WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability

Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...

CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-19085

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

EUVD-2026-63822

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19435

The Duplicate Post WordPress plugin (versions before 1.5.6 ) contains a vulnerability where it fails to verify user capabilities before returning post data. This allows users with a delegated role to perform unauthorized access to read the content, metadata, and passwords of posts they are not pe...

CVE-2026-19435 Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19435 Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

EUVD-2026-63823

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-19085

The Duplicate Post WordPress plugin (versions prior to 1.5.6 ) is vulnerable to an authorization bypass. The plugin fails to verify if a user has permission to read a post's content before duplicating it. This flaw allows users with a delegated role to republish another user's password-protected ...

CVE-2026-76131

creationtimestamp| type| source ---|---|--- 2026-08-21 04:19:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j3ybqejm7xu3h 2026-08-21 04:45:06+00:00| seen| https://jvn.jp/en/vu/JVNVU90210212...

SUSE CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-19085: Authorization Bypass Through User-Controlled Key

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19435: Exposure of Sensitive Information to an Unauthorized Actor

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

PT-2026-79308

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

PT-2026-79307

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-22681: Server-Side Request Forgery (SSRF)

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-77780: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-55241: Uncontrolled Resource Consumption

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...