CVE-2026-16072

CVE-2026-16072 affects Keycloak’s organization management component. A delegated administrator with org-management permissions can create an invitation for a non-existent email address and then fetch the secret registration link via the API, enabling creation of new user accounts and their additi...

CVE-2026-15395

creationtimestamp| type| source ---|---|--- 2026-07-17 12:12:29+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqtpwagzup2v 2026-07-17 12:12:46+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116935253395484489...

CVE-2026-41993

creationtimestamp| type| source ---|---|--- 2026-07-17 11:39:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqto3sym5k2u...

CVE-2023-46849

creationtimestamp| type| source ---|---|--- 2026-07-17 11:00:06+00:00| seen| https://t.me/cyberwarehouse/177 2026-07-18 00:00:28+00:00| seen| https://t.me/cyberwarehouse/177...

CVE-2026-59252

creationtimestamp| type| source ---|---|--- 2026-07-17 10:54:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtllcpgvo2k...

CVE-2026-12393

creationtimestamp| type| source ---|---|--- 2026-07-17 08:22:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtd3hngxz2u...

CVE-2026-15380

creationtimestamp| type| source ---|---|--- 2026-07-17 07:54:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtbjaewa325...

CVE-2026-9810

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2018-14816

creationtimestamp| type| source ---|---|--- 2026-07-17 07:00:04+00:00| seen| Telegram/pS736wy1q4JTpyQ27GThkrd-KM7MPYTW9rtTHg4MZzf-Jty 2026-07-18 00:00:37+00:00| seen| Telegram/pS736wy1q4JTpyQ27GThkrd-KM7MPYTW9rtTHg4MZzf-Jty...

CVE-2026-59173

creationtimestamp| type| source ---|---|--- 2026-07-17 06:39:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqt5cimvnh2p 2026-07-23 15:01:30+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrd45xpjlq2p...

CVE-2026-62764

creationtimestamp| type| source ---|---|--- 2026-07-17 06:34:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqt4zjdzoo2e 2026-07-17 14:26:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtxfpq6gq2i...

CVE-2026-9810

The CVE-2026-9810 entry concerns the AI Copilot WordPress plugin prior to version 1.5.4. The root cause is that the plugin does not bind OAuth access tokens to a WordPress user, allowing any valid token to be treated as an administrator session. Consequently, unauthenticated attackers completing ...

EUVD-2026-45150

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-9810 AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-9046

creationtimestamp| type| source ---|---|--- 2026-07-17 05:13:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqsyirmdtq2e 2026-07-17 05:13:36+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116933605175540875...

CVE-2026-24227

creationtimestamp| type| source ---|---|--- 2026-07-17 03:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqstmpirax2a...

CVE-2026-62207

creationtimestamp| type| source ---|---|--- 2026-07-17 02:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqkt3uoy2m...

CVE-2026-14956

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...

CVE-2026-62321

creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:13+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr7xax22x...

CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...