Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak reset-credentials flow bypass Autho...

CVE-2026-66275

A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by exceeding the session flow control incoming window. This action could lead to a denial of service DoS, making the system unavailable to legitimate users. Mitigation Ensure authenticated access to AMQP...

WordPress Themify Builder plugin <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action vulnerability

Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tbupdateolddata' AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Themify Builder versions = 7.8.0...

WordPress AutomatorWP plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via automatorwpconvertkitgetforms AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AutomatorWP versions = 5.8.4...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action vulnerability

Authenticated Subscriber+ Privilege Escalation via Arbitrary Option Update to wpematicoimportsettings adminaction vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.8.24...

WordPress AutomatorWP plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via automatorwpcampaignmonitorgetlists AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AutomatorWP versions = 5.8.4...

CVE-2026-79667

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79662

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...

CVE-2026-75971

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

CVE-2026-75908

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-19949

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-17587

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

Grok fooled into stealing user chat, location data, and more

A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution. AI researchers describe "Cryptographic Context Injection"—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

EUVD-2026-65447

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79667

Ech0 versions 4.3.4 and earlier fail to enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export authorize based only on the user's admin role, omitting scope checks. The backup export ...

EUVD-2026-65452

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...

CVE-2026-79662

Ech0 through 4.5.6 contains an OAuth redirect URI validation bypass in parseAndValidateClientRedirect (internal/service/auth/auth.go). The function compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment comp...