CVE-2026-3851: Improper Neutralization of Input During Web Page Generation

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-77764: Authorization Bypass Through User-Controlled Key

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...

CVE-2026-19116: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

PT-2026-85177

These are all security issues fixed in the trivy-0.74.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-19453: Improper Privilege Management

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...

CVE-2025-7963: Improper Neutralization of Input During Web Page Generation

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-14357: Missing Authorization

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

PT-2026-84741

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-10821: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-14982: Improper Limitation of a Pathname to a Restricted Directory

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-83551

creationtimestamp| type| source ---|---|--- 2026-09-01 23:20:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3muikoiggdb2q 2026-09-03 20:32:45+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3muncay5iri2q...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-72633

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2026-33465

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

CVE-2021-1137

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:47+00:00| seen| https://t.me/hackingAttack/4295 2026-09-01 20:02:47+00:00| seen| https://t.me/hackingAttack/4296 2026-09-02 01:03:23+00:00| seen| https://t.me/hackingAttack/4296 2026-09-02 01:03:24+00:00| seen|...

CVE-2021-36654

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:30+00:00| seen| https://t.me/hackingAttack/19109 2026-09-02 01:03:04+00:00| seen| https://t.me/hackingAttack/19109 2026-09-07 21:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/19109 2026-09-08 00:00:23+00:00|...

CVE-2021-35323

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:09+00:00| seen| https://t.me/hackingAttack/31750 2026-09-02 01:02:35+00:00| seen| https://t.me/hackingAttack/31750 2026-09-07 05:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/31750 2026-09-08 00:01:00+00:00|...

CVE-2022-31897

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:35+00:00| seen| https://t.me/hackingAttack/58348 2026-09-02 01:01:45+00:00| seen| https://t.me/hackingAttack/58348 2026-09-05 16:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/58348 2026-09-06 00:00:42+00:00|...