49969 matches found
PT-2026-90792
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...
CVE-2026-35867: Improper Neutralization of Special Elements used in an OS Command
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...
CVE-2026-90648
creationtimestamp| type| source ---|---|--- 2026-09-12 23:55:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/amjjbwu2chui2 2026-09-13 09:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117262911191284457 2026-09-13 09:00:29+00:00| seen|...
CVE-2026-90560
creationtimestamp| type| source ---|---|--- 2026-09-12 19:02:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdrermf7t2s...
CVE-2026-87888
creationtimestamp| type| source ---|---|--- 2026-09-12 18:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdnxdo47g2m...
CVE-2026-87842
creationtimestamp| type| source ---|---|--- 2026-09-12 18:00:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdnx4265j2b...
CVE-2026-82845
creationtimestamp| type| source ---|---|--- 2026-09-12 16:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvdjz5ikg222 2026-09-12 19:02:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdrezgjvp2r...
CVE-2026-81402
creationtimestamp| type| source ---|---|--- 2026-09-12 16:40:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvdjhdpavg2t 2026-09-12 20:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvduoifhap2o...
CVE-2026-15451
creationtimestamp| type| source ---|---|--- 2026-09-12 14:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdak72smv2p 2026-09-12 16:01:52+00:00| seen| https://gist.github.com/ichintu/11d7f3c8a2e6716bcedbcab98b589bc5...
CVE-2026-90537
creationtimestamp| type| source ---|---|--- 2026-09-12 14:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdajxfe6n2m...
CVE-2026-90553
creationtimestamp| type| source ---|---|--- 2026-09-12 13:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdaiumtdh2z 2026-09-16 07:26:28+00:00| seen| https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmey7k4i22 2026-09-16 07:26:40+00:00| seen|...
redamon v6.14.1
Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...
CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...
CVE-2026-82851
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...
CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...
CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...
EUVD-2026-76789
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...
WordPress Masteriyo LMS plugin 1.14.0-3.4.0 - Instructor+ Arbitrary Post Disclosure vulnerability
Instructor+ Arbitrary Post Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.14.0-3.4.0...
CVE-2026-82851
The Masteriyo LMS WordPress plugin (versions 1.14.0-3.4.0 ) contains an Insecure Direct Object Reference (IDOR) vulnerability. The plugin fails to verify ownership or restrict the type of records a user requests for download. This allows users with the instructor role to retrieve the full content...