https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T19:19:11.804673+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349705 EUVD-2026-349705 2026-10-10T19:19:11.806985+00:00 EUVD-2026-349705 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11974 fkie_cve-2026-11974 2026-10-10T19:19:11.807017+00:00

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

 https://cve.radiocsirt.org/vuln/ghsa-fj8r-hgww-qgmw GHSA-fj8r-hgww-qgmw 2026-10-10T19:19:11.807049+00:00

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.