PT-2026-81948

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2026-16984: Improper Access Control

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

WordPress My Agile Privacy® plugin <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions vulnerability

Missing Authorization to Unauthenticated Plugin Settings Modification via mapmissingcookieshield / mapcheckconsentmodestatus AJAX Actions vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin My Agile Privacy versions = 3.3.6...

CVE-2026-17587

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is affected by an authorization bypass in all versions up to and including 3.3.6 . The root cause is missing access-control checks on the map_missing_cookie_shield and map_check_consent_mode_status AJAX actions, allowing...

EUVD-2026-65461

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587 My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587 My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

The County Prosecutors Who Became ICE Informants

Illinois prosecutors shared defendants’ personal data with federal immigration agents without criminal warrants, public disclosure, or legislative oversight...

CVE-2026-17587: Missing Authorization

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-78380

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

CVE-2026-78380

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market it belong...

EUVD-2026-64857

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

CVE-2026-78380 Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

PT-2026-81266

Name of the Vulnerable Software and Affected Versions My Agile Privacy® – CMP, Cookie Consent & Privacy Tools versions prior to 3.3.7 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...

PT-2026-80869

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

Mitigating Explanation Leakage in Financial Fraud Detection Systems

Financial fraud detection relies heavily on centralized machine learning models. This creates serious data privacy risks. Federated Learning FL decentralizes data processing, but financial regulations still require models to be transparent. This means using Explainable AI XAI tools such as...

aindy-runtime (>=1.8.0, <=2.6.0), docassemble-base (1.10.6) +7 more potentially affected by CVE-2026-62384 via nltk (>=3.10.0, <=3.10.1)

nltk PYPI version =3.10.0, =1.8.0, =0.2.12, =4.0.0, =0.2.0, =0.2.15 Source cves: CVE-2026-62384 Source advisory: OSV:PYSEC-2026-3789...

TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit

The U.S. Department of Justice DoJ announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of violating child privacy laws in the country. As part of the settlement, the social media platform will pay $300 million immediately, and an...

CVE-2026-13736

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...