EUVD-2026-64225

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

EUVD-2026-64220

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-53525

creationtimestamp| type| source ---|---|--- 2026-08-22 01:13:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtn3uaac5i2x 2026-08-22 01:13:25+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117136503782177429...

OPENSUSE-SU-2026:11575-1 helm-4.2.4-1.1 on GA media

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-76904

creationtimestamp| type| source ---|---|--- 2026-08-21 22:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmr46uv4d2o 2026-08-21 22:07:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmrja7q442p 2026-08-21 23:20:04+00:00| seen|...

[SECURITY] [DSA 6458-1] gst-plugins-bad1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6458-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 21, 2026 https://www.debian.org/security/faq -...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656

FiftyOne (open-source visual AI dataset platform) versions prior to 1.17.0 unconditionally set Access-Control-Allow-Origin: * on its locally running, unauthenticated App/API server. Because the /media endpoint accepts a filesystem path parameter, a malicious website can issue cross-origin request...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

EUVD-2026-64145

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-77087

creationtimestamp| type| source ---|---|--- 2026-08-21 16:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtm4yhm7ea26 2026-08-21 16:09:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5ij7ehq2e 2026-08-21 16:23:35+00:00| seen|...

CVE-2026-18290

creationtimestamp| type| source ---|---|--- 2026-08-21 12:07:43+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtlpxwzwki2i 2026-08-21 12:07:50+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117133414439759245...

CVE-2026-77776

creationtimestamp| type| source ---|---|--- 2026-08-21 12:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/117133386151660614 2026-08-21 12:00:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtlpl4zilt2n 2026-08-21 12:13:30+00:00| seen|...

CVE-2026-77683

creationtimestamp| type| source ---|---|--- 2026-08-21 10:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtlkk3vbum2n 2026-08-21 10:30:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/117133032027242771 2026-08-23 09:00:28+00:00| seen|...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

WordPress Easy Media Replace plugin <= 0.2.0 - Author+ Stored XSS via Attachment Title vulnerability

Author+ Stored XSS via Attachment Title vulnerability discovered by testoun in WordPress Plugin Easy Media Replace versions = 0.2.0...

CVE-2026-16959

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

CVE-2026-16959

CVE-2026-16959 affects the Media Library Assistant WordPress plugin prior to version 3.40 . The root cause is an unvalidated search parameter (identified as mla_search_connector ) that is concatenated directly into a SQL query within a media-library query handler, enabling SQL injection by authen...

EUVD-2026-63820

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...