WordPress RSS Aggregator by Feedzy plugin < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability

Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability discovered by Farid Narimanov in WordPress Plugin Feedzy versions 5.2.6...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

PT-2026-69375

Name of the Vulnerable Software and Affected Versions RSS Aggregator by Feedzy versions prior to 5.2.6 Description The plugin fails to verify if the requesting user owns or has permission to edit the specified import job. This allows users with author-level access or higher to permanently delete...

Import Job Fails with "No kopia manifests found in the repository"

Challenge Import jobs fail with the error: No kopia manifests found in the repository Full error: "cause": "file": "kasten.io/k10/kio/collections/kopia/operations.go:144", "function": "kasten.io/k10/kio/collections/kopia.GetLatestSnapshot", "linenumber": 144, "message": "No kopia...

CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints...