EUVD-2026-50274

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-60004

creationtimestamp| type| source ---|---|--- 2026-07-29 07:59:42+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrrhfbohdx2w 2026-07-29 08:02:34+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mrrhkep54z23 2026-07-29 09:00:07+00:00| seen|...

CVE-2026-65094

creationtimestamp| type| source ---|---|--- 2026-07-29 02:15:51+00:00| seen| https://bsky.app/profile/potato.software/post/3mrqu6gweue2n 2026-07-29 02:15:51+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrqu6fq7xr2v 2026-07-29 16:05:35+00:00| seen|...

CVE-2026-54650

creationtimestamp| type| source ---|---|--- 2026-07-29 02:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdm6wwg23 2026-07-29 02:46:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqvvxefvd2s 2026-07-29 03:32:05+00:00| seen|...

CVE-2026-12938

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

CVE-2026-64863

creationtimestamp| type| source ---|---|--- 2026-07-28 23:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5e554m22 2026-07-29 00:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmmv237e2q 2026-07-29 00:35:05+00:00|...

CVE-2026-14996

creationtimestamp| type| source ---|---|--- 2026-07-28 22:00:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqfvwf55v2d 2026-07-28 23:06:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqjm5hnqn22...

CVE-2026-54635 pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

CVE-2026-16581

creationtimestamp| type| source ---|---|--- 2026-07-28 16:51:38+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-06 2026-07-28 17:04:20+00:00| seen| https://bsky.app/profile/cerberusit.bsky.social/post/3mrpve6p6qi23 2026-07-28 17:04:22+00:00| seen|...

CVE-2026-62433

creationtimestamp| type| source ---|---|--- 2026-07-28 15:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpp7ovqzg2s 2026-07-28 15:33:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpqbieqah2n 2026-07-29 13:55:22+00:00| seen|...

CVE-2026-62431

creationtimestamp| type| source ---|---|--- 2026-07-28 14:52:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpnys3koc2s 2026-07-28 15:43:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpqtfc6lg2u 2026-07-29 13:55:22+00:00| seen|...

CVE-2026-62435

creationtimestamp| type| source ---|---|--- 2026-07-28 14:49:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpnsxql3y2b 2026-07-28 15:12:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpp535lxd22 2026-07-29 13:55:22+00:00| seen|...

CVE-2026-14924

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...

CVE-2026-14924 Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...

CVE-2026-14924

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...

EUVD-2026-49702

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...

CVE-2026-39874

creationtimestamp| type| source ---|---|--- 2026-07-28 01:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mro7jycbc32j 2026-07-28 01:24:00+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mroasrtyly2b 2026-07-28 04:47:11+00:00| seen|...

CVE-2026-43698

creationtimestamp| type| source ---|---|--- 2026-07-28 01:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mro7jrdynf2d 2026-07-28 01:24:03+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mroasvm5d62b 2026-07-28 04:47:45+00:00| seen|...

PT-2026-65394

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...