📄 WordPress AI Engine 3.1.3 Mass Enumeration

This advisory documents a fully automated PHP-based exploitation framework designed to perform mass enumeration, plugin detection, token extraction, and automated account creation targeting vulnerable WordPress MCP-related REST API endpoints...

📄 WordPress AI Engine 3.1.3 Add Admin / Shell Upload

The AI Engine WordPress plugin version 3.1.3 exposes an MCP JSON RPC endpoint allowing unauthenticated calls to administrative functions. An attacker can remotely create an administrator account then upload a malicious plugin or payload to obtain full remote code execution on the WordPress Server...

CVE-2026-27601

creationtimestamp| type| source ---|---|--- 2026-03-03 23:59:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6xz656gz2z...

CVE-2026-26272

creationtimestamp| type| source ---|---|--- 2026-03-03 23:55:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6xs7cbxq2z...

CVE-2026-27600

creationtimestamp| type| source ---|---|--- 2026-03-03 23:50:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6xj6dscv2x...

CVE-2026-24898

creationtimestamp| type| source ---|---|--- 2026-03-03 22:18:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg6sfdl5hz25 2026-03-04 01:49:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg7656ce7a2o 2026-03-04 23:00:15+00:00| seen|...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the authorId parameter during the entry creation. An attacker can assign authorship of new entries to...

CVE-2023-31044

creationtimestamp| type| source ---|---|--- 2026-03-03 20:12:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6lcqyppz2d...

CVE-2026-3490

creationtimestamp| type| source ---|---|--- 2026-03-03 20:04:20+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-vvpj-8cmc-gx39 2026-06-17 17:53:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiuynehzl2h 2026-08-24 15:42:13+00:00| seen|...

CVE-2025-23299

creationtimestamp| type| source ---|---|--- 2026-03-03 19:21:18+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116166864253986208...

CVE-2025-52998

creationtimestamp| type| source ---|---|--- 2026-03-03 19:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg6hcjheki2s...

CVE-2026-0017

creationtimestamp| type| source ---|---|--- 2026-03-03 16:20:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg66fcwjq62u...

CVE-2025-48645

creationtimestamp| type| source ---|---|--- 2026-03-03 15:46:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg64htz7hv2s...

CVE-2026-27750

creationtimestamp| type| source ---|---|--- 2026-03-03 15:37:09+00:00| seen| https://infosec.exchange/users/quarkslab/statuses/116165982849269143 2026-03-03 15:37:37+00:00| seen| https://bsky.app/profile/quarkslab.bsky.social/post/3mg63xocxwc2l 2026-03-05 17:59:26+00:00| seen|...

CVE-2026-27748

creationtimestamp| type| source ---|---|--- 2026-03-03 15:37:09+00:00| seen| https://infosec.exchange/users/quarkslab/statuses/116165982849269143 2026-03-03 15:37:36+00:00| seen| https://bsky.app/profile/quarkslab.bsky.social/post/3mg63xocxwc2l 2026-03-05 18:01:35+00:00| seen|...

CVE-2026-28419

creationtimestamp| type| source ---|---|--- 2026-03-03 15:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2026-28418

creationtimestamp| type| source ---|---|--- 2026-03-03 15:35:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2025-58335

creationtimestamp| type| source ---|---|--- 2026-03-03 15:01:27+00:00| seen| https://gist.github.com/openjny/0f6c31694b4337dd06b63c352290b14f...

Missing Encryption of Sensitive Data

Overview github.com/rancher/rancher/pkg/controllers/management/node is a complete container management platform Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the cluster creation using RKE templates with Weave CNI, where the WEAVEPASSWORD is not set,...

OPENSUSE-SU-2026:20318-1 Security update for gitea-tea

This update for gitea-tea fixes the following issues: Changes in gitea-tea: - update to 0.12.0: New Features - Add tea actions commands for managing workflow runs and workflows in 880, 796 - Add tea api subcommand for arbitrary API calls not covered by existing commands in 879 - Add repository...