EUVD-2026-75971

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

WordPress Visualizer plugin 4.0.0-4.0.5 - Contributor+ Arbitrary Post/Page Modification vulnerability

Contributor+ Arbitrary Post/Page Modification vulnerability discovered by Artus KG in WordPress Plugin Visualizer versions 4.0.0-4.0.5...

CVE-2026-86782 Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-86782

The Visualizer WordPress plugin (versions 4.0.0-4.0.5 ) is vulnerable to an authorization bypass due to improper access controls on its chart-building actions. This flaw allows users with a Contributor role or higher to perform unauthorized actions, such as publishing, renaming, and overwriting t...

CVE-2026-85678

The AI Builder WordPress plugin (versions 2.4.1-2.7.7 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitize custom JavaScript saved against a post before it is echoed inside a script tag on the front end. This allows users with contributor-level a...

CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-64836

creationtimestamp| type| source ---|---|--- 2026-09-11 05:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7syggejg25...

CVE-2026-56711

creationtimestamp| type| source ---|---|--- 2026-09-11 05:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7syds2f72p 2026-09-11 08:54:11+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mva6x6vu5v2q 2026-09-11 16:37:28+00:00| seen|...

CVE-2026-87812

creationtimestamp| type| source ---|---|--- 2026-09-11 05:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7sgiqzx525...

CVE-2026-75704

creationtimestamp| type| source ---|---|--- 2026-09-11 05:09:36+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv7sfmkbun2f...

CVE-2026-89151

creationtimestamp| type| source ---|---|--- 2026-09-11 04:13:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i3xvqtlbegpim...

CVE-2026-57166

creationtimestamp| type| source ---|---|--- 2026-09-11 03:30:36+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv7mulx3f32z 2026-09-11 03:30:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117250289500372314...

PT-2026-89848

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

BadEngram: Backdoor Attack on Gated Memory Components in LLMs

To expand open-weight models' capacity without proportionally increasing computation, recent language models incorporate gated parametric memories that retrieve learned values and inject them into intermediate representations. Despite these efficiency benefits, such modules create a distinct atta...

CVE-2026-11446: Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-89251: Insufficient Verification of Data Authenticity

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

CVE-2026-89264: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

CVE-2026-50018: Uncontrolled Resource Consumption

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...

RedAmon 6.14.1

An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merged patch, with human oversight at every...