CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; Функция fflcockpitisallowed использует жёстко прописанный I...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Le plugin AI Bud expose un point de terminaison REST API /wp-json/ai-buddy/v1/wp/attachments qui permet de télécharger des fichiers dans la médiathèque WordPress. La logique de fichier du point de terminaison contient une...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

EUVD-2026-90506

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms Это форк безопасности SudoWP оригинального плагина Crowdsignal Forms. !WARNING Уведомление о безопасности : Оригинальный плагин "Crowdsignal Forms" версии = 1.7.2 содержит критическую уязвимость Missing Authorization CVE-2025-69015 , позволяющую аутентифицированным...

CVE-2025-11771

Exploit : Création non authentifiée d'enregistrement de vente Console du navigateur fetch'http://localhost/wordpress/wp-json/tokenico/create-sale-record', method: 'POST', headers: 'Content-Type': 'application/x-www-form-urlencoded' , body: new URLSearchParams networkId: "137", presaleKey:...

CVE-2025-12030

CVE-2025-12030 : Référence directe à un objet non sécurisée dans le plugin WordPress ACF to REST API Mots-clés : CVE-2025-12030, vulnérabilité ACF to REST API, IDOR, sécurité WordPress, exploitation authentifiée, vulnérabilité de plugin WordPress, CWE-639, modification de champs ACF, contournemen...

CVE-2026-102666: Use of Hard-coded Credentials

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once...

CVE-2026-101147: Cross-Site Request Forgery (CSRF)

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

Rocky Linux 8 [CIQ] Security Update: crit / criu / criu-debuginfo / criu-debugsource / libslirp / etc (crlsa-2021_0531)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20210531 advisory. podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API CVE-2020-14370 Tenable has extracted the preceding...

CVE-2024-37054

mlflow-pickle-rce Универсальный proof-of-concept для RCE через десериализацию pickle в реестрах моделей MLflow в стиле CVE-2024-37054. Взаимодействует только с MLflow REST API — без предположений о каком-либо конкретном клиентском приложении перед ним. ⚠️ Только для авторизованного тестирования...

CVE-2026-102134

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and...

CVE-2026-102134

The Kiteworks Core platform contains a vulnerability where gateway-level API security controls are not consistently applied to all requests authenticated via the central authentication service. Specifically, an authenticated user can access REST API functionality through request paths that bypass...

CVE-2026-102134 Kiteworks Core Unprotected Alternate Channel

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and...

wp-secure-mcp

wp-secure-mcp Простыми словами: это позволяет ИИ-агенту читать и немного записывать данные на сайт WordPress через настоящий Application Password WordPress — тот же тип учётных данных, который уже выдаёт wp-admin — и ничего больше. Здесь нет формы регистрации, нет регистрации OAuth-клиента, нет...

pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-18783

The Trex MES software by Trex Digital Smart Manufacturing Systems Inc. is vulnerable to an Authentication Bypass due to missing server-side authentication on a REST API endpoint . This vulnerability allows unauthorized access to critical functions. The issue affects versions through 2026-09-29 . ...