EUVD-2026-84378

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to POST...

PT-2026-86473

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.13 Description An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the pre update value function lacks capability or ownership checks, an...

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

PT-2026-79763

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116: Authorization Bypass Through User-Controlled Key

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-19075

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-19380

creationtimestamp| type| source ---|---|--- 2026-08-10 02:57:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j3s7fc7zkx4aa...

CVE-2026-4431 Easy Post Submission <= 2.3.0 - Missing Authorization

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-4431 Easy Post Submission <= 2.3.0 - Missing Authorization

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-18420

creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrxtxdxa7w2c 2026-08-20 22:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkapnkb7h22...

CVE-2026-58162

creationtimestamp| type| source ---|---|--- 2026-07-30 09:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mru4dv7t3l2r 2026-07-30 17:48:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruyqcqzen2i 2026-08-05 23:37:09+00:00| seen|...

CVE-2026-2395

creationtimestamp| type| source ---|---|--- 2026-07-22 15:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mramqbyzww2v 2026-07-22 16:58:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrasamszwq27...

CVE-2026-64878

creationtimestamp| type| source ---|---|--- 2026-07-21 21:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6piiv7552i 2026-07-21 23:42:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6ye6zujs23 2026-08-13 08:46:35+00:00| seen|...

CVE-2025-65720

creationtimestamp| type| source ---|---|--- 2026-07-16 18:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvoc5hlw2x...

CVE-2026-57363

creationtimestamp| type| source ---|---|--- 2026-07-13 18:51:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkeecjaem2a 2026-07-14 01:19:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql224uclj2w 2026-07-16 08:15:38+00:00| seen|...

CVE-2026-57379

creationtimestamp| type| source ---|---|--- 2026-07-13 11:04:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjkbrsxph2i 2026-07-16 07:56:17+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr57txq32g...

CVE-2026-55687

creationtimestamp| type| source ---|---|--- 2026-07-10 23:10:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbgh23va2y 2026-07-11 20:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfhbirnbl2k 2026-07-11 20:00:28+00:00| seen|...

CVE-2026-59161

creationtimestamp| type| source ---|---|--- 2026-07-10 22:58:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdaqhoxmm2x 2026-07-10 23:42:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqddaddmyn2e 2026-07-17 11:37:06+00:00| seen|...