CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509

The Headless CMS Plugin (up to version 2.0.4 ) for WordPress contains an information disclosure vulnerability in the REST API component. Specifically, the get_required_post_data function within the /wp-json/rae/v1/post endpoint is susceptible to manipulation of the post_id or post_slug arguments....

EUVD-2026-116486

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-115715

A flaw was found in Elasticsearch. An authenticated remote user with permissions to write to or search an index utilizing the phonetic analysis plugin can cause a Denial of Service DoS by submitting specially crafted input. Processing this input results in excessive heap memory consumption, causi...

CVE-2026-121548

A flaw was found in nnn. The togglex plugin fails to properly sanitize filenames before passing them to a system command. A local attacker can exploit this flaw by placing a file with a specially crafted name in a directory, leading to arbitrary command execution with the privileges of the user...

CVE-2026-115358

A flaw was found in OpenBao. When processing requests with malformed plugin parameters, such as key-value pair or header fields, error messages containing sensitive input are recorded in audit logs. An authenticated remote attacker can exploit this issue by submitting crafted requests to trigger...

CVE-2026-106557

A flaw was found in @backstage/plugin-techdocs-node. Improper validation of TechDocs Markdown extension configurations allows an authenticated user who can register or modify documentation sources to access resources outside the intended documentation boundary during build operations. This issue...

CVE-2026-106563

A flaw was found in the Backstage Kubernetes backend plugin @backstage/plugin-kubernetes-backend. Due to improper entity validation in a deprecated services endpoint, an authenticated user with read permissions can submit crafted entity data. This issue allows unauthorized information disclosure,...

CVE-2026-115366

A flaw was found in OpenBao. An improper authorization vulnerability in the plugin catalog interface allows an authenticated user with privileged access in a child namespace to modify system-wide plugin configurations. Because access to these endpoints is not restricted to the root namespace, an...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin myCred versions = 4.0.2...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daimi in WordPress Plugin myCred versions = 4.0.2...

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin Dokan versions = 5.3.2...

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin Dokan versions = 5.3.2...

WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Posts Table with Search & Sort versions = 1.4.14...

WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MinKhoy - VinSOC in WordPress Plugin Forminator versions = 1.58.3...

WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin Forminator versions = 1.58.3...

CVE-2026-121554

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-121546

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-74846

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...