CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64637

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003

The Content Mask WordPress plugin (versions 1.8.0 through 1.8.5.4 ) is vulnerable to a Contributor Publish Capability Bypass . The flaw occurs because the plugin fails to verify the necessary capabilities required to publish specific post types during creation. This allows users with low-level ro...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

Malicious Package

Overview stillm4ddpocs-demo-sprocket is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @syncraft-labs/react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-79763

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

PT-2026-79761

Name of the Vulnerable Software and Affected Versions Content Mask versions prior to 1.8.5.5 Description The Content Mask WordPress plugin fails to verify the necessary permissions required to publish the post type being created. This allows users with the Contributor role to publish posts and...

CVE-2026-77003: Improper Privilege Management

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-5389: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

SUSE CVE-2026-56670

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripti...

CVE-2026-59256 WWBN AVideo Unbound Token Authorization Bypass via Gallery

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

CVE-2026-59256

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

CVE-2026-59256

WWBN AVideo through commit 9c39d8c8 is affected by an authorization bypass vulnerability. The root cause is that the getToken() function creates tokens without binding them to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors . An attac...

Improper Resource Shutdown

Apache HttpComponents Client is vulnerable to Improper Resource Shutdown. The vulnerability is due to the classic I/O model failing to release connections back to the connection manager when processing an invalid or unsupported Content-Encoding header value, potentially exhausting available...

CVE-2026-14187

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...

SUSE CVE-2026-77014

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sortranges comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INTMAX. This causes silent omission of requested byte ranges...

Malicious Package

Overview lumen-pages-community is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-79685

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cxacru cm function where the driver fails to kill the rcv urb USB Request Block when an error occurs during the submission or waiting process of snd urb. This leav...