CVE-2026-9289 WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-9289 WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-9289

WordLift – AI powered SEO – Schema plugin for WordPress (versions up to and including 3.54.10 ) is vulnerable to unauthenticated sensitive information exposure via its JSON-LD REST API endpoints (/wordlift/v1/jsonld/). The root cause is that these routes are registered with a permission_callback ...

EUVD-2026-83565

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CLEANSTART-2026-BM99045 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CVE-2026-9289: Exposure of Sensitive Information to an Unauthorized Actor

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

PT-2026-95743

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata...

PT-2026-95805

Name of the Vulnerable Software and Affected Versions WordLift – AI powered SEO – Schema plugin for WordPress versions prior to 3.54.11 Description Sensitive information exposure occurs via the JSON-LD REST API endpoints. The plugin registers the '/wordlift/v1/jsonld/' routes, specifically...

WordPress WordLift – AI powered SEO – Schema plugin <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints vulnerability

Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin WordLift versions = 3.54.10...

CVE-2026-93432

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

DEBIAN-CVE-2026-92747

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...

CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-92747 Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...

EUVD-2026-83259

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-93432 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-93432 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-93432

A flaw in the Quarkus Qute template engine (io.quarkus.qute:quarkus-core) allows Cross-Site Scripting (XSS) and JSON Injection . When the {#eval} section helper processes a sub-template, it fails to propagate the parent template's content type, causing untrusted data to be emitted as raw, unescap...

CVE-2026-93432

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...