CVE-2025-14481

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481

The CVE concerns the WordPress Yoast SEO plugin (versions up to and including 26.5). The root cause is insufficient authorization checks in the Meta Search REST API endpoint, which fails to verify post ownership. This allows authenticated attackers with Contributor-level access or higher to read ...

CVE-2025-14481

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481 Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481 Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

EUVD-2025-209950

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2026-9631

creationtimestamp| type| source ---|---|--- 2026-05-27 04:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmsmniu4hc2n 2026-05-27 05:08:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsqhssf332h...

CVE-2026-35089

creationtimestamp| type| source ---|---|--- 2026-05-27 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-35087 2026-05-27 15:38:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmttnp42zq2c...

CVE-2026-35087

creationtimestamp| type| source ---|---|--- 2026-05-27 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-35087 2026-05-27 16:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtv4w342p2i...

CVE-2026-9627

creationtimestamp| type| source ---|---|--- 2026-05-27 03:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmsjdzvoso2w 2026-05-27 05:28:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsrkwg7wh2q...

CVE-2026-9022 Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute

The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-8606

creationtimestamp| type| source ---|---|--- 2026-05-27 01:48:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsfb74agt2i...

CVE-2026-9584

creationtimestamp| type| source ---|---|--- 2026-05-27 01:33:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsegdt5cw2q...

CVE-2026-9603

creationtimestamp| type| source ---|---|--- 2026-05-27 01:21:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsdry7r5r2h...

Exploit for Deserialization of Untrusted Data in Drupal

CVE-2019-6340 — Drupal RESTful Web Services RCE Python imple...

WordPress plugin Post Category Gallery 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-44045

Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.3 Description A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than 7.9.2...

WordPress plugin The Post Grid 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

free5GC 安全漏洞

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.2 contained security vulnerabilities. These vulnerabilities stemmed from SMF failing to include the necessary inbound OAuth2 middleware when mounting UPI management routing groups. Th...

PT-2026-43723

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ib uverbs post send function uses the wqe size variable from userspace without validation before passing it to kmalloc. If a small value is provided for wqe size, the system may...