CVE-2026-67180

creationtimestamp| type| source ---|---|--- 2026-08-11 17:02:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mst3r2gzln24...

CVE-2026-73079

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

CVE-2026-72596

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

EUVD-2026-56035

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72596

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72596 Ghost Foundation Ghost - Broken Access Control

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72596 Ghost Foundation Ghost - Broken Access Control

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72596

CVE-2026-72596 affects Ghost Foundation Ghost 5.x. A broken access control flaw allows authenticated users with the Author role to delete posts owned by others. The root cause is in the post model permissible() cascade: it lacks the branch that handles the combined isAuthor and isDestroy conditio...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

WordPress Ultimate Post Kit Addons for Elementor plugin <= 4.2.0 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Post Kit versions = 4.2.0...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-24330

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

CVE-2026-24330

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

PT-2026-70056

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 Description Insufficient input sanitization and output escaping in the post meta Shortcode allow authenticated attackers with Contributor-level access or highe...

CVE-2026-69115: Missing Authorization

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

PT-2026-70140

Name of the Vulnerable Software and Affected Versions Ghost Foundation Ghost versions 5.x Description An issue with broken access control allows authenticated users with the Author role to delete posts belonging to other users. This occurs because the permissible function in the post model lacks ...

CVE-2026-72596: Improper Access Control

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72598: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...