CVE-2026-9021 Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions

The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easyinvoiceacceptquote and easyinvoicedeclinequote AJAX actions via wpajaxnopriv hooks and relying solely on a quote-scoped nonce that i...

CVE-2026-9235 DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions

The DHL eCommerce Benelux for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the createlabel and deletelabel functions in versions up to, and including, 2.2.3. These functions are wir...

CVE-2026-47831

creationtimestamp| type| source ---|---|--- 2026-07-09 08:46:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7aomhpfa2q 2026-07-09 17:36:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6cspnal2i...

CVE-2026-12517

creationtimestamp| type| source ---|---|--- 2026-07-09 08:13:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76tg4nxx2g 2026-07-09 17:49:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6yw2ove2c...

CVE-2026-5523

creationtimestamp| type| source ---|---|--- 2026-07-09 08:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76hzxyyb26 2026-07-09 11:49:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq7kvszdyh27 2026-07-10 00:00:23+00:00| seen|...

CVE-2026-12270

creationtimestamp| type| source ---|---|--- 2026-07-09 08:04:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76d5lxbl2w 2026-07-09 17:40:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6izod342s...

CVE-2026-47828

The CVE affects bosh-cli versions prior to 7.10.4. During bosh create-env/delete-env, the CLI uploads CPI packages and rendered job templates to the VM’s DAV blobstore over HTTPS without verifying the server certificate, despite a CA certificate being present in the manifest. This enables a netwo...

CVE-2026-51541

creationtimestamp| type| source ---|---|--- 2026-07-09 03:44:40+00:00| seen| https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4b 2026-07-14 14:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmh7pt3tu2q...

CVE-2026-51538

creationtimestamp| type| source ---|---|--- 2026-07-09 03:40:11+00:00| seen| https://gist.github.com/MrAlaskan/8156ca3acd6754a9f66efede0a1351f2 2026-07-14 14:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmh7ocfu62v...

CVE-2026-51537

creationtimestamp| type| source ---|---|--- 2026-07-09 03:36:14+00:00| seen| https://gist.github.com/MrAlaskan/a5fb0fb7765c9df80d28220ed558f04e 2026-07-14 14:46:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmh467mk22t...

GHSA-GV7V-RGG6-548H

creationtimestamp| type| source ---|---|--- 2026-07-09 03:00:12+00:00| seen| https://t.me/brutsecurity/1117 2026-07-10 00:00:35+00:00| seen| https://t.me/brutsecurity/1117 2026-07-11 16:00:02+00:00| published-proof-of-concept| https://t.me/brutsecurity/1117 2026-07-12 00:00:45+00:00|...

GHSA-QCJ2-99CG-MPPF

creationtimestamp| type| source ---|---|--- 2026-07-09 03:00:06+00:00| seen| https://t.me/brutsecurity/2141 2026-07-10 00:00:14+00:00| seen| https://t.me/brutsecurity/2141 2026-07-11 12:00:04+00:00| published-proof-of-concept| https://t.me/brutsecurity/2141 2026-07-12 00:00:50+00:00|...

CVE-2026-54780

creationtimestamp| type| source ---|---|--- 2026-07-09 01:44:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6j4hinzz2z...

CVE-2026-54775

creationtimestamp| type| source ---|---|--- 2026-07-09 01:30:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6icp4g3g27...

CVE-2026-54779

creationtimestamp| type| source ---|---|--- 2026-07-09 01:27:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6i5snv3v27...

CVE-2026-54784

creationtimestamp| type| source ---|---|--- 2026-07-09 01:22:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6hv3t6nv2i...

CVE-2017-10678

creationtimestamp| type| source ---|---|--- 2026-07-09 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq6fdh2sxx2f...

CVE-2026-15133

creationtimestamp| type| source ---|---|--- 2026-07-09 00:34:15+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116887208284085207 2026-07-09 01:25:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6hzaaw4x27 2026-07-09 04:46:08+00:00| seen|...

CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...