CVE-2026-88864

creationtimestamp| type| source ---|---|--- 2026-09-10 13:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv66hk7skw2p 2026-09-10 16:07:29+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gp44tk22t...

CVE-2026-78361

creationtimestamp| type| source ---|---|--- 2026-09-10 13:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv66hibcvy2g...

WordPress Post Grid and Gutenberg Blocks plugin 2.3.0-2.3.8 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Chloe Chamberland - Wordfence in WordPress Plugin Post Grid and Gutenberg Blocks versions 2.3.0-2.3.8...

CVE-2026-9163

creationtimestamp| type| source ---|---|--- 2026-09-10 12:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv63o53t7m2w 2026-09-10 13:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2lnypozgvqemw 2026-09-10 14:07:38+00:00| seen|...

CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

EUVD-2026-75366

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889

The Aruba HiSpeed Cache WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.0.14 , caused by insufficient input sanitization and output escaping in the Post Content field. An authenticated attacker with Contributor-level access o...

CVE-2026-15019

creationtimestamp| type| source ---|---|--- 2026-09-10 06:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv5etlagw22m...

CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-15823

The Builderall Cheetah For Wp WordPress plugin (versions ≤ 3.0.2 ) contains a missing authorization flaw in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function is registered without a capability or nonce check, and the target post ID is read directly from user-controlled $_POST['b...

CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-79689

creationtimestamp| type| source ---|---|--- 2026-09-10 03:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv54eqtzed24...

CVE-2026-87607

creationtimestamp| type| source ---|---|--- 2026-09-10 01:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4v4bh7i42t 2026-09-10 05:15:18+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 08:07:07+00:00| seen|...

CVE-2026-87621

creationtimestamp| type| source ---|---|--- 2026-09-10 01:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4ukfajsa2p 2026-09-10 05:15:49+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 07:37:07+00:00| seen|...

CVE-2026-87527

creationtimestamp| type| source ---|---|--- 2026-09-10 00:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4tgo6dgh2w 2026-09-10 04:49:51+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 12:37:07+00:00| seen|...

CVE-2026-54054: Server-Side Request Forgery (SSRF)

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-78083: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...