CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

EUVD-2026-91455

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104438 YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

CVE-2026-13413

The CMP – Coming Soon & Maintenance WordPress plugin, in versions prior to 4.1.20 , contains an Improper Access Control (CWE-284) vulnerability. When maintenance or coming-soon mode is active, unauthenticated visitors can bypass the landing page to access hidden site content, including published ...

CVE-2026-94543: Use of Cache Containing Sensitive Information

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

PT-2026-104379

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions 16.x through 16.3.7 Description Self-hosted applications using the Pages Router with statically generated pages or Incremental Static Regeneration ISR can key a response cache entry...

PT-2026-104254

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

Linux Distros Unpatched Vulnerability : CVE-2026-94543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router wit...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-100512

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

CVE-2026-100512 WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

EUVD-2026-90220

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

CVE-2026-100512 WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

CVE-2026-100512

The WordPress Nested Pages plugin (versions

WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Nested Pages versions = 3.3.2...

EUVD-2026-89615

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

PT-2026-103483

Name of the Vulnerable Software and Affected Versions Nested Pages versions prior to 3.3.3 Description Nested Pages is subject to a PHP Object Injection issue. This occurs when untrusted data is passed to the unserialize function, allowing an attacker to inject malicious objects into the...

CVE-2026-100512: Deserialization of Untrusted Data

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-102279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a...