EUVD-2026-65272

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-78265

creationtimestamp| type| source ---|---|--- 2026-08-24 23:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtufu62l7y24 2026-08-24 23:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtuhit53l42p 2026-08-25 00:08:22+00:00| seen|...

CVE-2026-78266

AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...

CVE-2026-39975

creationtimestamp| type| source ---|---|--- 2026-08-24 19:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtu2nkbaek2e 2026-08-24 20:08:27+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtu4acx27o2f...

CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

EUVD-2026-65078

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71505

Dolibarr before 24.0.0 is affected by a Broken Object-Level Authorization (BOLA) vulnerability in the REST API third-party site account write routes . Per-object access checks are enforced only on read routes, leaving write endpoints unguarded. An authenticated attacker holding third-party creati...

CVE-2026-71505 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-76205

creationtimestamp| type| source ---|---|--- 2026-08-24 17:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3405 2026-08-25 00:00:22+00:00| published-proof-of-concept| https://t.me/bdufstecru/3405...

CVE-2026-57897

A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces APIs. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories...

Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

CVE-2026-78057

creationtimestamp| type| source ---|---|--- 2026-08-23 04:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ftkgjp5wud4yh...

CVE-2026-71513

creationtimestamp| type| source ---|---|--- 2026-08-22 23:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtpewfmcze22 2026-08-23 01:10:09+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtpm5xzluq2i 2026-08-23 01:10:31+00:00| seen|...

CVE-2026-19883

creationtimestamp| type| source ---|---|--- 2026-08-22 03:48:32+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtnek7zciz2h 2026-08-22 04:00:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnf6vth7x27 2026-08-22 08:01:31+00:00| seen|...

EUVD-2026-63937

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

WordPress Quiz And Survey Master plugin < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability

Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Quiz And Survey Master versions 11.2.4...