79044 matches found
CVE-2026-32331 WordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Textmetrics: from n/a through = 3.6.4...
CVE-2026-32331
CVE-2026-32331 affects the WordPress Textmetrics plugin (webtexttool) up to version 3.6.4 due to a broken access control issue. The root cause is improperly configured authorization/security levels, allowing exploitation of access control weaknesses in Textmetrics webtexttool. Impact is described...
CVE-2026-32329
The CVE-2026-32329 entry concerns WordPress plugin Advanced Related Posts (Ays Pro) in the component advanced-related-posts, affected up to version 1.9.1. The root cause is a Missing Authorization/Incorrectly Configured Access Control vulnerability, i.e., Broken Access Control that could enable u...
CVE-2026-31916 WordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through = 14.2.1...
BIT-GITLAB-2025-12555 Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD...
CVE-2026-4063 Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation
The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the addmenuitem method hooked to adminmenu in all versions up to, and including, 4.5.8. This is due to the method performing wpinsertpost and...
BIT-WORDPRESS-2026-3906 WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature block-level collaboration annotations was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API createitempermissionscheck method in...
BIT-WORDPRESS-MULTISITE-2026-3906 WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature block-level collaboration annotations was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API createitempermissionscheck method in...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
CVE-2025-59284-PoC Proof of con...
CVE-2026-3045
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: 1 a non-user-bound publicnonce is exposed to unauthenticated users...
WordPress plugin Perfect Portfolio 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
PT-2026-25160
Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25.3.0...
PT-2026-25315
CVE-2026-225757: GetGenie WP plugin IDOR flaw all ≤4.3.2 lets unauth users access/modify/delete arbitrary objects via ID manipulation. Update to 4.3.3 now—check for leaked data. CyberSec WordPress IDOR https://t.co/HVW0fbWe9M...
WordPress e2pdf 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. WordPress...
PT-2026-28450
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11 Description OpenClaw contains a privilege escalation issue within the device.token.rotate function. Callers possessing operator.pairing scope can generate tokens with expanded scopes, bypassing intended sco...
WordPress plugin VW Photography 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...
The vulnerability of the OnBeacon() function in the drivers/staging/rtl8723bs/core/rtw_mlme_ext.c module allows unauthorized access to protected information by a remote attacker. This vulnerability enables unauthorized access to sensitive data.
The vulnerability of the OnBeacon function in the drivers/staging/rtl8723bs/core/rtwmlmeext.c module, which supports additional devices in the Linux operating system, is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to gain unauthoriz...
CVE-2026-1525
A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing e.g., "Content-Length" and "content-length". This can lead to HTTP Request Smuggling, a...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the h2c upgrade process. An attacker can gain unauthorized access by exploiting improper authentication handling during the HTTP/2 Cleartext upgrade. Remediation Upgrade...