CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-85132

WPLP Cookie Consent WordPress plugin versions 4.0.2 through 4.4.1 fail to perform nonce or capability checks on the gcc_get_schedule_scan AJAX action. This allows any authenticated user at subscriber level or above to read back the automated cookie scan schedule configured by the administrator. T...

WordPress WPLP Cookie Consent plugin 4.0.2-4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure vulnerability

Subscriber+ Cookie Scan Schedule Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.2-4.4.1...

EUVD-2026-74712

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

WordPress Masteriyo LMS plugin 1.3.1-2.3.3 - Unauthenticated Course Enrollment Disclosure vulnerability

Unauthenticated Course Enrollment Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.3.1-2.3.3...

CVE-2026-81021 SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

EUVD-2026-74707

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-81022

The SupportCandy WordPress plugin (versions 3.3.6 through 3.5.2 ) fails to validate a submitted per-ticket authorization code before disclosing the real code to the requester. This allows unauthenticated attackers over the network to read the contents of any support ticket by exploiting the autho...

EUVD-2026-74708

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

CVE-2026-81022 SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

WordPress SupportCandy plugin 3.3.6-3.5.2 - Unauthenticated Ticket Content Disclosure vulnerability

Unauthenticated Ticket Content Disclosure vulnerability discovered by Mitre Osman Hussein in WordPress Plugin SupportCandy versions 3.3.6-3.5.2...

EUVD-2026-74704

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-16960

The Loops & Logic WordPress plugin (versions before 4.3.0 ) exposes an unrestricted public template-data action , allowing unauthenticated users to read arbitrary user records—including email addresses and roles —as well as arbitrary site options. The root cause is a missing permission check on t...

CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

EUVD-2026-74701

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

Blue-Borne

Blue-Borne BlueBorne Exploits & Framework Este repositorio contiene código PoC de varios exploits para las vulnerabilidades BlueBorne. En la carpeta 'android' se pueden encontrar exploits para la vulnerabilidad RCE de Android CVE-2017-0781 y la vulnerabilidad de fuga de información SDP...

CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

CVE-2026-21108

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information...

veeam-cve-2023-27532-mock

CVE-2023-27532 - Vulnerabilidad en Veeam Backup & Replication Descripción de la vulnerabilidad Veeam Backup & Replication contiene una vulnerabilidad que permite obtener las credenciales cifradas almacenadas en la base de datos de configuración, lo que permite a los atacantes acceder a los hosts ...