EUVD-2026-43315

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

EUVD-2026-43291

The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level self-registerable account to approve, feature, or reject arbitrary jobs, including those owned by other user...

EUVD-2026-43286

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator...

CVE-2026-57797 WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through = 4.5.1...

CVE-2026-61952 WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through = 1.8.21...

CVE-2026-57810

CVE-2026-57810 describes a SQL injection in the WordPress plugin APIExperts Square for WooCommerce (woosquare), affecting versions up to and including 4.7.4. The vulnerability is characterized as blind SQL injection due to improper neutralization of special elements in SQL queries. The provided d...

CVE-2026-57400

The CVE-2026-57400 entry concerns the WordPress plugin Event Tickets Manager for WooCommerce. A Missing Authorization vulnerability is described as due to Incorrectly Configured Access Control Security Levels, affecting the plugin’s “Event Tickets Manager for WooCommerce” component in versions up...

CVE-2026-10551

creationtimestamp| type| source ---|---|--- 2026-07-13 07:45:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj75ixawh2e 2026-07-14 03:45:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlc65wqkm2y 2026-07-16 08:20:55+00:00| seen|...

CVE-2026-12275

creationtimestamp| type| source ---|---|--- 2026-07-13 07:43:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6z3gyqz22 2026-07-14 00:00:15+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqkvm5egav2z 2026-07-14 03:16:08+00:00| seen|...

CVE-2026-15532

creationtimestamp| type| source ---|---|--- 2026-07-13 06:43:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj3o3xkkn2i...

CVE-2026-15531

creationtimestamp| type| source ---|---|--- 2026-07-13 06:30:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj2wvxzcs2e 2026-07-13 21:25:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkmwms2f32w...

CLEANSTART-2026-ZJ03849 Security fixes for CVE-2026-42583, ghsa-72hv-8253-57qq, ghsa-mj4r-2hfc-f8p6 applied in versions: 3.8.6-r0, 3.8.6-r1

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-12271

The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail...

CVE-2026-10551

The Breeze Cache WordPress plugin (before version 2.5.6) is vulnerable to unauthenticated Stored XSS due to a predictable replacement hash in the HTML minification process and a related regex misusage. An attacker can inject arbitrary HTML attributes into the final HTML by predicting the placehol...

CVE-2026-15537

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-41041

creationtimestamp| type| source ---|---|--- 2026-07-13 04:20:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqito7op4j2u 2026-07-13 14:33:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjvvulqhy2e 2026-07-13 17:40:06+00:00| seen|...

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol IMAP client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in glXDispChangeDrawableAttributes. A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapp...

CVE-2026-15288

creationtimestamp| type| source ---|---|--- 2026-07-13 01:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqiik624f32l...

CVE-2026-15512

creationtimestamp| type| source ---|---|--- 2026-07-13 00:29:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqigrl4mk42f 2026-07-13 04:23:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqitumodw52l...