CVE-2026-2446 Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options such as defaultrole etc and create arbitrary admin users...

CVE-2026-2446 Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options such as defaultrole etc and create arbitrary admin users...

CVE-2026-27005

creationtimestamp| type| source ---|---|--- 2026-03-06 05:55:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgemuhyhii2k...

CVE-2026-28681

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation...

CVE-2026-3560

creationtimestamp| type| source ---|---|--- 2026-03-06 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-158/ 2026-05-31 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn5qfwy5hx2x...

CVE-2026-3616

creationtimestamp| type| source ---|---|--- 2026-03-06 04:53:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgejflwmdm2n...

CVE-2026-29084 Gokapi: CSRF in Login Endpoint

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a...

CVE-2026-27807

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities e.g., assignment settings. These YAML files are parsed with aliases enabled. This issue has been patch...

CVE-2026-3610

creationtimestamp| type| source ---|---|--- 2026-03-06 04:14:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgeh74epfk27...

CVE-2026-28724

creationtimestamp| type| source ---|---|--- 2026-03-06 04:09:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgegvqn3qz27...

CVE-2026-28720

creationtimestamp| type| source ---|---|--- 2026-03-06 04:04:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgegnrbzur2e...

CVE-2026-26276

creationtimestamp| type| source ---|---|--- 2026-03-06 04:00:17+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mgegfntedm22...

CVE-2026-2589

creationtimestamp| type| source ---|---|--- 2026-03-06 02:43:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgec4zrymh2k...

CVE-2026-30861

creationtimestamp| type| source ---|---|--- 2026-03-06 02:38:40+00:00| published-proof-of-concept| https://github.com/Tencent/WeKnora/security/advisories/GHSA-r55h-3rwj-hcmg 2026-03-07 16:15:53+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-30861 2026-03-...

CVE-2026-28481

creationtimestamp| type| source ---|---|--- 2026-03-06 02:28:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgebc6knig2y...

CVE-2026-29611

creationtimestamp| type| source ---|---|--- 2026-03-06 02:19:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgearkm5r52y 2026-03-07 12:02:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghrrylhy425...

CVE-2026-28486

creationtimestamp| type| source ---|---|--- 2026-03-06 02:04:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mge7w4w5mz2u...

CVE-2026-28484

creationtimestamp| type| source ---|---|--- 2026-03-06 01:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mge7h76scz2u 2026-03-06 10:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf2judv3l2k 2026-03-06 10:01:31+00:00| seen|...

CVE-2026-25906

creationtimestamp| type| source ---|---|--- 2026-03-06 00:40:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mge37sqd562l...

PT-2026-23668

Name of the Vulnerable Software and Affected Versions WooCommerce versions 5.4.0 through 10.5.2 Description The WooCommerce WordPress plugin does not properly handle batch requests, potentially allowing unauthenticated users to execute administrative actions on non-store REST endpoints. This coul...