CVE-2026-69091

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

EUVD-2026-52284

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-18577

creationtimestamp| type| source ---|---|--- 2026-08-03 10:00:37+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0275 2026-08-03 10:00:37+00:00| seen| https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html 2026-08-03 12:21:24+00:00| seen|...

CVE-2026-15231

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

CVE-2026-15231 TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

EUVD-2026-52172

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

CVE-2026-15231 TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

CVE-2026-15231

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-16274

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

EUVD-2026-52163

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-16057

The Contest Gallery WordPress plugin (versions prior to 30.0.7 ) is vulnerable to arbitrary post deletion due to the post_cg_youtube_delete_from_library handler. The plugin fails to perform per-object capability or nonce checks , relying instead on a coarse role-membership test. This allows any u...

PT-2026-67062

Name of the Vulnerable Software and Affected Versions Tag, Category, and Taxonomy Manager versions prior to 3.51.0 Description This issue occurs because the plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived data. Consequently,...

CVE-2026-67616: Missing Authorization

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2025-71400

creationtimestamp| type| source ---|---|--- 2026-08-02 15:25:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4c6anz3p22 2026-08-02 15:25:36+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms4c6axj2h2v 2026-08-02 15:25:43+00:00| seen|...

CVE-2026-68580

creationtimestamp| type| source ---|---|--- 2026-08-02 14:01:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45imklnk2n 2026-08-02 14:14:32+00:00| seen| https://bsky.app/profile/potato.software/post/3ms4675yian23 2026-08-03 04:44:06+00:00| seen|...

CVE-2026-68579

creationtimestamp| type| source ---|---|--- 2026-08-02 14:01:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7g3fjqwmtvhbb 2026-08-02 14:01:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45ifxrli2p 2026-08-02 14:20:20+00:00| seen|...

CVE-2026-15236

creationtimestamp| type| source ---|---|--- 2026-08-02 11:55:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wftwygg24 2026-08-02 11:55:18+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3wgaibbv23...