44561 matches found
CVE-2026-75018: Missing Authorization
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...
PT-2026-86361
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...
PT-2026-86333
šØ CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and...
CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...
CVE-2026-85654
creationtimestamp| type| source ---|---|--- 2026-09-04 22:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupxnu7m6m2m 2026-09-08 18:30:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3muznq5uzq42v 2026-09-08 18:30:05+00:00| seen|...
CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-85702
creationtimestamp| type| source ---|---|--- 2026-09-04 21:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j74zbtuplef5k 2026-09-09 08:40:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv35a2rqrj2g 2026-09-09 08:40:15+00:00| seen|...
CVE-2026-79426
An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...
CVE-2026-79423
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
CVE-2026-85786
creationtimestamp| type| source ---|---|--- 2026-09-04 21:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupuci4ugc22 2026-09-10 02:40:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv4zmdvnk22b 2026-09-10 02:40:41+00:00| seen|...
CVE-2026-80119
creationtimestamp| type| source ---|---|--- 2026-09-04 20:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqxskiz62g 2026-09-10 04:20:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv577dvbel2x 2026-09-10 04:20:47+00:00| seen|...
CVE-2026-80116
creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwnrtul2v 2026-09-09 04:40:31+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv2ptqiwjx2b 2026-09-09 04:40:32+00:00| seen|...
CVE-2026-80114
creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwgw4gw2g 2026-09-09 07:10:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117239827757083424 2026-09-09 07:10:13+00:00| seen|...
WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability
Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...
CVE-2026-18175
creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkainfhn2z 2026-09-09 22:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4kdac7kj2p...
CVE-2026-19274
creationtimestamp| type| source ---|---|--- 2026-09-04 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupijajral2w 2026-09-04 18:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupknjyxry22 2026-09-05 23:01:21+00:00| seen|...
CVE-2026-18149
creationtimestamp| type| source ---|---|--- 2026-09-04 17:24:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w...
CVE-2026-18540
creationtimestamp| type| source ---|---|--- 2026-09-04 17:17:57+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muphtit3ps2w...
CVE-2026-84890
creationtimestamp| type| source ---|---|--- 2026-09-04 17:06:12+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muph6jb6xk2w 2026-09-12 08:40:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117257168610414149 2026-09-12 08:50:03+00:00| seen|...