CVE-2026-14231

The CVE refers to the LifterLMS WordPress plugin prior to version 10.0.10, where one of the select2 query AJAX handlers does not perform a proper capability check beyond ensuring the user is logged in. This allows any authenticated user with subscriber-level access to read titles of internal post...

EUVD-2026-50994

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-14923

The CVE-2026-14923 entry applies to the WordPress plugin Sync Post With Other Site, affecting versions before 1.9.3. The issue is an operator-precedence flaw in the REST route’s authorization check, which fails to properly enforce page-editing capability. As a result, an authenticated user with o...

CVE-2026-66397

creationtimestamp| type| source ---|---|--- 2026-07-30 04:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtniawca42i...

CVE-2026-16727

creationtimestamp| type| source ---|---|--- 2026-07-30 03:00:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrth53myr32r...

PT-2026-66576

Name of the Vulnerable Software and Affected Versions CleverTap Web SDK version 1.15.1 Description Cross Site Scripting XSS occurs because the application fails to sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious...

EUVD-2025-210564

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2026-67437

creationtimestamp| type| source ---|---|--- 2026-07-29 22:00:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrswdykg4k2w 2026-07-30 16:35:35+00:00| published-proof-of-concept| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch 2026-07-31...

CVE-2026-63119

creationtimestamp| type| source ---|---|--- 2026-07-29 21:26:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsuhri6me23 2026-07-30 16:35:27+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42 2026-07-31...

CVE-2026-67435

creationtimestamp| type| source ---|---|--- 2026-07-29 21:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrstx5hkw522 2026-07-31 01:31:12+00:00| seen| https://gist.github.com/alon710/d1939c63ece21d1bd9e89d2add282b5b...

CVE-2026-5492

creationtimestamp| type| source ---|---|--- 2026-07-29 21:13:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrstqgfvd32s...

CVE-2026-5491

creationtimestamp| type| source ---|---|--- 2026-07-29 21:10:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrstkhdrfa2g 2026-07-30 02:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtdsleuvm2m...

CVE-2026-6102

creationtimestamp| type| source ---|---|--- 2026-07-29 21:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrssziz5eg2o...

CVE-2026-63118

creationtimestamp| type| source ---|---|--- 2026-07-29 20:51:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrssjm3jv424 2026-07-30 16:35:30+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m 2026-07-31...

CVE-2026-67432

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67201

creationtimestamp| type| source ---|---|--- 2026-07-29 20:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrspoy6qkg2j...

CVE-2025-60931

creationtimestamp| type| source ---|---|--- 2026-07-29 19:39:35+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrsoirhwyl2p...

CVE-2026-20316

creationtimestamp| type| source ---|---|--- 2026-07-29 19:35:50+00:00| seen| https://bsky.app/profile/cvesentinel.bsky.social/post/3mrsoc3g26k2u 2026-07-29 20:00:01+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8dc30cfa-6d78-4c95-8f53-cf5195768d7e...

CVE-2026-67432 MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67193

creationtimestamp| type| source ---|---|--- 2026-07-29 18:48:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrslnxpa4t2q 2026-07-29 20:15:17+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-67193 2026-07-30 20:27:00+00:00| seen|...