CVE-2026-96897

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96897

The Optima Express IDX WordPress plugin (versions 8.5.0 - 8.7.5 ) is vulnerable to an authentication bypass due to a missing authorization check on an AJAX action. This flaw allows unauthenticated attackers to force the creation of a fixed author-role account and repeatedly rotate its application...

CVE-2026-96897 Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96897 Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

EUVD-2026-87900

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96897: Missing Authorization

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

PT-2026-99505

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6 Description An authorization check is missing in an AJAX action available to logged-out users. This allows unauthenticated attackers to force the creation of an account with a fixed...

DEBIAN-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

A flaw was found in GitPython. When updating submodules, GitPython fails to properly validate the submodule path specified in a repository's configuration file. A remote attacker could exploit this vulnerability by supplying a crafted repository containing directory traversal sequences in the...

CVE-2019-17382-EXPLOIT

CVE-2019-17382 - Zabbix Authentication Bypass A critical vulnerability discovered in Zabbix versions up to 4.4. The issue exists within the zabbix.php file when accessing the dashboard.view action with dashboardid=1. It enables attackers to bypass the login page, granting unauthorized access to t...

CVE-2026-96532

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197 I was presented with a high-severity alert indicating a potential exploit attempt of CVE-2023-22515, a zero-day vulnerability in Atlassian Confluence. The alert showed a suspicious GET request from an...

EUVD-2026-87540

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

CVE-2026-96532

The Testimonials Widget WordPress plugin, versions through 4.0.4 , is vulnerable to an unauthenticated arbitrary post update vulnerability. The root cause is a failure to perform capability or ownership checks when processing the plugin's front-end testimonial submission form. This flaw allows un...

WordPress MCP Server for WordPress plugin < 1.8.2 - CSRF to Administrator Account Creation vulnerability

CSRF to Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

PT-2026-99423

🚨 OpenCTI Authorization Flaw in Case Creation CVE-2026-76822 Critical Vulnerability Alert! OpenCTI is affected by CVE-2026-76822. 🔍 Identify Targets via ZoomEye: Search Dork: app="OpenCTI" Exposure: 1k instances identified globally. ZoomEye Search Link: 👉 https://t.co/C5U4m6Ej5b Infosec...

Linux Distros Unpatched Vulnerability : CVE-2026-100689

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...

PT-2026-99248

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests under certain conditions. This allows an unauthenticated attacker to perform actio...