EUVD-2026-51942

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...

CVE-2026-16042

The CVE-2026-16042 entry concerns the LWS Optimize WordPress plugin before version 3.4. The underlying issue is a missing capability check on cache-clearing actions, which allows any authenticated user, including Subscribers, to flush site caches and trigger repeated cache rebuilds. Documented im...

CVE-2026-16042

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...

CVE-2026-16042 LWS Optimize < 3.4 - Subscriber+ Cache Deletion

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...

EUVD-2026-51939

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

CVE-2026-11872

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

CVE-2026-14938

CVE-2026-14938 affects the FluentBoards WordPress plugin prior to 1.95.3. The issue: during a board import, the plugin does not verify that selected items belong to a board the requesting user is authorized to access, allowing any authenticated user with member access on a single board to copy/re...

CVE-2026-14938

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks including...

EUVD-2026-51931

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks including...

CVE-2026-14938 FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks including...

Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features

Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...

Exposure Of Sensitive Information To An Unauthorized Actor

linuxfabrik-lib is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to lib.url.fetch following cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, which allows an attacker controlling a...

CVE-2026-67343

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67340

ArcadeDB prior to 26.7.2 (arcadedb-engine) is affected: ScriptTriggerExecutor adds java.lang.* to allowed packages, allowing trigger scripts to access host classes via Java.type. An authenticated user with UPDATE_SCHEMA can create a JavaScript trigger that calls java.lang.Runtime.getRuntime().exe...

CVE-2026-67337

CVE-2026-67337 affects better-auth versions before 1.4.9. The issue is a two‑factor authentication bypass when session.cookieCache is enabled: attackers with valid primary credentials can reach authenticated routes without completing second‑factor verification by exploiting premature session cach...

CVE-2026-67337

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

EUVD-2026-51813

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

EUVD-2026-51843

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67343

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...