CVE-2026-89783

creationtimestamp| type| source ---|---|--- 2026-09-16 15:30:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnhft47tr2r 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-86341

CVE-2026-86341 affects GitLab EE versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The root cause is an improper access control check performed after a protected environment approval rule was already modified, rather than before. Under certain conditions, an authentica...

CVE-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

CVE-2026-86449

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-85131

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

CVE-2026-86449

The LearnPress WordPress plugin (versions 4.2.7.1-4.4.6 ) is vulnerable to an unauthenticated information disclosure flaw. The root cause is a failure to verify user capabilities before applying a user-supplied post status filter within one of its REST routes . This allows unauthenticated attacke...

CVE-2026-86449 LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-85131 WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

CVE-2026-85131

The WPLP Cookie Consent WordPress plugin (versions before 4.4.4 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists because the plugin fails to perform CSRF or capability checks when processing bulk actions on its administration screens. Additionally, the plugin does no...

CVE-2026-85131 WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

WordPress WPLP Cookie Consent plugin < 4.4.4 - Arbitrary Post Deletion vulnerability

Arbitrary Post Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.4...

WordPress Schema & Structured Data for WP & AMP plugin < 1.66 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.66...

CVE-2026-82124 Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82126

The Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63-1.65 ) is vulnerable to improper access control. The plugin fails to verify if a user has permission to edit a specific post when requesting schema generation. This allows users with the contributor role and above to obtain...

WordPress Schema & Structured Data for WP & AMP plugin 1.63-1.65 - Contributor+ Non-Public Post Content Disclosure vulnerability

Contributor+ Non-Public Post Content Disclosure vulnerability discovered by Shirshak in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.63-1.65...

EUVD-2026-80189

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...

CVE-2026-87886

creationtimestamp| type| source ---|---|--- 2026-09-16 02:27:45+00:00| seen| https://bsky.app/profile/abijita.bsky.social/post/3mvm3osvhv32w 2026-09-16 03:09:26+00:00| seen| https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvm5zerud22j 2026-09-16 03:15:25+00:00| seen|...

CVE-2026-87184

creationtimestamp| type| source ---|---|--- 2026-09-16 02:14:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2xvgqfk2f 2026-09-16 07:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmkvthlv62f 2026-09-23 03:07:07+00:00| seen|...

CVE-2026-87176

creationtimestamp| type| source ---|---|--- 2026-09-16 02:14:48+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2xnlmsj2p 2026-09-16 06:50:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmke25hyp2y 2026-09-23 08:48:14+00:00| seen|...

CVE-2026-87175

creationtimestamp| type| source ---|---|--- 2026-09-16 02:14:39+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2xfq55j2j 2026-09-16 06:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmkdxpfdo2t 2026-09-23 08:48:16+00:00| seen|...