PT-2026-84771

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-77784: Authorization Bypass Through User-Controlled Key

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

PT-2026-84833

An authorization flaw in the REST API repository details endpoint GET /service/rest/v1/repositories/repositoryName in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct...

PT-2026-84791

Name of the Vulnerable Software and Affected Versions Jenkins SAML Plugin versions prior to 4.618.v441a 27fa 46d2 Description Improper access control allows authenticated users to overwrite the SAML identity provider metadata file via Stapler data binding. This enables an attacker to replace the...

PT-2026-84621

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-77122: Incorrect Authorization

An authorization flaw in the REST API repository details endpoint GET /service/rest/v1/repositories/repositoryName in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct...

CVE-2026-77787: Missing Authorization

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

PT-2026-84617

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions...

CVE-2024-7952

creationtimestamp| type| source ---|---|--- 2026-09-01 20:15:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3xjmqdexrl73s...

CVE-2017-7521

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:52+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-02 01:03:29+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-08 20:00:04+00:00| published-proof-of-concept|...

CVE-2021-23995

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:46+00:00| seen| https://t.me/hackingAttack/5839 2026-09-02 01:03:22+00:00| seen| https://t.me/hackingAttack/5839 2026-09-08 10:00:06+00:00| seen| https://t.me/hackingAttack/5839 2026-09-09 00:00:33+00:00| seen|...

CVE-2021-38603

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:28+00:00| seen| https://t.me/hackingAttack/20129 2026-09-02 01:03:01+00:00| seen| https://t.me/hackingAttack/20129 2026-09-07 19:00:03+00:00| published-proof-of-concept| https://t.me/hackingAttack/20129 2026-09-08 00:00:27+00:00|...

CVE-2022-33077

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/72963 2026-09-02 01:01:35+00:00| seen| https://t.me/hackingAttack/72963 2026-09-05 06:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/72963 2026-09-06 00:00:55+00:00|...

CVE-2023-40286

creationtimestamp| type| source ---|---|--- 2026-09-01 20:00:46+00:00| seen| https://t.me/hackingAttack/121668 2026-09-02 01:01:06+00:00| seen| https://t.me/hackingAttack/121668 2026-09-04 03:00:04+00:00| seen| https://t.me/hackingAttack/121668 2026-09-05 01:00:42+00:00| seen|...

EUVD-2026-69571

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

CVE-2026-78603

Missing Authorization (CWE-862) in Kibana allows an authenticated user with minimal Elasticsearch privileges to bypass feature authorization and space access controls , leading to unauthorized disclosure of Fleet deployment metadata from the default Kibana space. The vulnerability leverages incor...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-84303

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as...

CVE-2026-19592

The OpenAI Codex CLI (versions 0.102.0 through 0.130.0) and Codex Desktop (macOS versions 260202.0859 through 26.513.31313; Windows versions 26.304.38 through 26.513.40821 and Microsoft Store package 26.304.38.0 through 26.513.4821.0) are vulnerable to remote code execution via the GitSpawn flaw....