CVE-2026-13404

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404

The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to an authorization bypass. The software fails to perform proper capability or ownership checks when writing like-count and visitor-tracking post meta, relying instead on a publicly-scrapeable nonce . This f...

EUVD-2026-66266

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-79282

creationtimestamp| type| source ---|---|--- 2026-08-26 04:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtxhmgfdze2t 2026-08-26 05:19:36+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-26 11:17:43+00:00| seen|...

CVE-2026-66152

creationtimestamp| type| source ---|---|--- 2026-08-26 01:42:39+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mtx7et2zyz2q 2026-08-26 12:30:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydkyf5re2o 2026-09-24 22:45:52+00:00| seen|...

CVE-2026-63074

creationtimestamp| type| source ---|---|--- 2026-08-26 01:09:35+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mtx5jnfojs24 2026-08-26 12:35:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydtvyhrf2r 2026-08-27 04:07:29+00:00| seen|...

CVE-2026-65637

creationtimestamp| type| source ---|---|--- 2026-08-26 00:54:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4q2jod4or3iqp 2026-08-26 12:30:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydl6w76z2k 2026-08-27 16:00:08+00:00| seen|...

CVE-2026-65183

creationtimestamp| type| source ---|---|--- 2026-08-26 00:48:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/75todjuu5eek7 2026-08-26 12:30:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydl6w76z2k...

EUVD-2026-66132

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

CVE-2026-80138

creationtimestamp| type| source ---|---|--- 2026-08-26 00:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwzq5epzv2u 2026-08-26 00:08:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtx23pmcxz25 2026-08-26 01:50:06+00:00| seen|...

CVE-2026-48549: Cross-Site Request Forgery (CSRF)

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute...

CVE-2026-48786: Exposure of Sensitive Information to an Unauthorized Actor

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

PT-2026-81943

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

PT-2026-82217

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.0 Description The software accepts a caller-supplied post-authentication redirect target and appends the issued token to it. The SamlLoginServlet reads the callback request parameter and stores it in the HTTP...

CVE-2026-13404: Authorization Bypass Through User-Controlled Key

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-80186

creationtimestamp| type| source ---|---|--- 2026-08-25 22:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwwbvvglr27...

CVE-2026-79787

creationtimestamp| type| source ---|---|--- 2026-08-25 20:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwmp5yebg2p 2026-08-26 01:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtx4yr622p23...