CVE-2026-9187

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the actionremoveabandoned function, which is registered to both the...

CVE-2025-11694

creationtimestamp| type| source ---|---|--- 2026-06-16 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-04 2026-06-16 17:43:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogdwx72mc2j...

CVE-2025-14272

creationtimestamp| type| source ---|---|--- 2026-06-16 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-01 2026-06-16 17:28:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogd547waq2m...

CVE-2026-9187

The Abandoned Contact Form 7 plugin for WordPress (

EUVD-2026-37032

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the actionremoveabandoned function, which is registered to both the...

CVE-2026-9187 Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the actionremoveabandoned function, which is registered to both the...

CVE-2026-1767

creationtimestamp| type| source ---|---|--- 2026-06-16 04:15:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moewsbzgsh2n...

CVE-2026-1764

creationtimestamp| type| source ---|---|--- 2026-06-16 04:10:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moewkmggos2j...

CVE-2026-42014

creationtimestamp| type| source ---|---|--- 2026-06-16 04:07:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moewdvftpp2p 2026-06-29 11:39:00+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpgfnrmckv2h 2026-06-29 11:39:01+00:00| seen|...

CVE-2026-8484

creationtimestamp| type| source ---|---|--- 2026-06-16 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-8484...

CVE-2026-54512

creationtimestamp| type| source ---|---|--- 2026-06-16 01:10:42+00:00| published-proof-of-concept| https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm 2026-06-24 00:07:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moymp44sqy23 2026-07-12...

CVE-2026-5064

creationtimestamp| type| source ---|---|--- 2026-06-16 00:43:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moekxellhv2p...

CVE-2026-48157

creationtimestamp| type| source ---|---|--- 2026-06-16 00:28:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moek4j5hxb2i...

PT-2026-49620

Name of the Vulnerable Software and Affected Versions Abandoned Contact Form 7 versions prior to 2.3 Description The plugin allows unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on a site. This occurs because the action remove abandoned function, register...

PT-2026-50086

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions prior to 2.0.48 Description Improper Control of Generation of Code allows for Remote Code Inclusion and unauthenticated Remote Code Execution RCE. This issue enables an attacker to...

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

The safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary...

PT-2026-50153

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1 Description When the fetch function is called, the runtime validates the destination hostname against --deny-net rules but fails to re-verify the IP addresses that the hostname resolves to. This allows an...

CVE-2026-48714

creationtimestamp| type| source ---|---|--- 2026-06-15 23:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moef7y4spa2t 2026-06-16 00:33:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moekfhn56c2n 2026-06-16 01:30:27+00:00| seen|...

CVE-2026-11850

creationtimestamp| type| source ---|---|--- 2026-06-15 22:40:51+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3moee4eyg372o 2026-07-21 12:01:10+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mr5r5pjbkd2z 2026-07-29 12:01:42+00:00| seen|...

CVE-2026-11832

creationtimestamp| type| source ---|---|--- 2026-06-15 22:14:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3moecmi2a4n2q 2026-06-15 23:57:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moeiet2rl42p 2026-06-17 07:00:40+00:00| seen|...