CVE-2026-4331

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-3328

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'postcontent' of adminform posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybeunserialize function without class restrictions on...

CVE-2026-4331 Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-4331

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-4331

The CVE affects Blog2Social: Social Media Auto Post & Scheduler for WordPress up to version 8.8.2. The resetSocialMetaTags() AJAX path incorrectly validates permissions: it only checks for the 'read' capability and a valid b2s_security_nonce, which are available to Subscriber-level users, due to ...

CVE-2026-4331 Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-33183

creationtimestamp| type| source ---|---|--- 2026-03-26 03:07:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwmrt3deo2g...

CVE-2026-28760

creationtimestamp| type| source ---|---|--- 2026-03-26 03:00:15+00:00| seen| https://jvn.jp/en/jp/JVN08057419/ 2026-03-26 07:19:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhx2uv3j7o2p 2026-03-26 09:00:30+00:00| seen|...

CVE-2026-3328

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'postcontent' of adminform posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybeunserialize function without class restrictions on...

CVE-2026-33918

creationtimestamp| type| source ---|---|--- 2026-03-26 01:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwfpt5zue2x 2026-03-26 19:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhyd4wmxir2f 2026-03-26 19:20:10+00:00| seen|...

CVE-2026-33636

creationtimestamp| type| source ---|---|--- 2026-03-26 01:00:54+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhwfpdaa5w2s 2026-03-26 16:00:58+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/116296309675649424 2026-03-26 22:15:57+00:00| seen|...

CVE-2026-34056

creationtimestamp| type| source ---|---|--- 2026-03-26 01:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwfosxhev2j 2026-03-26 18:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhy7rnoiql2k...

CVE-2026-4824

creationtimestamp| type| source ---|---|--- 2026-03-26 00:44:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwervgkyq2s...

CVE-2025-64648

creationtimestamp| type| source ---|---|--- 2026-03-26 00:30:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwdyaxye72d...

CVE-2026-33222

creationtimestamp| type| source ---|---|--- 2026-03-26 00:26:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwdrjyujh2d...

CVE-2025-36187

creationtimestamp| type| source ---|---|--- 2026-03-26 00:20:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwdg6wejo2d...

CVE-2026-2483

creationtimestamp| type| source ---|---|--- 2026-03-26 00:17:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwdbcjpbb22...

CVE-2026-2484

creationtimestamp| type| source ---|---|--- 2026-03-26 00:04:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwckpxssk2i...

CVE-2026-1014

creationtimestamp| type| source ---|---|--- 2026-03-26 00:02:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwchqbqmm25...

Tenda AC5 安全漏洞

Tenda AC5 is a wireless router produced by the Chinese company Tenda. Version 15.03.06.47 of Tenda AC5 contains a security vulnerability. This vulnerability stems from incorrect handling of parameters “PPPOEPassword” in the file/goform/QuickIndex component of the POST Request Handler, which may...