CVE-2026-77788 Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2026-77788

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , contains an authorization bypass vulnerability. The plugin fails to verify that a metadata row being updated belongs to the specific object the user is authorized to access. This flaw allows users with the Author role or higher to...

CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77787

The Rank Math SEO WordPress plugin (versions before 1.0.277 ) contains a vulnerability where it fails to perform a capability check during bulk metadata updates for taxonomy terms. The application also reuses the supplied object identifier across different object types. This allows users with the...

EUVD-2026-69841

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-77784

The Rank Math SEO WordPress plugin (versions before 1.0.277 ) contains an authorization bypass vulnerability. The plugin fails to verify if a user is permitted to edit an object before updating its SEO indexing metadata . This allows users with the Author role or higher to modify metadata on cont...

CVE-2026-77782

The Rank Math SEO WordPress plugin, in versions before 1.0.277.1 , is vulnerable to an unauthenticated content disclosure. The flaw exists because the plugin fails to verify if a post is password protected before utilizing its content to generate publicly accessible SEO metadata . This allows una...

CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2020-0155

creationtimestamp| type| source ---|---|--- 2026-09-02 05:00:04+00:00| seen| Telegram/FxPwD2QYmiA5ZVhY8rKhgPR6q1a7u8sU2ARM9Vm3CjRJJs0 2026-09-03 00:00:44+00:00| published-proof-of-concept| Telegram/FxPwD2QYmiA5ZVhY8rKhgPR6q1a7u8sU2ARM9Vm3CjRJJs0...

SUSE CVE-2026-84196

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

PT-2026-84622

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

PT-2026-84837

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.12 Description An integer underflow exists in the container box parser. On 32-bit platforms, 64-bit box sizes are truncated to size t, allowing remote attackers to provide a specially crafted JPEG XL file. This cause...

PT-2026-84771

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

PT-2026-84791

Name of the Vulnerable Software and Affected Versions Jenkins SAML Plugin versions prior to 4.618.v441a 27fa 46d2 Description Improper access control allows authenticated users to overwrite the SAML identity provider metadata file via Stapler data binding. This enables an attacker to replace the...

PT-2026-84860

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.10.3-lts and earlier Description An authenticated workspace user can perform a Server-Side Request Forgery SSRF via the knowledge web-document import and synchronization crawler. The application passes a user-supplied URL to t...

PT-2026-84832

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only t...

PT-2026-84619

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

PT-2026-84621

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

PT-2026-84800

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...