CVE-2026-15247: Missing Authorization

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-84221: Improper Neutralization of Special Elements used in an SQL Command

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

CVE-2026-84898: Improper Limitation of a Pathname to a Restricted Directory

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-72796

creationtimestamp| type| source ---|---|--- 2026-09-04 21:32:38+00:00| seen| https://gist.github.com/alon710/78668aa7363409db44eada4d30afb2b9 2026-09-04 22:35:12+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-fgmr-7w36-9qfq...

CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...

CVE-2026-53769

Avo , a Ruby on Rails admin panel framework, contains a missing server-side authorization vulnerability in Avo::AttachmentsController#create (the direct attachment upload endpoint) affecting versions 2.28.0 through before 3.32.0 . The endpoint creates an ActiveStorage::Blob before validating the ...

CVE-2026-18221

creationtimestamp| type| source ---|---|--- 2026-09-04 18:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkapewaz23 2026-09-09 22:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4lyumq6325...

CVE-2026-19274

creationtimestamp| type| source ---|---|--- 2026-09-04 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupijajral2w 2026-09-04 18:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupknjyxry22 2026-09-05 23:01:21+00:00| seen|...

CVE-2026-18149

creationtimestamp| type| source ---|---|--- 2026-09-04 17:24:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w 2026-09-29 23:30:32+00:00| seen| https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5 2026-09-30 12:01:15+00:00| seen|...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

EUVD-2026-71142

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-80536

creationtimestamp| type| source ---|---|--- 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...

CVE-2026-85611

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

EUVD-2026-71030

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-85148

creationtimestamp| type| source ---|---|--- 2026-09-04 03:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munyzel7mh2b 2026-09-04 03:35:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5vpljehfiajj3 2026-09-04 04:02:47+00:00| seen|...

CVE-2026-85611: Authorization Bypass Through User-Controlled Key

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

PT-2026-85507

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...