CVE-2026-73377

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-75851

creationtimestamp| type| source ---|---|--- 2026-08-18 12:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mte7bb543m2p 2026-08-18 12:27:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jmjnx7jcsbs5x 2026-08-18 13:00:50+00:00| seen|...

ROOT-APP-NPM-CVE-2025-64718 CVE-2025-64718 in js-yaml - Patched by Root

Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available...

WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...

ROOT-APP-GOBINARY-CVE-2026-25681 CVE-2026-25681 in golang.org/x/net - Patched by Root

Root has patched CVE-2026-25681 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-25639 CVE-2026-25639 in axios - Patched by Root

Root has patched CVE-2026-25639 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44494 CVE-2026-44494 in axios - Patched by Root

Root has patched CVE-2026-44494 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44487 CVE-2026-44487 in axios - Patched by Root

Root has patched CVE-2026-44487 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44488 CVE-2026-44488 in axios - Patched by Root

Root has patched CVE-2026-44488 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39833 CVE-2026-39833 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39833 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39831 CVE-2026-39831 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39831 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \\sms,...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access

The plugin does not restrict access to published and non protected posts/pages when the maintenance mode is enabled, allowing unauthenticated users to access them. id: CVE-2023-1263 info: name: Coming Soon & Maintenance 4.1.7 - Unauthenticated Post/Page Access author: r3Y3r53 severity: medium...

XWiki - Open Redirect

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com i.e. omitting the http:. It was also possible to bypass it when using URL...

ATutor < 2.2.1 - Cross Site Scripting

ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. id: CVE-2023-27008 info: name: ATutor 2.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | ATutor 2.2.1 was discovered with a vulnerability, a...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access. id: CVE-2019-11886 info: name: Yellow Pencil Visual Theme Customizer 7.2.1 - Privilege...

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...