tag

Route-Confusion

wp2shell — WordPress Core Pre-Auth SQLi → Row Forgery → Admin Creation → RCE (CVE-2026-63030 + CVE-2026-60137) KEV EPSS 97%

CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf web Patched

CVE-2026-63030webCRITICAL 9.1Patched2026-07-19LiteLLM Proxy Unauthenticated Auth Bypass via Host-Header Route Confusion (CVE-2026-49468)

CVE-2026-49468 web Patched

CVE-2026-49468webCRITICAL 9.8Patched2026-07-05Discourse Scoped API Key Pre-Route Authorization Bypass

None assigned as of 2026-07-03 web Unverified

None assigned as of 2026-07-03webHIGHUnverified2026-07-03