CVE-2026-74007

The WordPress 3D FlipBook plugin (versions ≤ 1.16.20) exposes sensitive data to unauthenticated users over the network (CVSS 5.3). No specific technical details, patch version, or evidence of in-the-wild exploitation are provided in the documents.

EUVD-2026-60904

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32468

CVE-2026-32468 is an unauthenticated sensitive data exposure vulnerability in the Duitku Payment Gateway WordPress plugin, affecting versions 2.11.14 and below . The flaw allows remote attackers to access sensitive data without any prior authentication, as reflected by the CVSS 3.1 score of 7.5 (...

CVE-2026-32468 WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-24301

Microsoft Copilot has an improper neutralization of special elements used in a command (command injection ) flaw. A network-based, unauthenticated attacker with user interaction can disclose information. CVSS 3.1 scores 8.8 HIGH (C:H/I:H/A:H). No in-the-wild exploitation or patch version is docum...

EUVD-2026-60737

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...

CVE-2026-75587

creationtimestamp| type| source ---|---|--- 2026-08-18 12:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mte6yfl4r62d...

CVE-2026-5224 Sensitive Data Exposure in Kriptek Crypto's Cryptosim

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229...

BIT-GITLAB-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

MAL-2026-14122 Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

CVE-2026-11801

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

EUVD-2026-60568

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-11801 WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

MINI-9QM4-79XR-RJRQ

Bulletin has no description...

ANT-2026-BTRNT5A3 · supabase/supabase · broken-access-control

broken-access-control high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-BTRNT5A3: Server action accepts client-controlled CRM backend targets submitFormAction is exporte...

EUVD-2026-60542

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

EUVD-2026-60548

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

EUVD-2026-60546

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

PT-2026-77187

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradmin id t...