CVE-2026-57690

Unauthenticated Cross Site Request Forgery CSRF in Werkstatt = 4.7.2 versions...

CVE-2026-57689

Subscriber Broken Access Control in Werkstatt = 4.7.2 versions...

CVE-2026-57671

Unauthenticated Cross Site Scripting XSS in perfmatters = 2.6.4 versions...

CVE-2026-57357

Unauthenticated Cross Site Scripting XSS in Search Atlas SEO = 2.6.6 versions...

CVE-2026-57353

Subscriber Broken Access Control in Link Whisper Premium = 2.9.0 versions...

CVE-2026-57355

Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...

CVE-2025-69094

Subscriber SQL Injection in Unicamp = 2.2.2 versions...

USN-8398-4: nginx vulnerability

USN-8398-3 fixed a vulnerability in nginx. This update provides the corresponding fix for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A...

CVE-2026-57683

creationtimestamp| type| source ---|---|--- 2026-07-02 12:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpnyb2qfwu2w 2026-07-02 12:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116850270547831923 2026-07-02 21:48:04+00:00| seen|...

CVE-2026-54431

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

CVE-2026-54431

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

EUVD-2026-41313

Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...

CVE-2026-57753

The CVE-2026-57753 entry concerns the WordPress Kit (formerly ConvertKit) for WooCommerce plugin, affected versions 2.1.5 and earlier. Description indicates an unauthenticated sensitive data exposure vulnerability in these versions. The provided documents do not specify the exact root cause, vuln...

CVE-2026-57690 WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Werkstatt = 4.7.2 versions...

EUVD-2026-41299

Unauthenticated Cross Site Request Forgery CSRF in Werkstatt = 4.7.2 versions...

CVE-2026-57689

The CVE-2026-57689 entry concerns the WordPress Werkstatt theme (versions up to 4.7.2) with a Broken Access Control flaw. Affected component: Werkstatt WordPress theme; root cause: broken access control mechanisms in version &lt;= 4.7.2. Impact: unauthorized access to restricted functionality, as...

EUVD-2026-41296

Contributor SQL Injection in Custom Field Template = 2.7.8 versions...

CVE-2026-57687 WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability

Contributor SQL Injection in Custom Field Template = 2.7.8 versions...

CVE-2026-57685 WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme = 3.2.8 versions...

CVE-2026-57673

Technical details of CVE-2026-57673 are not publicly provided in the supplied documents. Monitor for updates from authoritative sources; the available entries indicate unauthenticated XSS in Optimole