CVE-2026-2999

creationtimestamp| type| source ---|---|--- 2026-03-02 05:49:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html 2026-03-02 07:22:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg2ptxicnr2x 2026-03-02 07:23:14+00:00| seen|...

CVE-2026-3000

creationtimestamp| type| source ---|---|--- 2026-03-02 05:49:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html 2026-03-02 07:22:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg2ptqb6c225 2026-03-02 07:22:58+00:00| seen|...

CVE-2026-28554

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforoapproveajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation...

WordPress Plugin Context Blog Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Context Blog. The...

CVE-2026-28554 wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforoapproveajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation...

CVE-2026-27151

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the moveposts action only checked canmoveposts? on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move...

CVE-2026-27162

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, postsnearby was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use Post.securedguardian to properly filter po...

CVE-2026-28409

creationtimestamp| type| source ---|---|--- 2026-02-28 00:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuzcrimck2u 2026-02-28 01:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116145666777961188 2026-02-28 01:30:32+00:00| seen|...

CVE-2026-3255

creationtimestamp| type| source ---|---|--- 2026-02-27 23:24:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuu7hwlqs2x 2026-02-27 23:30:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mfuuk6yvv62a...

CVE-2026-26207

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, discourse-policy plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The PolicyController loads posts by ID without verifying the current...

CVE-2025-11251

creationtimestamp| type| source ---|---|--- 2026-02-27 13:31:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mftt2i2t3x2n 2026-02-27 13:38:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mftthya3zh27 2026-02-27 18:00:15+00:00| seen|...

CVE-2026-0980

creationtimestamp| type| source ---|---|--- 2026-02-27 08:18:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mftbk4vnqy2u 2026-02-27 08:18:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mftbkhgxec2v 2026-02-27 10:03:14+00:00| seen|...

CVE-2026-3301

creationtimestamp| type| source ---|---|--- 2026-02-27 06:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfszu67jax2m 2026-02-27 06:19:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mft2vd6lmq2s 2026-02-27 07:03:30+00:00| seen|...

CVE-2026-28364

creationtimestamp| type| source ---|---|--- 2026-02-27 04:24:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsuj76ohg2x 2026-02-27 04:25:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsuk4rdbu26 2026-02-27 05:35:23+00:00| seen|...

CVE-2026-28363

creationtimestamp| type| source ---|---|--- 2026-02-27 04:24:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsuixv7xg25 2026-02-27 04:25:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsujvdclc2u 2026-02-27 05:31:06+00:00| seen|...

n8n has Webhook Forgery on Zendesk Trigger Node

Impact An attacker who knows the webhook URL of a workflow using the ZendeskTrigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node does not verify the HMAC-SHA256 signature that Zendesk attaches to every outbound webhook, allowing any party to inject...

CVE-2026-27151

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the moveposts action only checked canmoveposts? on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move...

CVE-2026-27162

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, postsnearby was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use Post.securedguardian to properly filter po...

CVE-2026-27154

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: displaynameonposts = true; and prioritizeusernameinux = false. Editing a post of a malicious user would trigger ...

CVE-2026-27154 Discourse has XSS when editing a malicious post

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: displaynameonposts = true; and prioritizeusernameinux = false. Editing a post of a malicious user would trigger ...