CVE-2023-54359

CVE-2023-54359 affects WordPress adivaha Travel Plugin 2.3. The vulnerability is a time-based blind SQL injection in the pid parameter, exploitable by unauthenticated attackers via the /mobile-app/v3/ endpoint using XOR-based payloads to manipulate queries and potentially expose data or cause den...

CVE-2023-54358 WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at...

CVE-2026-40189

creationtimestamp| type| source ---|---|--- 2026-04-09 18:20:46+00:00| published-proof-of-concept| https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx 2026-04-10 21:24:55+00:00| published-proof-of-concept| Telegram/4ztR6gRcWXk6YwHnamVGk5ZiVkHzJEoA9sdr8vYKwKHNiwI 2026-04-...

EUVD-2026-20978

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

CVE-2026-4338

creationtimestamp| type| source ---|---|--- 2026-04-09 11:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj2nprutki27...

CVE-2026-5357

creationtimestamp| type| source ---|---|--- 2026-04-09 04:05:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizwjg3uwt24 2026-04-19 08:33:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjtk5zr37f2c...

CVE-2026-5830

creationtimestamp| type| source ---|---|--- 2026-04-09 02:52:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizshbo33j2i 2026-04-09 03:18:04+00:00| published-proof-of-concept| Telegram/k6H1jBRyYuwqPn43znhK7mg4465TougGvrd7kOsXjIgmqE 2026-05-01 01:37:08+00:00| seen|...

CVE-2026-4124

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...

CVE-2026-4124

CVE-2026-4124 concerns the Ziggeo WordPress plugin (versions ≤ 3.1.1). The vulnerability arises in the wp_ajax_ziggeo_ajax handler, which only checks a nonce (check_ajax_referer) and lacks capability checks via current_user_can(). The nonce ziggeo_ajax_nonce is exposed to all logged-in users thro...

PT-2026-31725

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at...

CVE-2026-39851

creationtimestamp| type| source ---|---|--- 2026-04-08 22:16:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizd2fxkvu2q...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5844

creationtimestamp| type| source ---|---|--- 2026-04-08 20:16:06+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5844 2026-04-09 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116373220738589930 2026-04-09 06:00:30+00:00| seen|...

CVE-2026-39355

Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users’ team workspaces...

CVE-2026-39706

creationtimestamp| type| source ---|---|--- 2026-04-08 10:32:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy3pojsob2i...

CVE-2026-32282

creationtimestamp| type| source ---|---|--- 2026-04-08 04:24:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixh4she3w23 2026-04-15 22:49:41+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mjky5tnx3ef2 2026-04-17 12:01:34+00:00| seen|...

[SECURITY] Fedora 43 Update: goose-1.23.2-7.fc43

Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...

MAL-2026-2865 Malicious code in @sie-ppr-web-checkout/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 977089aabb00f7d390dd6bf7ad3e9038c4998ec2ccf93a2e38016f525c32f368 The package @sie-ppr-web-checkout/app was found to contain malicious code. Source: ghsa-malware...

Malicious code in @sie-ppr-web-checkout/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 977089aabb00f7d390dd6bf7ad3e9038c4998ec2ccf93a2e38016f525c32f368 The package @sie-ppr-web-checkout/app was found to contain malicious code. Source: ghsa-malware...