EUVD-2026-63823

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-19085

The Duplicate Post WordPress plugin before 1.5.6 lacks an authorization check before duplicating a post. A user with a delegated role can exploit this to republish another user's password-protected post as publicly readable, resulting in a content disclosure. The vulnerability requires high privi...

CVE-2026-76131

creationtimestamp| type| source ---|---|--- 2026-08-21 04:19:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j3ybqejm7xu3h 2026-08-21 04:45:06+00:00| seen| https://jvn.jp/en/vu/JVNVU90210212...

SUSE CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

PT-2026-79307

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-73197 Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

EUVD-2026-63240

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-73197

FreeIPA is vulnerable to an unauthenticated denial-of-service via the /ipa/migration/migration.py endpoint. A remote attacker can send oversized form POST requests that force the migration handler to read the full request body into memory, causing memory exhaustion and potential service disruptio...

CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

WordPress Classified Listing plugin < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts vulnerability

Contributor+ Unpublished Post Content Disclosure via rtclblockcssgetposts vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...

Linux Distros Unpatched Vulnerability : CVE-2026-73197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the...

PT-2026-78918

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-76227 Renovate 42.68.1 before 42.96.3 Environment Variable Exposure

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

CVE-2026-60879

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:05+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwcyy4y2h 2026-08-19 17:52:21+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-23 05:37:07+00:00| seen|...

CVE-2026-16979

The SmartCrawl WordPress plugin (versions before 3.16.3) lacks capability checks on two AJAX actions, letting any Subscriber read private/draft post titles by ID and enumerate stored post-meta key names. CISA SSVC assesses partial technical impact with no known exploitation. No in-the-wild exploi...