CVE-2026-68861

creationtimestamp| type| source ---|---|--- 2026-08-27 19:10:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117169049441350258 2026-08-29 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6vimppxt23...

CVE-2026-69519

creationtimestamp| type| source ---|---|--- 2026-08-27 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu3ijqlmnk2h...

SUSE CVE-2026-55227

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-1512

creationtimestamp| type| source ---|---|--- 2026-08-27 15:00:12+00:00| seen| https://t.me/cve0day/255 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/255 2026-08-29 00:00:30+00:00| published-proof-of-concept| https://t.me/cve0day/255...

CVE-2026-27579

creationtimestamp| type| source ---|---|--- 2026-08-27 15:00:12+00:00| seen| https://t.me/cve0day/257 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/257 2026-08-29 00:00:30+00:00| published-proof-of-concept| https://t.me/cve0day/257...

GHSA-F558-MP87-58VJ

creationtimestamp| type| source ---|---|--- 2026-08-27 15:00:12+00:00| seen| https://t.me/cve0day/270 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/270 2026-08-29 00:00:30+00:00| published-proof-of-concept| https://t.me/cve0day/270...

CVE-2026-81574

creationtimestamp| type| source ---|---|--- 2026-08-27 11:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu2p267o7c2l 2026-08-27 11:01:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ibazv6h46utsr 2026-09-15 08:17:47+00:00| seen|...

CVE-2026-71416

creationtimestamp| type| source ---|---|--- 2026-08-27 09:30:40+00:00| published-proof-of-concept| https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf 2026-09-11 15:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvatgoplu222 2026-10-03...

curl: 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path

Summary The fix for CVE-2026-7009 commit 51905671e0 does not cover AWS-LC. In osslappleverify in lib/vtls/openssl.c, a missing OCSP staple is detected only when SSLgettlsextstatusocspresp returns a negative length. OpenSSL returns -1 for absence, but AWS-LC returns 0 with a NULL output pointer. O...

curl: 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Summary Curlvtlsappleverify in lib/vtls/apple.c passes the stapled OCSP response to SecTrustSetOCSPResponse only when both HAVEBUILTINAVAILABLE and SUPPORTSSecOCSP are defined. When HAVEBUILTINAVAILABLE is absent, the OCSP buffer is silently discarded. GCC does not support builtinavailable, so th...

WordPress Dokan plugin < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability

Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability discovered by Shivamani Vastrala in WordPress Plugin Dokan versions 5.0.9...

CVE-2026-78125

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

WordPress LearnPress plugin < 4.0.3 - Unauthenticated Order Status Disclosure vulnerability

Unauthenticated Order Status Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin LearnPress & Sepay Payment versions 4.0.3...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

EUVD-2026-66881

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125

The LearnPress WordPress plugin (specifically the Sepay Payment component) is vulnerable in versions up to and including 4.0.2 due to a missing authorization check on one of its REST endpoints . This flaw allows unauthenticated attackers to disclose the payment status of arbitrary orders by enume...

CVE-2026-80521

creationtimestamp| type| source ---|---|--- 2026-08-27 01:57:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117164986929423742 2026-09-23 12:44:11+00:00| seen| https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw6rfhbhe624 2026-09-23 12:44:12+00:00| seen|...

CVE-2026-78125: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...