CVE-2026-3139 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppbsaveavatarvalue function due to missing validation on a user controlled key...

CVE-2026-3139

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppbsaveavatarvalue function due to missing validation on a user controlled key...

CVE-2026-4317

creationtimestamp| type| source ---|---|--- 2026-03-31 10:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3midxuhnjb42i 2026-03-31 10:58:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midzgvh7s62o 2026-03-31 11:17:48+00:00| seen|...

CVE-2026-3881

creationtimestamp| type| source ---|---|--- 2026-03-31 09:55:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midvvg7m372j...

CVE-2026-5178

creationtimestamp| type| source ---|---|--- 2026-03-31 07:20:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midnaenxax27...

CVE-2026-5182

creationtimestamp| type| source ---|---|--- 2026-03-31 07:15:33+00:00| published-proof-of-concept| Telegram/1iWaApiUM0jOADSkCxbAhXY3iS1qKmB0s9RsJgnPCTY34SA 2026-03-31 10:27:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midxpf45p327...

CVE-2026-5179

creationtimestamp| type| source ---|---|--- 2026-03-31 07:15:33+00:00| published-proof-of-concept| Telegram/1iWaApiUM0jOADSkCxbAhXY3iS1qKmB0s9RsJgnPCTY34SA 2026-03-31 07:30:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midnsbjtwx2q...

CVE-2026-34054

creationtimestamp| type| source ---|---|--- 2026-03-31 04:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midc3x3gyw2p 2026-03-31 05:17:42+00:00| seen| Telegram/62pZ0M7EEU9QzqUpq3hJFXhFPR-ebrkyPJ1cBwC7xQpoTU0...

PT-2026-29383

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow HBO in CIccMpeSpectralMatrix::Describe. The issue is observable under AddressSanitizer as an out-of-bounds heap read when...

WordPress plugin User Profile Builder 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-29384

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a segmentation fault SEGV in CIccTagArray::Cleanup. The issue is observable under UBSan/ASan as misaligned member access / misaligned pointer...

PT-2026-29398

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate and output produced by CIccMBB::Describe via CLUT dumping. This issue has been patched in version 2.3.1....

PT-2026-29394

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior UB condition in IccUtil.cpp triggered by a crafted input profile. Under UndefinedBehaviorSanitizer, the issue is reported as invalid left shift...

PT-2026-29387

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile and TIFF input can trigger a heap-buffer-overflow HBO in CTiffImg::WriteLine. The issue is observable under AddressSanitizer as an out-of-bounds heap read...

PT-2026-29385

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack overflow SO in SIccCalcOp::ArgsUsed. The issue is observable under AddressSanitizer as a stack-overflow when iccApplyProfiles processes ...

PT-2026-29389

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior UB via a null-pointer member call in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions reported by UBSan as...

PT-2026-29382

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior UB in CIccCalculatorFunc::ApplySequence due to invalid enum values being loaded for icChannelFuncSignature. The issue is...

PT-2026-29224

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb save avatar value function due to missing validation on a user controlled key...

CVE-2026-33987

creationtimestamp| type| source ---|---|--- 2026-03-30 23:20:23+00:00| published-proof-of-concept| Telegram/dTdXmSClQuUutduSI7B7lq8U0lWyZCa4SY-4SfXv6kqarNA 2026-03-31 00:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3micuxx3kmo25 2026-04-04 11:20:09+00:00| seen|...

CVE-2026-21861

creationtimestamp| type| source ---|---|--- 2026-03-30 23:04:28+00:00| published-proof-of-concept| https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g 2026-03-30 23:16:35+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-21861...