CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-15823

The Builderall Cheetah For Wp WordPress plugin (versions ≤ 3.0.2 ) contains a missing authorization flaw in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function is registered without a capability or nonce check, and the target post ID is read directly from user-controlled $_POST['b...

CVE-2026-79689

creationtimestamp| type| source ---|---|--- 2026-09-10 03:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv54eqtzed24...

CVE-2026-87607

creationtimestamp| type| source ---|---|--- 2026-09-10 01:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4v4bh7i42t 2026-09-10 05:15:18+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 08:07:07+00:00| seen|...

CVE-2026-87621

creationtimestamp| type| source ---|---|--- 2026-09-10 01:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4ukfajsa2p 2026-09-10 05:15:49+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 07:37:07+00:00| seen|...

CVE-2026-87527

creationtimestamp| type| source ---|---|--- 2026-09-10 00:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4tgo6dgh2w 2026-09-10 04:49:51+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 12:37:07+00:00| seen|...

PT-2026-89349

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-88894: Incorrect Authorization

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88062: Improper Control of Generation of Code

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

CVE-2026-15889: Improper Neutralization of Input During Web Page Generation

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

PT-2026-89722

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2026-54054: Server-Side Request Forgery (SSRF)

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-78083: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2025-57231: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

Empire v7.0.2

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

CVE-2026-87016

creationtimestamp| type| source ---|---|--- 2026-09-09 23:01:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4ndzoauy24 2026-09-10 22:35:05+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7 2026-09-16...

CVE-2026-87995

creationtimestamp| type| source ---|---|--- 2026-09-09 23:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4ndlgnru22 2026-09-10 16:35:12+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jmc6-2wr8-h3wj 2026-09-17...

CVE-2026-68484

creationtimestamp| type| source ---|---|--- 2026-09-09 22:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4mq2hgmx2p...

CVE-2026-61907

creationtimestamp| type| source ---|---|--- 2026-09-09 19:40:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/64kwekmjcusjz...

CVE-2026-22590

creationtimestamp| type| source ---|---|--- 2026-09-09 18:04:35+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mv44rkfwjm2w 2026-09-09 22:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4m67g7dc2y...