CVE-2026-82299

creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoydcqpi623...

CVE-2026-78583

creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoydcqpi623 2026-09-09 23:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4pe63ej32b...

Use of Single-factor Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication through the removeTwofactorConfig process and the twofactorenabled form field, which are accessible via POST...

CVE-2026-80536

creationtimestamp| type| source ---|---|--- 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...

CVE-2026-80583

creationtimestamp| type| source ---|---|--- 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...

CVE-2026-85403

creationtimestamp| type| source ---|---|--- 2026-09-04 11:08:16+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3muot6j7pgy2u...

CVE-2026-85546

creationtimestamp| type| source ---|---|--- 2026-09-04 10:56:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4hdkxyhjnkx75...

CVE-2026-84428

creationtimestamp| type| source ---|---|--- 2026-09-04 10:27:32+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muoqvmwms225 2026-09-04 13:06:39+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3muozs7o5py2y 2026-10-01 12:30:29+00:00| seen|...

GHSA-PFVF-FWFP-25MP

creationtimestamp| type| source ---|---|--- 2026-09-04 10:00:16+00:00| seen| https://bsky.app/profile/strawberry.rocks/post/3muopeviwkv2k 2026-10-09 16:30:32+00:00| seen| https://gist.github.com/alon710/3f4a231234c89945ddbbd06ebc24e753...

CVE-2026-76169

creationtimestamp| type| source ---|---|--- 2026-09-04 09:54:28+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muop2ikyjc25 2026-10-01 10:30:31+00:00| seen| https://gist.github.com/alon710/a1265d04bb89bd5ad393ac2683538928...

CVE-2026-85094

creationtimestamp| type| source ---|---|--- 2026-09-04 07:04:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j5vsxotiacu2n 2026-09-04 08:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muoip2kztd2l 2026-10-10 14:05:24+00:00| seen|...

CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

CVE-2026-84066

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions before 8.9 ) is vulnerable to an arbitrary post metadata write. The root cause is a failure to verify that a requesting user owns the post before writing uploaded file references to its metadata. ...

CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9 - Subscriber+ Arbitrary Post Meta Write vulnerability

Subscriber+ Arbitrary Post Meta Write vulnerability discovered by ryan zegar in WordPress Plugin Directorist versions 8.9...

CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-84146

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.8 , contains a vulnerability where it fails to perform required capability or post-status checks. This allows unauthenticated visitors to retrieve sensitive details—including title, price, SKU, description, and sto...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

WordPress Ninja Forms plugin 3.14.0-3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability

Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability discovered by ChinhNguyen in WordPress Plugin Ninja Forms versions 3.14.0-3.15.1...