CVE-2026-13176

creationtimestamp| type| source ---|---|--- 2026-08-22 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mto6uokzka2t...

CVE-2026-4245

The Post Duplicator WordPress plugin (all versions up to and including 3.0.11 ) is vulnerable to an authorization bypass in its REST API. The duplicate_post_permissions() callback only verifies the duplicate_posts capability without checking whether the user holds publish_posts or other status-ga...

EUVD-2026-64251

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-66001

creationtimestamp| type| source ---|---|--- 2026-08-22 06:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtnmhdlosm2m...

CVE-2026-16260

CVE-2026-16260 is a stored XSS vulnerability in the Post Grid, Slider & Carousel Ultimate WordPress plugin (versions before 1.8.1 ). The plugin fails to sanitise and escape the Header Title custom post type setting before outputting it in an HTML attribute on the admin edit screen. This allows au...

EUVD-2026-64216

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-74891

creationtimestamp| type| source ---|---|--- 2026-08-21 20:02:02+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mtmki3fzgl2q 2026-08-22 12:00:47+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mtoa2i5jux2x...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

Apache Solr - Deserialization of Untrusted Data

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. id:...

CVE-2026-63343

creationtimestamp| type| source ---|---|--- 2026-08-21 16:09:28+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5iab4xo2t 2026-08-21 19:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtmjatvxh52p 2026-08-21 22:30:04+00:00| seen|...

CVE-2026-63125

creationtimestamp| type| source ---|---|--- 2026-08-21 16:09:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5hwzd6q2e 2026-08-21 18:03:43+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtmdujupza2o 2026-08-21 18:03:48+00:00| seen|...

CVE-2026-76611

creationtimestamp| type| source ---|---|--- 2026-08-21 14:14:42+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtlx2yz2rs2p...

CVE-2026-53614

creationtimestamp| type| source ---|---|--- 2026-08-21 13:45:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtlvgb5xow2o...

CVE-2026-77759

creationtimestamp| type| source ---|---|--- 2026-08-21 12:21:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3sqovrbovachd...

WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability

Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...

CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...