Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the import process. An attacker can access internal resources or read arbitrary files from the server filesystem by submitting crafted filenames containing URL wrappers or path traversal sequences...

CVE-2026-67438

creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:33+00:00| published-proof-of-concept| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65 2026-07-31 08:32:20+00:00| seen| https://gist.github.com/alon710/006ebdb624799640fa8e05feb88f3b11...

CVE-2026-55651

creationtimestamp| type| source ---|---|--- 2026-07-29 18:35:25+00:00| published-proof-of-concept| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7 2026-07-30 07:31:43+00:00| seen| https://gist.github.com/alon710/eef1157f11956461ac0859c3d9d6253b...

CVE-2026-54574

creationtimestamp| type| source ---|---|--- 2026-07-29 17:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsih6ubzv2j 2026-07-29 18:35:11+00:00| published-proof-of-concept| https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7 2026-07-30 01:32:06+00:0...

CVE-2026-11351

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...

CVE-2026-11351 ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...

CVE-2026-11351

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...

CVE-2026-11351 ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...

WordPress ShinyStat Analytics plugin 1.0.12-1.0.17 - Unauthenticated Non-Published Product Information Disclosure vulnerability

Unauthenticated Non-Published Product Information Disclosure vulnerability discovered by Que Thanh Tuan in WordPress Plugin ShinyStat Analytics versions 1.0.12-1.0.17...

CVE-2026-11351

The ShinyStat Analytics WordPress plugin, specifically versions 1.0.12 through 1.0.17 , is vulnerable to an unauthenticated information disclosure flaw. The root cause is a missing authorization check on one of the plugin's REST API endpoints . This allow unauthenticated users to retrieve sensiti...

PT-2026-65689

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...

CVE-2026-54603

creationtimestamp| type| source ---|---|--- 2026-07-28 18:35:08+00:00| published-proof-of-concept| https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9 2026-07-28 20:31:48+00:00| seen| https://gist.github.com/alon710/76a4f64bf3e94be3974678cdc55c68d9...

EUVD-2026-49702

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the fx operation. An attacker can cause a denial of service by passing a specially crafted argument. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Advisory - GitHu...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to an incomplete fix in the policy. An attacker can gain unauthorized access to restricted functionality or data by bypassing intended security policies. Remediation A fix was pushed into the master branch bu...

CVE-2026-65971

creationtimestamp| type| source ---|---|--- 2026-07-23 23:00:03+00:00| seen| https://t.me/GithubRedTeam/94876 2026-07-24 00:00:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/94876 2026-07-24 01:00:03+00:00| seen| Telegram/lPm2d4VYpYEjn3m2EVnzf33SWkbqRmjBxDEhEFxEK5fDURE 2026-07-2...

CVE-2026-65912

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:16+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-cjmm-f4jc-qw8r...

CVE-2026-65914

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:12+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h8r8-wccr-v5f2...

CVE-2026-65899

creationtimestamp| type| source ---|---|--- 2026-07-23 14:35:03+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-vxr8-fq34-vvx9...

CVE-2026-12082 Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...