WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Semantic Search Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...

WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Global Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...

GHSA-P3PR-8F3M-4QP8 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Summary pyLoad ships the WindowsPhoneNotify addon, whose send method opens an HTTP connection to a host taken directly from the plugin's pushurl configuration value. A user holding the standard non-admin SETTINGS permission can set pushurl and pushid and enable the addon through the web API, sinc...

CVE-2026-33272

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

EUVD-2026-95815

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Jakub Herman in WordPress Plugin uListing versions = 2.2.0...

CVE-2026-85348

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

EUVD-2026-95706

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

BIT-GHOST-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

EUVD-2026-95523

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability

Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...

CVE-2026-88931

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

PT-2026-109318

Name of the Vulnerable Software and Affected Versions Wizarr versions prior to 2026.9.1 Description Markdown content provided through the editor or imported bundles is evaluated in a non-sandboxed Jinja2 environment with application globals exposed. This allows an authenticated user with...

CVE-2026-33272: Authentication Bypass Using an Alternate Path or Channel

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

AZL-107589 CVE-2026-97032 affecting package kata-containers-cc 3.15.0.aks0-21

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107138 CVE-2026-78669 affecting package application-gateway-kubernetes-ingress 1.7.7-6

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107607 CVE-2026-78669 affecting package keda 2.14.1-19

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107174 CVE-2026-78669 affecting package azurelinux-image-tools 1.6.0-3

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...