https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T17:18:43.097392+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-287822 EUVD-2026-287822 2026-10-05T17:18:43.143286+00:00 EUVD-2026-287822 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14947 fkie_cve-2025-14947 2026-10-05T17:18:43.143323+00:00

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates.

 https://cve.radiocsirt.org/vuln/ghsa-xj7c-96w2-g33p GHSA-xj7c-96w2-g33p 2026-10-05T17:18:43.143356+00:00

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates.