PT-2026-84620

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77785: Authorization Bypass Through User-Controlled Key

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77782: Exposure of Sensitive Information to an Unauthorized Actor

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2023-3360: Deserialization of Untrusted Data

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

PT-2026-84617

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

PT-2026-84618

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...

CVE-2026-76657

creationtimestamp| type| source ---|---|--- 2026-09-01 22:07:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muigmax72z22 2026-09-01 23:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muikoegdsa2m 2026-09-01 23:48:47+00:00| seen|...

awesome-list — Updated!

Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...

CVE-2026-82854

creationtimestamp| type| source ---|---|--- 2026-08-31 09:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muemf4tokp2y 2026-08-31 10:07:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muenvxe2542b 2026-08-31 11:00:39+00:00| seen|...

CVE-2026-81574

creationtimestamp| type| source ---|---|--- 2026-08-27 11:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu2p267o7c2l 2026-08-27 11:01:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ibazv6h46utsr 2026-09-15 08:17:47+00:00| seen|...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-13172

The Eventin WordPress plugin (versions before 4.1.22 ) is vulnerable to an unauthenticated unpublished content disclosure . The root cause is a lack of restriction on access to non-published content by status or ownership within one of its REST API namespaces . This allows unauthenticated users t...

CVE-2026-78683

creationtimestamp| type| source ---|---|--- 2026-08-25 02:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtuqytwvum2e 2026-08-25 02:34:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6kw3zehwcdngz 2026-08-25 04:08:25+00:00| seen|...

CVE-2026-75930: Missing Authorization

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-78380 Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

CVE-2026-78380 Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

WordPress YMC Smart Filter plugin < 3.11.3 - Unauthenticated Private/Draft Post Disclosure vulnerability

Unauthenticated Private/Draft Post Disclosure vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Filter & Grids versions 3.11.3...

WordPress Copy & Delete Posts plugin < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure vulnerability

Authenticated Arbitrary Post Content and Password Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress Copy & Delete Posts plugin < 1.5.6 - Author+ Password-Protected Post Content Disclosure vulnerability

Author+ Password-Protected Post Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

CVE-2026-77003: Improper Privilege Management

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...