EUVD-2026-30255

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwarsaverecipe AJAX handler. This makes it possible for unauthenticated...

CVE-2026-7481

creationtimestamp| type| source ---|---|--- 2026-05-14 06:40:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mls7jb7h3w2l 2026-05-14 07:52:53+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-14 2026-05-14 18:00:00+00:00| seen|...

CVE-2026-6271

creationtimestamp| type| source ---|---|--- 2026-05-14 06:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mls72nq6sn2q 2026-05-14 09:06:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlshon6mjj2k 2026-05-14 13:30:30+00:00| seen|...

CVE-2026-7525

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

CVE-2026-29206

creationtimestamp| type| source ---|---|--- 2026-05-14 03:54:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlrwb25mje2s 2026-05-20 06:20:46+00:00| seen| https://www.acn.gov.it/portale/w/cpanel-whm-e-wp-squared-poc-pubblico-per-lo-sfruttamento-della-cve-2026-29205...

CVE-2026-46419

creationtimestamp| type| source ---|---|--- 2026-05-14 03:54:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlrwasixhi2k...

CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

EUVD-2026-30217

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

CVE-2026-7525

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

CVE-2026-7525

The CVE pertains to WordPress plugin My Calendar – Accessible Event Manager (versions ≤ 3.7.9). It describes an authorization bypass: authenticated users with custom-level access can tamper with the POST body (e.g., event_approved) to publish events or set statuses (cancelled, private) beyond the...

CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

CVE-2026-6929

creationtimestamp| type| source ---|---|--- 2026-05-14 02:50:33+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mlrsoimqbh24...

CVE-2026-32991

creationtimestamp| type| source ---|---|--- 2026-05-14 02:46:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrsgkjgte2e 2026-05-20 06:20:46+00:00| seen| https://www.acn.gov.it/portale/w/cpanel-whm-e-wp-squared-poc-pubblico-per-lo-sfruttamento-della-cve-2026-29205...

CVE-2026-8500

creationtimestamp| type| source ---|---|--- 2026-05-14 02:36:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrrunabrp2h...

CVE-2026-44369

creationtimestamp| type| source ---|---|--- 2026-05-14 02:06:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrq5nn2oh2h...

CVE-2026-44381

creationtimestamp| type| source ---|---|--- 2026-05-14 00:33:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrkz6rkck2k...

CVE-2026-44377

creationtimestamp| type| source ---|---|--- 2026-05-14 00:23:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrkhavktp2k...

PT-2026-40896

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.3 Description Insufficient restrictions in the get post property from querystring function allow unauthenticated attackers to extract data from private, draft, or password-protected posts. Recommendations Updat...

PT-2026-40850

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...