CVE-2026-38669

wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...

WCMS 跨站脚本漏洞

WCMS is a content management system CMS developed by Vedegis for individual users. Version wCMS v.1.4 has a cross-site scripting vulnerability, which stems from cross-site scripting attacks when creating new blogs...

PPTAgent 路径遍历漏洞

PPTAgent is an open-source intelligent presentation generation tool based on large models developed by ICIP-CAS. Previous versions of PPTAgent, such as 418491a, contained a path traversal vulnerability. This vulnerability stemmed from issues with the markdowntabletoimage function, which could lea...

CVE-2026-40776

creationtimestamp| type| source ---|---|--- 2026-05-03 23:00:13+00:00| seen| Telegram/zMIGDiZKcsuCchc0aPmk0dRYccv5m6M1w-Y-ifos8swuOP4 2026-05-04 03:00:05+00:00| seen| Telegram/xOE6u0S4AhmTrHPBDYscPzMv6FpE3fbyPNbn5dJYZfuDoSw 2026-05-06 23:00:13+00:00| seen|...

CVE-2026-7704

creationtimestamp| type| source ---|---|--- 2026-05-03 20:31:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkxyu2d77q2r...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940-POC cPanel/WHM Authentication Bypass Proof of...

CVE-2026-5299

creationtimestamp| type| source ---|---|--- 2026-05-03 10:37:15+00:00| seen| https://t.me/itarmyofrussianews/379...

CVE-2026-44337

creationtimestamp| type| source ---|---|--- 2026-05-03 05:26:18+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3643-7v76-5cj2 2026-05-08 17:42:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlebpa6xin2k...

CVE-2026-7671

creationtimestamp| type| source ---|---|--- 2026-05-02 21:00:04+00:00| seen| Telegram/FLV6t7Va3cw7z9NmSu7nucQbg4vUfz1QpezNhFqmTOM...

CVE-2026-4100

The CVE concerns the Paid Memberships Pro plugin for WordPress, affecting all versions up to 3.6.5. The root cause is missing capability checks on three AJAX handlers: wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook. This allows a...

CVE-2026-4100 Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the wpajaxpmprostripecreatewebhook, wpajaxpmprostripedeletewebhook, and...

EUVD-2026-26782

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the wpajaxpmprostripecreatewebhook, wpajaxpmprostripedeletewebhook, and...

SUSE CVE-2026-31713

In the Linux kernel, the following vulnerability has been resolved: fuse: abort on fatal signal during sync init When sync init is used and the server exits for some reason error, crash while processing FUSEINIT, the filesystem creation will hang. The reason is that while all other threads will...

CVE-2026-31766

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. A local user could exploit this vulnerability by providing a malformed doorbell offset during user queue creation. This lack of proper bounds checking allows the offset to exceed the allocated memory, potentially corrupting critical...

CVE-2026-31713

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. When using synchronous initialization sync init, if the FUSE server exits unexpectedly while processing the FUSEINIT request, the filesystem creation process can hang. This issue occurs because the mounting thread keep...

CVE-2026-31712

A flaw was found in the ksmbd component of the Linux kernel. An authenticated Server Message Block SMB client with permissions to set an Access Control List ACL on a file can craft a malicious Discretionary Access Control List DACL. This crafted DACL, containing an undersized Access Control Entry...

CVE-2026-31701

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in createcard The caiaq driver stores a pointer to the parent USB device in cdev-chip.dev but never takes a reference on it. The card's privatefree callback, sndusbcaiaqcardfree, ca...

CVE-2026-43013

Technical details for CVE-2026-43013 are not publicly available in the provided connected documents. Monitor for updates from vendors/security trackers.

CVE-2026-43013 net/mlx5: lag: Check for LAG device before creating debugfs

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: lag: Check for LAG device before creating debugfs mlx5lagdevaddmdev may return 0 success even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5ldevadddebugfs ev...

CVE-2026-43013

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: lag: Check for LAG device before creating debugfs mlx5lagdevaddmdev may return 0 success even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5ldevadddebugfs ev...