{ "append_only": true, "archive_index_url": "https://vuln.signal-radar.com/data/vuln/archive/index.json", "archive_version": "v0.1", "generated_at": "2026-08-11T04:47:29.424605+00:00", "immutable_run": true, "item_count": 20, "items": [ { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16881/", "current_public_safe_latest": true, "cvss_score": 8.7, "cvss_severity": "HIGH", "epss_percentile": 0.17818, "epss_score": 0.00262, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16881", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16881.json", "product": null, "public_safe_summary": "NVD: A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. NVD: The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. NVD: As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16881.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. NVD: The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. NVD: As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16881/timeline.json", "vendor": null }, { "affected_label": "redhat / build_of_keycloak", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-18569/", "current_public_safe_latest": true, "cvss_score": 3.7, "cvss_severity": "LOW", "epss_percentile": 0.05786, "epss_score": 0.00162, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-18569", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-18569.json", "product": "build_of_keycloak", "public_safe_summary": "NVD: A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. NVD: This component handles authentication and session management for applications. NVD: The issue occurs when an OIDC identity provider is configured to skip signature validation.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-18569.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "vendor/product: redhat / build_of_keycloak; affected version context: -", "source_published_impact": "This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. NVD: This component handles authentication and session management for applications. NVD: The issue occurs when an OIDC identity provider is configured to skip signature validation.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-18569/timeline.json", "vendor": "redhat" }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-18739/", "current_public_safe_latest": true, "cvss_score": 2.5, "cvss_severity": "LOW", "epss_percentile": 0.00721, "epss_score": 0.00095, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-18739", "impact_tags": [ "code execution review", "local exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-18739.json", "product": null, "public_safe_summary": "NVD: A flaw was found in popt, a command-line option parsing library. NVD: An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. NVD: This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-18739.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes code execution review · local exposure. Possible impact: A local user may be able to run code or commands on affected systems.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A flaw was found in popt, a command-line option parsing library. NVD: An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. NVD: This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-18739/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-68744/", "current_public_safe_latest": true, "cvss_score": 3.3, "cvss_severity": "LOW", "epss_percentile": 0.0086, "epss_score": 0.00097, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-68744", "impact_tags": [ "local exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-68744.json", "product": null, "public_safe_summary": "NVD: A flaw was found in SSSD. NVD: The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. NVD: A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-68744.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes local exposure. Possible impact: This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for local exposure.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A flaw was found in SSSD. NVD: The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. NVD: A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-68744/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-10526/", "current_public_safe_latest": true, "cvss_score": 5.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.13587, "epss_score": 0.00228, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-10526", "impact_tags": [ "remote exposure relevant", "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-10526.json", "product": null, "public_safe_summary": "NVD: The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-10526.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes remote exposure · authenticated boundary. Possible impact: This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-10526/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-11366/", "current_public_safe_latest": true, "cvss_score": 3.7, "cvss_severity": "LOW", "epss_percentile": 0.09087, "epss_score": 0.00192, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-11366", "impact_tags": [ "remote exposure relevant", "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-11366.json", "product": null, "public_safe_summary": "NVD: The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-11366.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes remote exposure · authenticated boundary. Possible impact: This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-11366/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-12698/", "current_public_safe_latest": true, "cvss_score": 4.3, "cvss_severity": "MEDIUM", "epss_percentile": 0.08268, "epss_score": 0.00185, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-12698", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-12698.json", "product": null, "public_safe_summary": "NVD: The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-12698.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-12698/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-14816/", "current_public_safe_latest": true, "cvss_score": 6.5, "cvss_severity": "MEDIUM", "epss_percentile": 0.16342, "epss_score": 0.0025, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-14816", "impact_tags": [ "remote exposure relevant", "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-14816.json", "product": null, "public_safe_summary": "NVD: The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-14816.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes remote exposure · authenticated boundary. Possible impact: This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-14816/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-14824/", "current_public_safe_latest": true, "cvss_score": 4.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.06945, "epss_score": 0.00173, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-14824", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-14824.json", "product": null, "public_safe_summary": "NVD: The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-14824.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-14824/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-14848/", "current_public_safe_latest": true, "cvss_score": 5.4, "cvss_severity": "MEDIUM", "epss_percentile": 0.06591, "epss_score": 0.0017, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-14848", "impact_tags": [ "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-14848.json", "product": null, "public_safe_summary": "NVD: The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-14848.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes authenticated boundary. Possible impact: This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-14848/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-14872/", "current_public_safe_latest": true, "cvss_score": 6.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.13884, "epss_score": 0.00231, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-14872", "impact_tags": [ "SQL injection risk" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-14872.json", "product": null, "public_safe_summary": "NVD: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-14872.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes SQL injection risk. Possible impact: An attacker may be able to read or change database-backed application data.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-14872/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-14939/", "current_public_safe_latest": true, "cvss_score": 6.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.1441, "epss_score": 0.00235, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-14939", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-14939.json", "product": null, "public_safe_summary": "NVD: The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local... NVD: As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-14939.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local... NVD: As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-14939/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-15233/", "current_public_safe_latest": true, "cvss_score": 4.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.03997, "epss_score": 0.00142, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-15233", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-15233.json", "product": null, "public_safe_summary": "NVD: The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-15233.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-15233/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-15958/", "current_public_safe_latest": true, "cvss_score": 9.3, "cvss_severity": "CRITICAL", "epss_percentile": 0.10529, "epss_score": 0.00204, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-15958", "impact_tags": [ "remote exposure relevant", "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-15958.json", "product": null, "public_safe_summary": "NVD: The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-15958.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes remote exposure · authenticated boundary. Possible impact: This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-15958/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16035/", "current_public_safe_latest": true, "cvss_score": 4.3, "cvss_severity": "MEDIUM", "epss_percentile": 0.09344, "epss_score": 0.00195, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16035", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16035.json", "product": null, "public_safe_summary": "NVD: The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16035.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16035/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16056/", "current_public_safe_latest": true, "cvss_score": 4.3, "cvss_severity": "MEDIUM", "epss_percentile": 0.05802, "epss_score": 0.00162, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16056", "impact_tags": [ "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16056.json", "product": null, "public_safe_summary": "NVD: The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16056.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes authenticated boundary. Possible impact: This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16056/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16068/", "current_public_safe_latest": true, "cvss_score": 3.5, "cvss_severity": "LOW", "epss_percentile": 0.03996, "epss_score": 0.00142, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16068", "impact_tags": [ "authenticated boundary review" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16068.json", "product": null, "public_safe_summary": "NVD: The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16068.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes authenticated boundary. Possible impact: This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16068/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16069/", "current_public_safe_latest": true, "cvss_score": 6.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.14522, "epss_score": 0.00235, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16069", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16069.json", "product": null, "public_safe_summary": "NVD: The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16069.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16069/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16070/", "current_public_safe_latest": true, "cvss_score": 2.7, "cvss_severity": "LOW", "epss_percentile": 0.06458, "epss_score": 0.00168, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16070", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16070.json", "product": null, "public_safe_summary": "NVD: The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16070.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16070/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-16293/", "current_public_safe_latest": true, "cvss_score": 6.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.14523, "epss_score": 0.00235, "first_observed_at": "2026-08-11T04:43:10.985977+00:00", "id": "CVE-2026-16293", "impact_tags": [ "XSS risk" ], "kev": false, "last_observed_at": "2026-08-11T04:43:10.985977+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-16293.json", "product": null, "public_safe_summary": "NVD: The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/items/CVE-2026-16293.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes XSS risk. Possible impact: This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when...", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-16293/timeline.json", "vendor": null } ], "public_safe_only": true, "radar": "vuln", "run_id": "20260811T044729Z", "run_index_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T044729Z/index.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "schema_version": "v0.1" }