CVE-2025-15285

The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication and checkCategoryAuthentication functions in all versions up to, and including, 2.2.1. These authorization functions only implement...

CVE-2026-25540: Use of Cache Containing Sensitive Information

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via Rails.cache. When AUTHORIZEDFETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that...

PT-2026-5885

Name of the Vulnerable Software and Affected Versions SEO Flow versions prior to 2.2.2 Description The SEO Flow plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check within the checkBlogAuthentication and checkCategoryAuthentication functions...

PT-2026-6319

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.3.19 Mastodon versions prior to 4.4.13 Mastodon versions prior to 4.5.6 Description Mastodon, a free, open-source social network server based on ActivityPub, contains a flaw related to web cache poisoning. When the...

CVE-2025-15285: Missing Authorization

The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication and checkCategoryAuthentication functions in all versions up to, and including, 2.2.1. These authorization functions only implement...

WordPress plugin SEO Flow by LupsOnline 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-25614

creationtimestamp| type| source ---|---|--- 2026-02-03 20:20:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdy6qg4hkv23 2026-02-03 20:21:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdy6rsl7i52h...

CVE-2026-24149

creationtimestamp| type| source ---|---|--- 2026-02-03 20:20:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdy6q7myap27 2026-02-03 20:21:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdy6rl63zs2g 2026-02-04 05:00:00+00:00| seen|...

CVE-2025-14550

creationtimestamp| type| source ---|---|--- 2026-02-03 15:53:03+00:00| seen| https://seclists.org/oss-sec/2026/q1/141 2026-02-03 17:16:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mdxugave7y2b 2026-02-03 17:23:28+00:00| seen|...

CVE-2026-25537

creationtimestamp| type| source ---|---|--- 2026-02-03 11:57:38+00:00| published-proof-of-concept| https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc 2026-02-10 12:44:46+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3meiyjelg7s25 2026-02-10...

CVE-2026-24936

creationtimestamp| type| source ---|---|--- 2026-02-03 09:21:34+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3mdwzvbhz6k2z 2026-02-03 09:21:35+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3mdwzvi6hic2z 2026-02-03 09:21:35+00:00| seen|...

BIT-MASTODON-2026-23961 Mastodon may allow a remote suspension bypass

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2025-8590

creationtimestamp| type| source ---|---|--- 2026-02-03 08:18:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwdz4vlp23 2026-02-03 08:18:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwep6anm2m...

CVE-2025-8589

creationtimestamp| type| source ---|---|--- 2026-02-03 08:17:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwds6yye24 2026-02-03 08:18:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwweidlsp23...

CVE-2026-1730

creationtimestamp| type| source ---|---|--- 2026-02-03 08:17:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwdlpqnf2h 2026-02-03 08:18:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwweay6pl2g...

CVE-2026-0950

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check postpasswordrequired before rendering post excerpts in the renderexcerpt...

EUVD-2026-5268

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check postpasswordrequired before rendering post excerpts in the renderexcerpt...

CVE-2026-0950

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check postpasswordrequired before rendering post excerpts in the renderexcerpt...

CVE-2026-0950 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check postpasswordrequired before rendering post excerpts in the renderexcerpt...

CVE-2026-0950 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check postpasswordrequired before rendering post excerpts in the renderexcerpt...