49454 matches found
CVE-2026-12000 Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...
EUVD-2026-53187
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2026-7753
creationtimestamp| type| source ---|---|--- 2026-08-05 06:36:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hyzljjuhq4ge2 2026-08-06 04:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msf6l3vo4x2n 2026-08-06 04:15:09+00:00| seen|...
Malicious code in ethers-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04 [email protected] impersonates the ethers.js ecosystem name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on...
CVE-2026-18898
creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msctyngfho2a 2026-08-05 08:52:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msd5lxeuo32c...
CVE-2026-17515
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin, in versions prior to 7.0.4 , is vulnerable to sensitive information disclosure. The root cause is a lack of authorisation and CSRF checks in one of its AJAX actions (specifically mlsimport_logger_per_item). This fla...
CVE-2026-16055 Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...
CVE-2026-17515 MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...
EUVD-2026-53103
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public draft, private, and pending posts on sites that have a captcha provider...
CVE-2020-9687
creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:08+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:56+00:00| seen| https://t.me/timcorehacking/946...
CVE-2020-13640
creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:04+00:00| seen| https://t.me/timcorehacking/919 2026-08-06 00:00:55+00:00| seen| https://t.me/timcorehacking/919 2026-09-08 00:00:06+00:00| seen| Telegram/B-15478wwQOjMOaoaVA0h8pku4eXhSRPXQWjKT1NHNCbCU8 2026-09-08 00:00:07+00:00| seen|...
CVE-2020-9683
creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:04+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:55+00:00| seen| https://t.me/timcorehacking/946...
CVE-2020-13754
creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:04+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:56+00:00| seen| https://t.me/timcorehacking/946...
CVE-2026-18322 Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...
CVE-2026-18907
creationtimestamp| type| source ---|---|--- 2026-08-05 02:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/iz6wskxiikwcm 2026-08-12 08:00:04+00:00| published-proof-of-concept| Telegram/vuQdXmMeT7ZjueM2JhgohUlB-sFrZ38VMxRjw40hYCSTaE 2026-08-13 00:00:44+00:00|...
CVE-2026-18896
creationtimestamp| type| source ---|---|--- 2026-08-05 02:36:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bpk4apcdf5lm7...
CVE-2026-18856
creationtimestamp| type| source ---|---|--- 2026-08-05 02:27:48+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msci47xh4s2g...
MAL-2026-12065 Malicious code in greatcall-customers-commandapi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9 [email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declare...
Malicious code in aedes_clusters (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...