CVE-2026-66593

CVE-2026-66593 is an unauthenticated SQL injection vulnerability in the WordPress plugin Security & Malware scan by CleanTalk , affecting versions ≤ 2.184 . The flaw allows a remote attacker to execute arbitrary SQL queries without authentication, leading to high confidentiality impact and low av...

CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-53999

The WordPress Altair theme (versions up to 5.2.2) has an unauthenticated broken access control flaw (CVSS 6.5, medium), exploitable remotely without credentials. An attacker can alter or disrupt functionality (low integrity/availability impact) but cannot read sensitive data. No fix version or ex...

EUVD-2025-210757

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

EUVD-2025-210756

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

CVE-2025-15689

The WordPress Capella theme (≤2.5.5) allows unauthenticated remote privilege escalation with no user interaction, rated CVSS 9.8 critical. No root cause, patch version, or exploit details are provided in the documents; see the Patchstack advisory for further information. Exploitation status is no...

CVE-2026-74021 WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

EUVD-2026-63328

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

CVE-2026-74021

WordPress Chaplin theme ≤2.6.8 has an unauthenticated broken access control flaw, allowing remote attackers to access restricted content (CVSS 7.5 HIGH, network/low-complexity, no auth). No patch version or exploit details are provided; update to a newer theme version when available.

Why "Shady AI" is Security's Next Big Governance Problem

In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI...

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Verdure Core versions = 1.2...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

EUVD-2026-63273

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool . The tool used a raw HTTP client to send requests to a user-supplied API URL, bypassing n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated ...

CVE-2026-77084 n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values

n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value wou...

CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...