CVE-2026-4019 Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/postid/blockid using returntrue as the permissioncallback, allowing any...

CVE-2026-4019

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/postid/blockid using returntrue as the permissioncallback, allowing any...

EUVD-2026-26200

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/postid/blockid using returntrue as the permissioncallback, allowing any...

CVE-2026-4019 Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/postid/blockid using returntrue as the permissioncallback, allowing any...

CVE-2026-4019

The CVE-2026-4019 vulnerability affects the WordPress plugin Complianz – GDPR/CCPA Cookie Consent (versions up to and including 7.4.5). The REST endpoint /wp-json/complianz/v1/consent-area/{post_id}/{block_id} uses a permissive permission_callback (__return_true), enabling unauthenticated request...

CVE-2026-6253

creationtimestamp| type| source ---|---|--- 2026-04-29 07:06:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkmjxidnro2m 2026-04-29 07:10:54+00:00| seen| https://mastodon.social/users/bagder/statuses/116486743707813679 2026-04-29 07:11:04+00:00| seen|...

CVE-2026-40560

creationtimestamp| type| source ---|---|--- 2026-04-29 00:38:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkluc4fnnn2x 2026-04-29 00:38:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkluc5hnxw2k...

CVE-2026-42426

creationtimestamp| type| source ---|---|--- 2026-04-28 20:27:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mklgbbpntz2c 2026-04-28 20:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mklhewbuan2e 2026-05-28 07:37:06+00:00| seen|...

CVE-2026-7343

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:00:44+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkls6yfyxg2p 2026-04-29 00:01:01+00:00| seen|...

WordPress Complianz – GDPR/CCPA Cookie Consent plugin <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure vulnerability

Missing Authorization to Unauthenticated Private Post Content Disclosure vulnerability discovered by Wesley van de Kamp - Conda Security in WordPress Plugin Complianz versions = 7.4.5...

CVE-2026-41873

creationtimestamp| type| source ---|---|--- 2026-04-28 17:09:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl3a4a57i2q 2026-04-28 17:18:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkl3ppnk6p2b 2026-05-26 15:13:18+00:00| seen|...

CVE-2026-7248

creationtimestamp| type| source ---|---|--- 2026-04-28 09:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkkbkxvuui2o 2026-04-28 09:30:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116481630491966753 2026-04-28 11:14:03+00:00| seen|...

CVE-2026-7202

creationtimestamp| type| source ---|---|--- 2026-04-28 01:43:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjhicp2472z 2026-04-28 02:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjijf2sb72s 2026-04-28 05:00:31+00:00| seen|...

CVE-2026-7204

creationtimestamp| type| source ---|---|--- 2026-04-28 01:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116479743048315445 2026-04-28 01:44:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjhishfjn2r 2026-04-28 02:00:31+00:00| seen|...

CVE-2026-6741

creationtimestamp| type| source ---|---|--- 2026-04-27 21:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkixnm7i5g2t 2026-04-27 21:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkixpgj3wt2n 2026-04-28 19:33:06+00:00| seen|...

CVE-2026-7153

creationtimestamp| type| source ---|---|--- 2026-04-27 21:00:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkixneplf62t 2026-04-27 21:01:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkixp74yld2f...

CVE-2026-42613

creationtimestamp| type| source ---|---|--- 2026-04-27 12:15:23+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-pxm6-mhxr-q4mj 2026-05-11 17:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllqvvrpcy26 2026-05-11...

CVE-2026-42315

creationtimestamp| type| source ---|---|--- 2026-04-27 08:09:32+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-838g-gr43-qqg9 2026-05-11 18:24:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllvhstyvk2c 2026-05-11...

CVE-2026-7059

A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function getsimulationposts of the file backend/app/api/simulation.py of the component Query Parameter Handler. Performing a manipulation of the argument Platform results in path traversal. The attack can be initiated...

CVE-2026-7059

The CVE-2026-7059 entry concerns 666ghj MiroFish (affected up to version 0.1.2). The vulnerability lies in the get_simulation_posts function of backend/app/api/simulation.py within the Query Parameter Handler. An attacker can achieve path traversal by manipulating the Platform argument. The issue...