CVE-2026-1541 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...

CVE-2026-1541

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...

CVE-2026-4812

The CVE describes a vulnerability in Advanced Custom Fields (ACF) for WordPress, affecting versions up to 6.7.0. The issue arises from AJAX field query endpoints that accept user-supplied filter parameters, which override field-configured restrictions without proper authorization checks. This all...

CVE-2026-1541

The CVE concerns the Avada (Fusion) Builder WordPress plugin, affected up to version 3.15.1. The root cause is that fusion_get_post_custom_field() does not validate whether metadata keys are underscore-prefixed, enabling authenticated users with Subscriber-level access and above to expose protect...

CVE-2026-1541 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...

CVE-2026-35034

creationtimestamp| type| source ---|---|--- 2026-04-15 01:22:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjiqaulcnn2t...

CVE-2026-27298

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:21+00:00| published-proof-of-concept| Telegram/GYbH54sRbOOqgznzSrvNbIPKqa8TpEiUvDUzTYtUUyxy-E 2026-04-15 11:15:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjrelsv272f 2026-06-13 10:07:07+00:00| seen|...

CVE-2026-27295

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:06+00:00| seen| Telegram/dGt1m22sw1SGsA9Eug0OSHT5OJOK3joaNLENVhZetMIBpOs 2026-04-15 11:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjqka4vjs2u 2026-04-15 23:07:07+00:00| seen|...

CVE-2026-27294

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:06+00:00| seen| Telegram/dGt1m22sw1SGsA9Eug0OSHT5OJOK3joaNLENVhZetMIBpOs 2026-04-15 11:00:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjqjzlq2i2e...

CVE-2026-27292

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:06+00:00| seen| Telegram/dGt1m22sw1SGsA9Eug0OSHT5OJOK3joaNLENVhZetMIBpOs 2026-04-15 11:59:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjtu5mxyn2k 2026-04-16 00:07:07+00:00| seen|...

CVE-2026-27290

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:06+00:00| seen| Telegram/dGt1m22sw1SGsA9Eug0OSHT5OJOK3joaNLENVhZetMIBpOs 2026-04-15 11:15:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjresr2ms27 2026-04-15 20:37:08+00:00| seen|...

CVE-2026-27293

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:06+00:00| seen| Telegram/dGt1m22sw1SGsA9Eug0OSHT5OJOK3joaNLENVhZetMIBpOs 2026-04-15 11:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjqjt5anb2a 2026-04-15 22:37:07+00:00| seen|...

CVE-2026-34457

creationtimestamp| type| source ---|---|--- 2026-04-15 00:46:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjio7q55bd2t 2026-04-15 01:19:21+00:00| published-proof-of-concept| Telegram/GYbH54sRbOOqgznzSrvNbIPKqa8TpEiUvDUzTYtUUyxy-E 2026-04-15 10:33:18+00:00| seen|...

CVE-2026-35033

creationtimestamp| type| source ---|---|--- 2026-04-15 00:43:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjio2djnt62g 2026-04-15 01:19:29+00:00| seen| Telegram/4QaIVP4Z6j7I04jn6w3qCKrQ76Fz4EXtpUCBPkRfgX1dqr4...

CVE-2026-2396

creationtimestamp| type| source ---|---|--- 2026-04-15 00:40:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjinvgwpcl2z...

CLEANSTART-2026-MP87020 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Multiple security vulnerabilities affect the karpenter package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. See references for individual vulnerability details...

CVE-2025-15470

creationtimestamp| type| source ---|---|--- 2026-04-15 00:24:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjimyqq4jv2t...

CVE-2026-1314

creationtimestamp| type| source ---|---|--- 2026-04-15 00:19:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjimprprmr2o 2026-04-22 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk4fgtcu522h...

CVE-2026-27288

creationtimestamp| type| source ---|---|--- 2026-04-15 00:18:27+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mjimntrqsi2i...

CVE-2026-33023

creationtimestamp| type| source ---|---|--- 2026-04-15 00:14:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjimgt7fwf2g 2026-04-15 01:19:21+00:00| published-proof-of-concept| Telegram/GYbH54sRbOOqgznzSrvNbIPKqa8TpEiUvDUzTYtUUyxy-E 2026-04-15 10:33:33+00:00| seen|...