123231 matches found
CVE-2026-8848
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-22927
creationtimestamp| type| source ---|---|--- 2026-07-09 05:50:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116888450705839903 2026-08-05 08:27:26+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3msd47cgijk2y...
GHSA-9298-4CF8-G4WJ
creationtimestamp| type| source ---|---|--- 2026-07-09 03:00:12+00:00| seen| https://t.me/brutsecurity/1052 2026-07-10 00:00:35+00:00| seen| https://t.me/brutsecurity/1052 2026-07-11 16:00:02+00:00| published-proof-of-concept| https://t.me/brutsecurity/1052 2026-07-12 00:00:45+00:00|...
CVE-2026-54779
creationtimestamp| type| source ---|---|--- 2026-07-09 01:27:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6i5snv3v27...
CVE-2026-54784
creationtimestamp| type| source ---|---|--- 2026-07-09 01:22:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6hv3t6nv2i...
Exploit for CVE-2026-50131
CVE-2026-50131 Fedify incomplete SSRF mitigation after GHSA-...
PT-2026-56987
Name of the Vulnerable Software and Affected Versions Junos OS on MX Series versions prior to 23.2R2-S7 Junos OS on MX Series versions 23.4 through 23.4R2-S8 Junos OS on MX Series versions 24.2 through 24.2R2-S5 Junos OS on MX Series versions 24.4 through 24.4R2-S4 Junos OS on MX Series versions...
PT-2026-56897
Name of the Vulnerable Software and Affected Versions Hoppscotch versions prior to 2026.6.0 Description The updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER SMTP URL value. Additionally, the validateSMTPUrl function in utils.ts permits path,...
Alibaba Cloud Linux 3 : 0187: podman (ALINUX3-SA-2026:0187)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0187 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-25679: url.Parse insufficiently...
Linux Distros Unpatched Vulnerability : CVE-2026-59947
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential...
gstreamer1-plugins-bad-free security update
1.16.1-8.0.1 - Update origin URL Orabug: 36209826 1.16.1-8 - Fix for CVE-2026-52720: librfb framebuffer update rectangle validation Resolves: RHEL-184455 1.16.1-7 - Fix integer overflow in vmncdec CVE-2026-52722 Resolves: RHEL-184414...
CVE-2026-59223: Protection Mechanism Failure
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEBFETCHFILTERLIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based blocklist bypasses such as !internal.example.com in a URL pa...
PT-2026-56881
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description An issue exists in the channel thread parent and reply handling where the parent id is not bound to the channel in the URL. This allows an authenticated user to reference a message from a differe...
PT-2026-56886
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description Improper matching in the WEB FETCH FILTER LIST allows for blocklist bypasses. The system compares configured host entries against URL strings and non-label-boundary suffixes, which enables...
CVE-2026-55590: URL Redirection to Untrusted Site
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the...
PT-2026-59697
Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link...
PT-2026-57006
Name of the Vulnerable Software and Affected Versions GitHub CLI gh versions 2.10.0 through 2.95.0 Description Connecting to a malicious Codespace using the gh codespace jupyter command can lead to command execution. This occurs because the tool opens a JupyterLab URL provided by a process within...
CVE-2026-57054: Use of Incorrectly-Resolved Name or Reference
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...
CVE-2026-57501: Incorrect Privilege Assignment
Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...