CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

PT-2026-81957

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-74851: Improper Control of Generation of Code

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin

On August 10th, 2026, we received a submission for an Unauthenticated Privilege Escalation vulnerability in Pods, a WordPress plugin with more than 100,000 active installations. This vulnerability allows unauthenticated attackers to escalate their privileges to administrator and perform various...

Exploit for CVE-2026-19598

🚨 CVE-2026-19598 https://plugins.trac.wordpress.org/browser/pod...

Exploit for CVE-2026-19598

CVE-2026-19598-PoC Proof of Concept for CVE-2026-19598 affecti...

CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

EUVD-2026-59778

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

CVE-2026-19598

Pods plugin

CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

CVE-2026-19598 Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

WordPress Pods plugin <= 3.3.9 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Nhien Pham nhienit - GalaxyOne in WordPress Plugin Pods versions 3.3-3.3.9...

PT-2026-73042

Name of the Vulnerable Software and Affected Versions Pods – Custom Content Types and Fields versions prior to 3.3.9.1 Description The Pods – Custom Content Types and Fields plugin for WordPress contains a privilege escalation flaw allowing unauthenticated attackers to gain Administrator privileg...

CVE-2026-19598: Incorrect Authorization

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

VulnCheck KEV: CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

CVE-2026-73667 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

CVE-2026-73667 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

CVE-2026-18608

The vulnerability CVE-2026-18608 affects the Data Science Pipelines Operator (DSPO). Its ClusterRole grants excessive privileges beyond what is needed, including pods/exec and cluster-wide role/binding control. If a DSPO pod is compromised, an attacker could leverage these permissions to achieve ...

CVE-2026-18608

A flaw was found in the Data Science Pipelines Operator DSPO. The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wi...

SUSE CVE-2026-41184

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the SERVICEACCOUNTTOKEN placeholder Canal/Flannel-Calico deployments, the installer substitutes the live Kubernetes ServiceAccount bearer token before logging,...