40935 matches found
CVE-2026-32299
creationtimestamp| type| source ---|---|--- 2026-03-23 22:43:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr53alsvy2q 2026-03-25 02:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhtzo455hr2i...
CVE-2026-32276
creationtimestamp| type| source ---|---|--- 2026-03-23 22:30:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4f4hwqo2c 2026-03-23 22:31:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4fviqoh2f 2026-03-23 23:34:10+00:00| seen|...
CVE-2026-32913
creationtimestamp| type| source ---|---|--- 2026-03-23 22:29:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4cjbbof2e 2026-03-23 23:14:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr6slkvs22p 2026-03-24 12:00:04+00:00| published-proof-of-concept|...
CVE-2026-4066
The CVE concerns the Smart Custom Fields plugin for WordPress (affected: all versions up to and including 5.0.6). A missing capability check in relational_posts_search() allows authenticated users with Contributor-level access or higher to read private and draft posts from other authors via the s...
CVE-2026-32910
CVE-2026-32910 affects OpenClaw prior to 2026.3.1. The vulnerability is an approval bypass in the system.run flow where non-path-like argv[0] tokens fail to bind executable identity, allowing post-approval executable rebind. Practically, an attacker can modify PATH resolution after approval to ex...
EUVD-2024-55496
A Reflected Cross-Site Scripting XSS vulnerability exists in the POST request data zipPath of tiki-adminsystem.php in Tiki version 21.2. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or...
WordPress Post Affiliate Pro plugin <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field vulnerability
Authenticated Administrator+ Server-Side Request Forgery via 'Post Affiliate Pro URL' Field vulnerability discovered by Phap Nguyen Anh - FIS in WordPress Plugin Post Affiliate Pro versions = 1.28.0...
WordPress Multi Post Carousel by Category plugin <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'slides' Shortcode Attribute vulnerability discovered by zaim in WordPress Plugin Multi Post Carousel by Category versions = 1.4...
WordPress Post Flagger plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'slug' Shortcode Attribute vulnerability discovered by zakaria in WordPress Plugin Post Flagger versions = 1.1...
CVE-2026-33723
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save method in objects/subscribe.php concatenates the $this-usersid property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from...
CVE-2026-33517
creationtimestamp| type| source ---|---|--- 2026-03-23 19:16:27+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33517 2026-03-23 22:39:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr4ufbdb72g...
CVE-2026-30849
creationtimestamp| type| source ---|---|--- 2026-03-23 19:16:25+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-30849 2026-03-23 22:49:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr5gictm72f 2026-07-12 13:00:03+00:00|...
WordPress Company Posts for LinkedIn plugin <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary LinkedIn Post Data Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Company Posts for LinkedIn versions = 1.0.0...
WordPress Easy Image Gallery plugin <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery SHORTCODE Post Meta vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Gallery SHORTCODE Post Meta vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Easy Image Gallery versions = 1.5.3...
WordPress MimeTypes Link Icons plugin <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content vulnerability
Authenticated Contributor+ Server-Side Request Forgery via Crafted Links in Post Content vulnerability discovered by Kai Aizen in WordPress Plugin MimeTypes Link Icons versions = 3.2.20...
CVE-2026-33723
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save method in objects/subscribe.php concatenates the $this-usersid property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from...
WordPress Any Post Slider plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'posttype' Shortcode Attribute vulnerability discovered by zaim in WordPress Plugin Any Post Slider versions = 1.0.4...
WordPress Sherk Custom Post Type Displays plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'title' Shortcode Attribute vulnerability discovered by theviper17y in WordPress Plugin Sherk Custom Post Type Displays versions = 1.2.1...
CVE-2026-33716
creationtimestamp| type| source ---|---|--- 2026-03-23 17:42:04+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2 2026-03-23 19:19:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqrox7irw2e 2026-03-23 20:44:07+00:0...