49474 matches found
CVE-2026-15231
The Tag, Category, and Taxonomy Manager (also known as TaxoPress ) WordPress plugin, in versions before 3.51.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived ...
CVE-2026-16274
The Classified Listing WordPress plugin versions prior to 5.4.4 is vulnerable to unauthorized content disclosure via the rtcl_block_css_get_posts AJAX action. The root cause is a failure to perform capability or ownership checks , allowing users with contributor-level access and above to read any...
CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...
CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
EUVD-2026-52162
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
EUVD-2026-52163
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...
CVE-2026-64814
creationtimestamp| type| source ---|---|--- 2026-08-03 05:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3ms5rquz3q42y...
CVE-2024-38798
creationtimestamp| type| source ---|---|--- 2026-08-03 04:09:39+00:00| seen| https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3ms5muf6wbrl2...
Measuring Post-Quantum TLS Deployment across UK Internet Sectors
Post-quantum cryptography PQC is becoming an important component of long-term trust in Internet-facing infrastructure. Publicly observable PQC support provides evidence of externally visible deployment, but does not necessarily reflect the overall progress of an organisation's post-quantum...
PT-2026-67633
Name of the Vulnerable Software and Affected Versions Zyxel WAX650S versions prior to 7.10ABRM.4C0 Description A post-authentication command injection issue exists in the "export-cgi" CGI program. This allows an authenticated attacker with administrator privileges to execute arbitrary operating...
PT-2026-67062
Name of the Vulnerable Software and Affected Versions Tag, Category, and Taxonomy Manager versions prior to 3.51.0 Description This issue occurs because the plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived data. Consequently,...
CVE-2026-16057: Missing Authorization
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
PT-2026-67341
CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...
PT-2026-67103
Name of the Vulnerable Software and Affected Versions Classified Listing WordPress plugin versions prior to 5.4.4 Description An AJAX action that returns post content fails to perform necessary capability or ownership checks. This allows users with contributor-level access or higher to read the...
CVE-2026-18089: Improper Verification of Cryptographic Signature
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...
CVE-2026-56673
creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o6frjq32t...
CVE-2026-56672
creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o675pfx2b...
CVE-2026-67356
creationtimestamp| type| source ---|---|--- 2026-08-02 16:12:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4es7oylx2x...
CVE-2026-68578
creationtimestamp| type| source ---|---|--- 2026-08-02 14:01:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45i7bwtm2t 2026-08-03 02:39:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117029256627432016...