39903 matches found
CVE-2026-77784
The Rank Math SEO WordPress plugin (versions before 1.0.277 ) contains an authorization bypass vulnerability. The plugin fails to verify if a user is permitted to edit an object before updating its SEO indexing metadata . This allows users with the Author role or higher to modify metadata on cont...
CVE-2026-77783 Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
EUVD-2026-69837
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
CVE-2026-77782
The Rank Math SEO WordPress plugin, in versions before 1.0.277.1 , is vulnerable to an unauthenticated content disclosure. The flaw exists because the plugin fails to verify if a post is password protected before utilizing its content to generate publicly accessible SEO metadata . This allows una...
WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability
Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...
CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
PT-2026-84620
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...
CVE-2026-77785: Authorization Bypass Through User-Controlled Key
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...
CVE-2026-77784: Authorization Bypass Through User-Controlled Key
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...
PT-2026-84621
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...
CVE-2026-77783: Authorization Bypass Through User-Controlled Key
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
CVE-2026-77782: Exposure of Sensitive Information to an Unauthorized Actor
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
PT-2026-84619
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...
PT-2026-84622
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...
PT-2026-84617
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
PT-2026-84618
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
CVE-2026-77788: Authorization Bypass Through User-Controlled Key
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...
CVE-2026-77787: Missing Authorization
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...
hdf5: HDF5: Denial of Service due to malformed chunk data in files
A flaw was found in HDF5. An attacker can craft a malicious HDF5 file that, when opened and read by an application, exploits a validation bypass. This bypass, related to mismatched chunk-layout dimensionality and dataspace rank, leads to a divide-by-zero error, causing a denial of service DoS and...