🕵️ RESEARCH & DEEP DIVES
3D FlipBook WordPress plugin ≤ 1.16.20 leaks protected flipbook data via 'id' parameter (CVE-2026-15758)
The 3D FlipBook WordPress plugin leaks sensitive data, including URLs of password-protected PDFs, to unauthenticated attackers.- Affects WordPress sites using the 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin, all versions up to and including 1.16.20
- Sensitive information is exposed via the 'id' parameter, allowing unauthenticated attackers to extract flipbook title, outline, props, and the serialized data blob containing the PDF's direct URL
- The exposure bypasses WordPress post-password confidentiality on password-protected flipbooks
- Flipbook post IDs can be enumerated via the unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge
- CVSS 3.1 score 5.3 (Medium); vulnerability credited to Suredsi Ulpada (cyberdesu), assigned CWE-200
Cisco patches Secure Email Gateway zero-day exploited in attacks — BleepingComputer
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution — The Hacker News
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE — The Hacker News
GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overfl... — CVE ThreatInt
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetproxy-a... — CVE ThreatInt
SourceCodester Online Faculty Clearance System Profile Picture Upload edit_pi... — CVE ThreatInt
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce through 4.1... — CVE ThreatInt
AI Engine through 3.7.7 - Insecure Direct Object Reference to Authenticated (Subsc... — CVE ThreatInt
WP Directory Kit through 1.5.7 - Unauthenticated Unpublished Listing Disclosure vi... — CVE ThreatInt
WP Directory Kit through 1.5.7 - Contributor+ Non-Public Listing Field Disclosure ... — CVE ThreatInt
WP Directory Kit through 1.5.7 - Editor+ SQL Injection via Elementor Category and ... — CVE ThreatInt
Android application "ManabiPocket for Parents" contains an improper access co... — CVE ThreatInt
D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflowA flaw has b... — CVE ThreatInt
moment vulnerable to Path Traversal via crafted non-string locale namemoment ... — CVE ThreatInt
Hawtio-operator: hawtio-operator: tls private key written to operator log at ... — CVE ThreatInt
Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec... — CVE ThreatInt
stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authenticati... — CVE ThreatInt
D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflowA sec... — CVE ThreatInt
D-Link DIR-882 CGI Binary dllog.cgi main information disclosureA weakness has... — CVE ThreatInt
Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026 — Cyber Security News
Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026 — Cyber Security News
UANIA OS: Authenticated Remote Code Execution — r/netsec
EchelonGraph — r/netsec
Improving Single Sign-On Experiences with OpenID Connect and SCIM — securityboulevard.com (discovered)
Mastering SSO Implementation: A Comprehensive Guide for Seamless & Secure Logins — securityboulevard.com (discovered)
AI Agent Identity and Access Control: A Framework for B2B SaaS — securityboulevard.com (discovered)
Why Post-Quantum Cryptography Should Matter to Every Organization — securityboulevard.com (discovered)