CVE-2026-11981

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the givesetnotificationstatushandler function. This makes it possible for unauthenticated attackers to disable donation email notificatio...

CVE-2026-11981 GiveWP <= 4.15.3 - Cross-Site Request Forgery

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the givesetnotificationstatushandler function. This makes it possible for unauthenticated attackers to disable donation email notificatio...

CVE-2026-11981

The CVE-2026-11981 entry concerns the WordPress GiveWP plugin (affected: versions up to 4.15.3) with a Cross-Site Request Forgery vulnerability due to missing nonce validation in give_set_notification_status_handler(). This allows unauthenticated attackers to disable donation email notifications ...

GHSA-M63V-2G9W-2W6V

creationtimestamp| type| source ---|---|--- 2026-07-01 03:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116842484590156234 2026-07-01 03:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpkjmgapbr23...

EUVD-2026-40442

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...

PT-2026-54460

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give set notification status handler function. This makes it possible for unauthenticated attackers to disable donation email...

Linux Distros Unpatched Vulnerability : CVE-2026-13976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiall...

ROS-20260701-73-0056

The vulnerability of the raid10syncrequest function in the drivers/md/raid10.c module of the Linux kernel’s device driver for multiple devices RAID and LVM is related to display errors when reporting resource status due to inconsistent checks. Exploiting this vulnerability can allow an attacker t...

CVE-2026-56334

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...

CVE-2026-50003

creationtimestamp| type| source ---|---|--- 2026-06-30 22:51:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpk3ooy4n423 2026-07-01 02:36:40+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01 2026-07-02 20:45:13+00:00| seen|...

CVE-2026-56334 Capgo - Missing UPDATE RLS Policy for Build Status Persistence

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...

CVE-2026-56334 Capgo - Missing UPDATE RLS Policy for Build Status Persistence

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...

CVE-2026-56334

Capgo before 12.128.2 is affected by an insufficient UPDATE row-level security (RLS) policy on the build_requests table. The missing policy allows API-key and anonymous access to persist builder status updates to be blocked or unpersisted, resulting in build status and error details remaining in ...

CVE-2026-56318

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validatepasswordcompliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observi...

CVE-2026-8864

creationtimestamp| type| source ---|---|--- 2026-06-30 18:11:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjm2lvbnn2u...

CVE-2026-58377

creationtimestamp| type| source ---|---|--- 2026-06-30 17:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlfnxyxp2d 2026-07-02 05:59:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpne2y63yj22...

CVE-2025-23351

creationtimestamp| type| source ---|---|--- 2026-06-30 16:30:28+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116840007230776932 2026-07-01 17:03:35+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mplypz6an627 2026-07-02 01:57:01+00:00| seen|...

CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...

CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...

CVE-2026-58371

SeaweedFS before 4.30 is vulnerable to cross-origin information disclosure via an unvalidated JSONP callback parameter. The shared writeJson helper can reflect the callback verbatim into responses served as application/javascript without callback-name validation, missing X-Content-Type-Options: n...