CVE-2026-66256

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-66256

A deserialization of untrusted data vulnerability exists in Apache Shindig (all versions), specifically within the OpenSocial REST API via XStream deserialization . Attackers with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server....

CVE-2026-66443

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

EUVD-2026-57868

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443

CVE-2026-66443 affects the WordPress REST API Log plugin, specifically versions

EUVD-2026-57938

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

CVE-2026-27543

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges ca...

CVE-2026-15413

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

CVE-2026-15413 Link Factory - Backdoor

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

CVE-2026-15413 Link Factory - Backdoor

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

CVE-2026-15413

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

EUVD-2026-57747

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

CVE-2026-15413

The CVE-2026-15413 entry concerns the Link Factory WordPress plugin, described as a backdoor. It exposes an operator-controlled REST API at /wp-json/link-factory/v1/ authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (health check excluded). The vulnera...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' through the OnmsJexlUberspect.getMethod method in the Measurements REST API. An attacker can load arbitrary Java classes on the server by submitting a...

WordPress Eventin plugin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API vulnerability

Contributor+ Customer PII Disclosure via REST API vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.20...

CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

CVE-2026-19182

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...