CVE-2026-89190

The Robin Image Optimizer WordPress plugin, in versions prior to 2.0.8 , contains a vulnerability where it fails to verify user capabilities before dispatching a request handler within its bundled admin framework. This flaw allows users with subscriber-level accounts to access and render admin-on...

CVE-2026-89190 Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

CVE-2026-89190 Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

WordPress Robin Image Optimizer plugin < 2.0.8 - Subscriber+ Plugin Settings Disclosure vulnerability

Subscriber+ Plugin Settings Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin Robin image optimizer versions 2.0.8...

EUVD-2026-68054

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547

A low-privileged authenticated user on Termix (prior to 2.3.2) can call POST /database/export to retrieve a global settings table containing reset_code_ and temp_reset_token_ artifacts for other accounts, enabling account takeover and admin compromise via the normal password-reset flow. Upgrade t...

CVE-2026-16594

The WP Directory Kit WordPress plugin, in versions before 1.5.5 , is vulnerable to a sensitive information disclosure flaw. The plugin fails to perform adequate authorization or nonce checks on one of its authenticated AJAX actions. This security oversight allows any authenticated user, such as a...

WordPress Praison AI SEO plugin < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure) vulnerability

Unauthenticated Multiple Missing Authorization Post Permalink Modification, Plugin Settings Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Praison SEO WordPress versions 5.0.7...

EUVD-2026-39654

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible...

CVE-2026-57922

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible...

CVE-2026-57922

CVE-2026-57922 affects JetBrains YouTrack prior to version 2026.2.16593, where project settings could be disclosed via MCP. The vulnerability is described as a disclosure of project settings, with no exploitation details provided. The documents imply a fix in version 2026.2.16593, but do not prov...

CVE-2026-57922

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible...

PT-2026-52702

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.16593 Description An issue exists that allows the disclosure of project settings via the MCP. Recommendations Update to version 2026.2.16593...

CVE-2026-57922: Missing Authorization

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible...

CVE-2026-50232

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when user...

EUVD-2026-34831

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when user...

CVE-2026-7552 Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter

The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to expose sensitive plugin...

WordPress Geo Mashup plugin <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure vulnerability

Missing Authorization to Unauthenticated Plugin Settings Disclosure vulnerability discovered by t0ann9uy3n in WordPress Plugin Geo Mashup versions = 1.13.19...