CVE-2026-2373 Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the getmainqueryargs function due to insufficient restrictions on which posts can be included. This makes it possib...

CVE-2026-2373 Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the getmainqueryargs function due to insufficient restrictions on which posts can be included. This makes it possib...

CVE-2026-33067

creationtimestamp| type| source ---|---|--- 2026-03-17 00:49:57+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mvpm-v6q4-m2pf 2026-03-20 10:09:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhibldx3oz27...

CVE-2026-33066

creationtimestamp| type| source ---|---|--- 2026-03-17 00:49:21+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4663-4mpg-879v 2026-03-20 09:58:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhiawcd5np27 2026-04-17 03:38:28+00:00...

CVE-2026-22730

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0305/ 2026-03-17 13:25:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhb3464rsu2n 2026-03-17 14:13:42+00:00| seen|...

CVE-2026-23554

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0304/ 2026-03-17 13:25:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhb34ejclh2b 2026-03-18 00:00:00+00:00| seen|...

CVE-2026-23555

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0304/ 2026-03-17 13:25:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhb34ejclh2b 2026-03-23 08:13:15+00:00| seen|...

MongoDB Server 安全漏洞

MongoDB Server is an open-source NoSQL database developed by MongoDB, a US-based company. This database offers features such as collection-oriented storage, dynamic querying, data replication, and automatic failover. There is a security vulnerability in MongoDB Server, which can be triggered when...

WordPress Plugin Easy Post Submission Has Unspecified Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin Easy Post Submission, which stems from ...

CVE-2026-4224

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0302/ 2026-03-17 13:30:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhb3er3v2c2v 2026-04-02 12:01:02+00:00| seen|...

PT-2026-25870

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get main query args function due to insufficient restrictions on which posts can be included. This makes it...

RHEL 9 : python3.12 (RHSA-2026:4746)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4746 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

GHSA-G375-5WMP-XR78 Admidio is Missing Authorization on Forum Topic and Post Deletion

Summary The forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topicdelete and postdelete actions in forum.php only validate the CSRF token but perform no authorization check before calling delete. Any authenticated user with...

Missing Authorization

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Missing Authorization in the topicdelete and postdelete processes. An attacker can remove any forum topic, including all associated...

Admidio is Missing Authorization on Forum Topic and Post Deletion

Summary The forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topicdelete and postdelete actions in forum.php only validate the CSRF token but perform no authorization check before calling delete. Any authenticated user with...

Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Summary The eCard send handler in Admidio uses the raw $POST'ecardmessage' value instead of the HTMLPurifier-sanitized $formValues'ecardmessage' when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent t...

GHSA-4WR4-F2QF-X5WJ Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Summary The eCard send handler in Admidio uses the raw $POST'ecardmessage' value instead of the HTMLPurifier-sanitized $formValues'ecardmessage' when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent t...

Cross-site Request Forgery (CSRF)

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the savemembership process. An attacker can alter membership start and end dates for any member of...

CVE-2026-32873

creationtimestamp| type| source ---|---|--- 2026-03-16 20:49:50+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-4w98-xf39-23gp 2026-03-20 01:52:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhfrsmfpq2k...

Integer Overflow or Wraparound

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the getUploadLength function. An attacker can repeatedly trigger post-upload hooks with arbitrary filenames and empty file contents by...