CVE-2026-68586

creationtimestamp| type| source ---|---|--- 2026-08-03 14:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyhkwq72o...

CVE-2026-68584

creationtimestamp| type| source ---|---|--- 2026-08-03 14:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyg64yp2u...

CVE-2026-64827

creationtimestamp| type| source ---|---|--- 2026-08-03 14:16:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/355ijrasd4dlj...

CVE-2026-18089

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-8793

creationtimestamp| type| source ---|---|--- 2026-08-03 12:50:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3ms6jxjcufv2l...

CVE-2026-18089

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-33591

creationtimestamp| type| source ---|---|--- 2026-08-03 12:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117031464187150211 2026-08-03 12:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms6h6fbd2l2i 2026-08-05 13:00:07+00:00| seen|...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-17583

creationtimestamp| type| source ---|---|--- 2026-08-03 10:00:38+00:00| seen| https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html 2026-08-03 10:01:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms6ajowixy2u 2026-08-03 11:17:27+00:00|...

EUVD-2026-52257

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082

CTI-Transmute exposes a CSRF vulnerability in the admin user-deletion endpoint: /account/delete/ accepts HTTP GET, allowing an attacker to induce an authenticated admin to delete a user via a forged request. Exploitation requires an active admin session but no CTI-Transmute account or admin privi...

CVE-2026-16274

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-16057

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-12803

creationtimestamp| type| source ---|---|--- 2026-08-03 06:09:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2igor6ykz2if6 2026-08-03 11:22:47+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-12803 2026-08-04 09:28:17+00:00| seen|...

EUVD-2026-52172

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

CVE-2026-15231

The CVE-2026-15231 vulnerability affects the Tag, Category, and Taxonomy Manager WordPress plugin prior to version 3.51.0. The root cause is improper access control: the plugin does not verify that a user is authorized to access a referenced post before processing it and returning derived data. T...

EUVD-2026-52163

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

EUVD-2026-52162

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...