CVE-2026-59233: Authorization Bypass Through User-Controlled Key

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

PT-2026-69677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Out-of-bounds reads occur in three sideband reply parsers when reading 16-bit fields. The issue arises because bounds are checked only after the read operation. Specifically, when the...

CVE-2026-19369

creationtimestamp| type| source ---|---|--- 2026-08-09 22:42:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dzrqtrm37fwwb...

CVE-2026-67622

creationtimestamp| type| source ---|---|--- 2026-08-09 16:00:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnxegt2qg2h 2026-08-10 17:18:10+00:00| seen| https://gist.github.com/haidang-infosec/402db84bee7aca2f57bb109b31574649...

CVE-2026-67621

creationtimestamp| type| source ---|---|--- 2026-08-09 16:00:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnxea4z4f2u...

CVE-2026-15153

creationtimestamp| type| source ---|---|--- 2026-08-09 14:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msnrkhs5la26...

CVE-2026-70628

creationtimestamp| type| source ---|---|--- 2026-08-09 14:02:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnqoqqo7y27...

CVE-2026-71947

creationtimestamp| type| source ---|---|--- 2026-08-09 14:02:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117065912163705973...

CVE-2026-19351

creationtimestamp| type| source ---|---|--- 2026-08-09 12:52:41+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msnmvbvrda2j 2026-08-10 11:39:42+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mspzbq3juj2w...

CVE-2026-19281

creationtimestamp| type| source ---|---|--- 2026-08-09 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3msnisozdov2l...

CVE-2026-19190

creationtimestamp| type| source ---|---|--- 2026-08-09 09:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msn7wj4u3225...

CVE-2026-14364

creationtimestamp| type| source ---|---|--- 2026-08-09 09:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msn7w3xarw24...

CVE-2026-14221

creationtimestamp| type| source ---|---|--- 2026-08-09 07:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msn23hz4ck2f...

CVE-2026-18603

creationtimestamp| type| source ---|---|--- 2026-08-09 06:31:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5gu4ns4p4elmp...

CVE-2026-16957

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-16965

The Solace Extra WordPress plugin versions prior to 1.6.1 is vulnerable to an authorization bypass because it fails to perform capability or nonce checks in one of its AJAX actions. Specifically, the solace update sitebuilder status action allows any authenticated user, such as a subscriber , to ...

CVE-2026-16957

The Slim SEO WordPress plugin versions prior to 4.9.11 contains a vulnerability where a post-meta preview feature fails to properly restrict access. The component verifies only read access instead of ensuring the user is authorized to edit the specific post. This allows users with the Contributor...