CVE-2026-9676 f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts...

CVE-2026-9676

The vulnerability CVE-2026-9676 affects the F4 Post Tree WordPress plugin prior to 2.0.5. The issue arises because the plugin does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the...

CVE-2026-9676

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts...

EUVD-2026-40040

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts...

CVE-2026-13538 Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection

A vulnerability was determined in Wavlink WL-NU516U1-A M16U1V240425. The affected element is the function sub401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote...

CVE-2026-13538

A vulnerability was determined in Wavlink WL-NU516U1-A M16U1V240425. The affected element is the function sub401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote...

EUVD-2026-40036

A vulnerability was determined in Wavlink WL-NU516U1-A M16U1V240425. The affected element is the function sub401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote...

CVE-2026-13521

creationtimestamp| type| source ---|---|--- 2026-06-29 04:53:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfoywemip2e...

CVE-2026-47193

creationtimestamp| type| source ---|---|--- 2026-06-29 01:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfbyraaz22y...

CVE-2026-49991

creationtimestamp| type| source ---|---|--- 2026-06-29 01:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfby6r6fp2x 2026-06-29 05:10:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpfpwvwcr226...

CVE-2026-56123

creationtimestamp| type| source ---|---|--- 2026-06-29 00:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpfaoajjhc2y...

CVE-2026-13513

creationtimestamp| type| source ---|---|--- 2026-06-29 00:28:28+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpfa6sd5lg2m 2026-06-29 02:13:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfg2pst3i2w...

PT-2026-53251

Name of the Vulnerable Software and Affected Versions Edimax EW-7478APC version 1.04 Description An OS command injection flaw exists in the POST Request Handler component. A remote attacker can exploit this by manipulating the submit-url argument within the formAccept function of the...

PT-2026-53436

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post install...

CVE-2026-13510

creationtimestamp| type| source ---|---|--- 2026-06-28 23:37:28+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpf5dm2lfr26 2026-06-29 02:03:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpffisxqe62w...

CVE-2007-1771

creationtimestamp| type| source ---|---|--- 2026-06-28 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpf5cwtnld2h...

CVE-2026-13511

creationtimestamp| type| source ---|---|--- 2026-06-28 23:36:13+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpf5bevtoz2b 2026-06-29 01:50:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpferhzbhw2q 2026-06-29 14:55:04+00:00| seen|...

CVE-2026-13507

creationtimestamp| type| source ---|---|--- 2026-06-28 21:56:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpexopsqwv23...

CVE-2026-53005

creationtimestamp| type| source ---|---|--- 2026-06-28 20:04:15+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpergdjq6r2l...

CVE-2026-53147

creationtimestamp| type| source ---|---|--- 2026-06-28 18:28:12+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpem2lbzro2u 2026-06-28 18:28:13+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpem2mjzdc2g 2026-06-28 18:28:13+00:00| seen|...