CVE-2026-3139 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppbsaveavatarvalue function due to missing validation on a user controlled key...

CVE-2026-3139

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppbsaveavatarvalue function due to missing validation on a user controlled key...

WordPress Auto Post Scheduler plugin <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting via apsoptionspage vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Auto Post Scheduler versions = 1.84...

CVE-2026-5183

creationtimestamp| type| source ---|---|--- 2026-03-31 10:37:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midybc2z3o2o...

CVE-2026-5186

creationtimestamp| type| source ---|---|--- 2026-03-31 10:22:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midxggnifh2n...

CVE-2026-3881

creationtimestamp| type| source ---|---|--- 2026-03-31 09:55:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midvvg7m372j...

CVE-2025-10551

creationtimestamp| type| source ---|---|--- 2026-03-31 09:22:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midu2265e72c 2026-03-31 10:13:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midwvsmxyv2s 2026-03-31 11:17:40+00:00| seen|...

CVE-2026-5201

creationtimestamp| type| source ---|---|--- 2026-03-31 09:21:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midtzstdys2x 2026-03-31 10:06:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midwj4o52i2q 2026-03-31 11:17:48+00:00| seen|...

cpython: POP3 command injection in user-controlled commands

A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server...

CVE-2026-5178

creationtimestamp| type| source ---|---|--- 2026-03-31 07:20:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midnaenxax27...

CVE-2026-1797

creationtimestamp| type| source ---|---|--- 2026-03-31 07:11:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midmpqjcb427 2026-04-01 21:45:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mihnzm6okn2l...

CVE-2026-1877

The Auto Post Scheduler plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.84. This is due to missing nonce validation on the 'apsoptionspage' function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

CVE-2026-1877

Auto Post Scheduler for WordPress (up to version 1.84) is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the aps_options_page function, allowing unauthenticated attackers to update settings and inject malicious scripts via forged requests if a site admin is tricked in...

CVE-2026-30563

A Stored Cross-Site Scripting XSS vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the updatedetails.php file. The application fails to sanitize the "website" parameter provided in a POST request. This allows authenticated attackers to inject...

CVE-2026-34040

creationtimestamp| type| source ---|---|--- 2026-03-31 04:02:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midc5qg6yb2s 2026-03-31 05:17:29+00:00| published-proof-of-concept| Telegram/84MSU-hIhNrWnS8A8cOqhlUxSHC6aqIIGr26pihaT5cA3PI 2026-03-31 06:56:01+00:00| seen|...

CVE-2026-34054

creationtimestamp| type| source ---|---|--- 2026-03-31 04:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midc3x3gyw2p 2026-03-31 05:17:42+00:00| seen| Telegram/62pZ0M7EEU9QzqUpq3hJFXhFPR-ebrkyPJ1cBwC7xQpoTU0...

CVE-2026-34042

creationtimestamp| type| source ---|---|--- 2026-03-31 04:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midc3pcfpa2j 2026-03-31 05:17:42+00:00| seen| Telegram/62pZ0M7EEU9QzqUpq3hJFXhFPR-ebrkyPJ1cBwC7xQpoTU0 2026-03-31 06:51:01+00:00| seen|...

CVE-2026-34591

creationtimestamp| type| source ---|---|--- 2026-03-31 03:49:17+00:00| published-proof-of-concept| https://github.com/python-poetry/poetry/security/advisories/GHSA-2599-h6xx-hpxp 2026-04-02 19:26:58+00:00| published-proof-of-concept| Telegram/7DVhAvDfvaCSFfrp-315YEAfd2kaZp9OZJgmE0wwvo2i8o...

Cross-site Scripting (XSS)

Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the blog post rendering process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious...

SQL Injection

Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to SQL Injection via the blog post process. An attacker can execute arbitrary SQL commands by supplying crafted input to the affected component. Remediation Upgrade...