CVE-2026-84222

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-21102

creationtimestamp| type| source ---|---|--- 2026-09-09 06:07:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv2updojsh2y 2026-09-09 18:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv45na5c5i22 2026-09-11 03:37:06+00:00| seen|...

EUVD-2026-74716

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.1-6.2.5...

CVE-2025-15690 Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

CVE-2025-15690 Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

CVE-2025-15690

The Content Mask WordPress plugin (versions 1.7.1-1.8.5.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape content submitted via a post before it is outputted in generated pages. This allows users with a role as low as...

EUVD-2026-74691

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-19944

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944

WP Crowdfunding for WordPress (versions up to and including 2.2.1 ) contains a second-order SQL injection in the wpneo_reward Post Meta field, caused by insufficient escaping and lack of prepared statements. An authenticated attacker with Shop Manager or higher privileges can inject a malicious p...

EUVD-2026-74607

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-75738

creationtimestamp| type| source ---|---|--- 2026-09-09 02:14:32+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv2hoqo4fu2t...

CVE-2026-75668

creationtimestamp| type| source ---|---|--- 2026-09-09 02:14:29+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv2honpo5k26...

CVE-2026-87657

creationtimestamp| type| source ---|---|--- 2026-09-09 01:52:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/356y2aim7dvwv 2026-09-10 04:46:05+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-16 04:46:27+00:00| seen|...

Module-Lattice-Based Digital Signature Algorithm Utility 20260908

This is mldsa, a module-lattice-based digital signature algorithm utility for generating keypairs, signing and verifying files and data. It has an alter ego, mlsignify, implementing the same command line switches as signify1. The mldsa and mlsignify utilities are based on the libmldsa3 library,...

Ensembling LLMs for AI-Augmented Cybersecurity Software Requirements Generation

Translating high-level controls from security standards into concrete, system-specific requirements is central to cybersecurity requirements engineering. Large language models LLMs can accelerate this labor-intensive, recall-sensitive task, but any single run is unreliable: it misses valid...

PT-2026-88854

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...