CVE-2026-54409

creationtimestamp| type| source ---|---|--- 2026-07-03 07:06:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppycdprae2o 2026-07-08 11:01:21+00:00| seen| https://vulnerability.circl.lu/bundle/ebad18a5-251f-49a4-b877-c63995fd13a6...

CVE-2026-9148 Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the getCommentAuthor function, which interpolates the stored commentauthorurl...

CVE-2026-8926

The curl utility (and libcurl ) is vulnerable to a password leak when it uses a .netrc file for credentials while the URL contains a username without a password (e.g., https://[email protected]/). In this scenario, if no exact match exists for the specified user, curl may incorrectly retrieve and ...

CVE-2026-8926 password leak with netrc and user in URL

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...

CVE-2026-8926

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...

CVE-2026-12064 proto-default skips SSH verification

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

EUVD-2026-41502

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

CVE-2026-12064 proto-default skips SSH verification

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

CVE-2026-12064

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

CVE-2026-11397

creationtimestamp| type| source ---|---|--- 2026-07-03 06:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppv7esftr2w 2026-07-03 16:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpqwyyq3yp2k 2026-07-03 20:53:28+00:00| seen|...

CVE-2026-12920

creationtimestamp| type| source ---|---|--- 2026-07-03 06:02:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppuqn3v7h2u 2026-07-03 09:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpq7jyedgu2m 2026-07-03 19:26:14+00:00| seen|...

EUVD-2026-41489

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

CVE-2026-11397

The CVE-2026-11397 entry concerns the WordPress plugin WP Import Export Lite (versions

CVE-2026-11397 WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

CVE-2026-11397 WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

CVE-2025-69132

creationtimestamp| type| source ---|---|--- 2026-07-03 03:28:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppm4ijrkz2y...

CVE-2026-12960

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS...

CVE-2026-13050

creationtimestamp| type| source ---|---|--- 2026-07-03 02:48:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppjvl2taw2s 2026-07-03 18:56:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpr7xwm3m52k...

CVE-2026-13728

creationtimestamp| type| source ---|---|--- 2026-07-03 02:45:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppjplxoob2s 2026-07-03 18:56:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpr7x6yb642b...

CVE-2026-13084

creationtimestamp| type| source ---|---|--- 2026-07-03 02:16:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppi32kisz2o 2026-07-03 18:55:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpr7vly4kv2k...