CVE-2026-78380 Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

WordPress YMC Smart Filter plugin < 3.11.3 - Unauthenticated Private/Draft Post Disclosure vulnerability

Unauthenticated Private/Draft Post Disclosure vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Filter & Grids versions 3.11.3...

WordPress Copy & Delete Posts plugin < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure vulnerability

Authenticated Arbitrary Post Content and Password Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress Copy & Delete Posts plugin < 1.5.6 - Author+ Password-Protected Post Content Disclosure vulnerability

Author+ Password-Protected Post Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

CVE-2026-77003: Improper Privilege Management

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

PT-2026-79307

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.6 Description Insufficient validation occurs when duplicating posts, as the plugin fails to verify if the user has permission to read the content before the duplication process. This allows...

WordPress Copy & Delete Posts plugin < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization vulnerability

Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Duplicate Post versions 1.5.5...

CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

CVE-2025-11729: Improper Authorization

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

CVE-2026-55704

Discourse serializes shared-draft topics and posts through the group posts and group mentions endpoints regardless of draft-view permissions, leaking unpublished draft titles and content to any group-activity viewer. Affected versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are fixed ...

EUVD-2026-60237

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

CVE-2026-55704 Discourse: Shared-draft titles and excerpts leak through group post serialization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

CVE-2026-55704

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

CVE-2026-55704 Discourse: Shared-draft titles and excerpts leak through group post serialization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

CVE-2026-55704 Discourse: Shared-draft titles and excerpts leak through group post serialization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

PT-2026-76682

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Users permitted to view group activity but restricted from seeing shared drafts can...

CVE-2026-55704: Missing Authorization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

Malicious code in @zalastax/nolb-posts (npm)

The package @zalastax/nolb-posts was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-18035: Missing Authorization

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...