CVE-2026-3358 Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...

CVE-2026-3358

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...

PT-2026-32084

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post status validation in the enroll now and course enrollment functions. Both enrollment endpoints...

WordPress plugin Tutor LMS – eLearning and online course solution 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

CVE-2026-40191

creationtimestamp| type| source ---|---|--- 2026-04-10 23:02:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6gjmiwe42x...

CVE-2026-40252

creationtimestamp| type| source ---|---|--- 2026-04-10 22:52:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6fxmmmds2t 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs...

CVE-2026-40242

creationtimestamp| type| source ---|---|--- 2026-04-10 22:32:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6ev3mnrn2o 2026-04-10 23:27:06+00:00| published-proof-of-concept| Telegram/azLV8BVN7oG3TROgln-jCTMw5r1pt6lKfNlckhfBfrofK-k 2026-04-17 03:03:48+00:00| confirmed|...

CVE-2026-40184

creationtimestamp| type| source ---|---|--- 2026-04-10 22:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6d6xtf7t2a...

CVE-2026-40185

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-10 21:24:55+00:00| published-proof-of-concept| Telegram/4ztR6gRcWXk6YwHnamVGk5ZiVkHzJEoA9sdr8vYKwKHNiwI 2026-04-10 22:08:59+00:00| seen|...

GHSA-FVCV-3M26-PCQX

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-12 07:51:50+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3mjbulrf7362m 2026-04-12 23:10:48+00:00| seen|...

CVE-2026-33710

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:20+00:00| seen| Telegram/ZRwkJT-g6xqpr38tjocBfuP9bsA0qHKZRvqY91xv80DRmI 2026-04-11 07:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bc2i2zl2m 2026-04-13 02:56:04+00:00| seen|...

CVE-2026-33618

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-10 21:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mj6bgva46m22 2026-04-11 07:03:47+00:00| seen|...

CVE-2026-33704

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-17 06:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjocqrr7dy2v...

GHSA-CP79-9MWR-WR49 Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Summary Ech0 allows any authenticated user to read historical system logs and subscribe to live log streams because the dashboard log endpoints validate only that a JWT is present and valid, but do not require an administrator role or privileged scope. Impact Any valid user session can access GET...

CVE-2026-40315

creationtimestamp| type| source ---|---|--- 2026-04-10 19:32:00+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-x783-xp3g-mqhp 2026-04-14 05:18:05+00:00| published-proof-of-concept| Telegram/pSCCNMgE3Fpe3zcCZgeqk6LWYSbZiR1jqFncMFnyrTX8KY 2026-04-14 07:48:06+00:00| seen|...

CVE-2026-31940

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:11+00:00| seen| Telegram/3GtkgxN8M7sGDIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg 2026-04-11 07:05:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bjttqpe2w 2026-04-13 02:56:04+00:00| seen|...

CVE-2026-35660

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc 2026-04-11 08:02:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7epixxnt2u...

EUVD-2026-21158

PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhookurl in Jobs API...

PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

Summary The /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server...

GHSA-8FRJ-8Q3M-XHGM PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

Summary The /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server...