CVE-2026-1667

The CVE concerns the SEO Plugin by Squirrly SEO for WordPress (up to version 14.0.0) with a vulnerability in savePost() that allows unauthenticated users to create arbitrary posts and, if Advanced Custom Fields is installed, to inject stored XSS scripts. Root cause is a leak of an API token and i...

CVE-2026-1667 SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-61444

creationtimestamp| type| source ---|---|--- 2026-07-10 16:15:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqck7yabkh27 2026-07-10 16:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqclwzjjnb2f 2026-07-10 20:16:31+00:00| seen|...

CVE-2026-59796

creationtimestamp| type| source ---|---|--- 2026-07-10 16:12:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqck3iudxm2x 2026-07-10 20:22:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcy2mf6472z 2026-07-12 06:00:48+00:00| seen|...

CVE-2026-48043

creationtimestamp| type| source ---|---|--- 2026-07-10 15:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcjc5vizd2e...

CVE-2026-54469

creationtimestamp| type| source ---|---|--- 2026-07-10 15:30:16+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116896393517811948 2026-07-10 17:27:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcoasxcp327 2026-07-10 21:24:23+00:00| seen|...

GHSA-4VJ7-5MJ6-JM8M

creationtimestamp| type| source ---|---|--- 2026-07-10 15:11:59+00:00| seen| https://gist.github.com/alon710/6a1f370c6283107f299350100ca84db2...

CVE-2026-48138

creationtimestamp| type| source ---|---|--- 2026-07-10 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqceqewuyp2g...

CVE-2026-31267

creationtimestamp| type| source ---|---|--- 2026-07-10 14:07:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116896068760157808 2026-07-11 00:34:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg4zqogq2z...

EUVD-2026-42887

n8n before 1.123.24, 2.10.4, and 2.12.0 across its 1.x and 2.x branches contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions...

CVE-2026-56312

Capgo before 12.128.2 is affected by an improper validation vulnerability in the accept_invitation endpoint. The issue allows bypassing captcha validation to create user accounts, potentially wasting invite links and enabling unauthorized account creation. Affected product/version: Capgo prior to...

CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn...

CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn...

CVE-2026-11990

creationtimestamp| type| source ---|---|--- 2026-07-10 12:32:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc5r4f2p52z 2026-07-10 13:23:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcamqmmvf22 2026-07-11 00:44:17+00:00| seen|...

CVE-2026-14461

creationtimestamp| type| source ---|---|--- 2026-07-10 12:27:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc5i5xosi2x 2026-07-10 14:21:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcdud4c3b26 2026-07-10 16:15:07+00:00| seen|...

CVE-2026-51807

creationtimestamp| type| source ---|---|--- 2026-07-10 12:26:14+00:00| seen| https://gist.github.com/5asever40-a11y/dcfa867b099a7782ad72ab7981427765 2026-07-14 23:56:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfu3brq72t 2026-07-15 15:44:06+00:00| seen|...

CVE-2026-12955

creationtimestamp| type| source ---|---|--- 2026-07-10 12:13:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4oz4s4a2i 2026-07-10 21:13:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2vwd6tv2s...

CVE-2026-9838

creationtimestamp| type| source ---|---|--- 2026-07-10 11:57:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc3sxpap32w 2026-07-10 12:14:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4qmhllr2e...

CVE-2026-15182

creationtimestamp| type| source ---|---|--- 2026-07-10 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mqc2t473jw2c...

CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...