CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

WordPress Ninja Forms plugin 3.14.0-3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability

Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability discovered by ChinhNguyen in WordPress Plugin Ninja Forms versions 3.14.0-3.15.1...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-80438

The Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1 ) contains an improper access control vulnerability in its REST API abilities. The plugin fails to restrict these abilities to administrators, incorrectly treating a plugin-specific capability as equivalent to full site administrati...

WordPress Content Views plugin < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Content Views versions 4.5.1.2...

CVE-2020-29007

creationtimestamp| type| source ---|---|--- 2026-09-04 05:00:05+00:00| seen| Telegram/PY8bWpO043D-Z8Y-HNjpKbgrcjpV8amEBJErFv8jCkTtc 2026-09-05 01:00:37+00:00| published-proof-of-concept| Telegram/PY8bWpO043D-Z8Y-HNjpKbgrcjpV8amEBJErFv8jCkTtc...

CryptoLyzer v1.6.0

CryptoLyzer is a fast, flexible, and comprehensive server cryptographic protocol TLS, SSL, SSH, IKE, DNSSEC and related setting HTTP headers, DNS records analyzer and fingerprint JA3, HASSH generator with API and CLI interfaces. Use CryptoLyzer when you need to audit TLS/SSL cipher suites — unlik...

CVE-2026-85147

creationtimestamp| type| source ---|---|--- 2026-09-04 03:29:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hm6fpyj5ql53i 2026-09-04 04:03:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muo3g2tpvv23...

CVE-2026-85146

creationtimestamp| type| source ---|---|--- 2026-09-04 03:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munyzd4jpt2y 2026-09-04 04:02:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muo3fud6vf2l 2026-09-04 04:08:30+00:00| seen|...

CVE-2026-85455

creationtimestamp| type| source ---|---|--- 2026-09-04 00:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munnv63jzo2v...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79426

The CRMEB v6.0.0 platform contains an arbitrary file deletion vulnerability within the /adminapi/file/video_data_save component. This flaw allows authenticated attackers to delete arbitrary files on the system by sending a crafted POST request . Exploitation details or specific proof-of-concept l...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

EUVD-2026-71770

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-75170

The HubCore platform (version 14.1.1) is vulnerable to a Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint. A remote unauthenticated attacker can inject arbitrary JavaScript into the application's response by exploiting the language POST parameter . Practical conse...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

PT-2026-91836

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...