GHSA-FF9R-WW9C-43X8 Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

Impact Stored XSS vulnerability in content titles allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This...

CVE-2026-2360

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is...

CVE-2026-2360 Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is...

CVE-2026-2360

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is...

CVE-2026-2360 Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is...

CVE-2026-25769

creationtimestamp| type| source ---|---|--- 2026-02-11 17:00:00+00:00| published-proof-of-concept| https://github.com/hakaioffsec/CVE-2026-25769/blob/main/exploit/poc.py 2026-02-11 17:00:00+00:00| confirmed|...

CVE-2026-26190

creationtimestamp| type| source ---|---|--- 2026-02-11 11:40:49+00:00| published-proof-of-concept| https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6 2026-02-13 19:22:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mera57cpvr2m 2026-02-14...

CVE-2026-21335

creationtimestamp| type| source ---|---|--- 2026-02-11 10:17:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3melaqqrxq32h...

CVE-2026-21351

creationtimestamp| type| source ---|---|--- 2026-02-11 10:01:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mel7txnvnc25...

CVE-2025-13650 REFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB

An attacker with access to the web application ZeusWeb of the provider Microcom in this case, registration is not necessary, but the action must be performed who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Surname’ parameter of the ‘Creat...

CVE-2026-1560

creationtimestamp| type| source ---|---|--- 2026-02-11 09:00:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mel4hgvx7e2a 2026-02-11 09:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/116051177122807179 2026-02-11 09:59:59+00:00| seen|...

CVE-2026-21353

creationtimestamp| type| source ---|---|--- 2026-02-11 07:27:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mekxb7dvga2x 2026-06-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260602 2026-06-02 20:00:00+00:00| seen|...

CVE-2025-70045

creationtimestamp| type| source ---|---|--- 2026-02-11 02:54:39+00:00| seen| https://gist.github.com/zcxlighthouse/bd5852a409c97438016f2c476f8461d9 2026-02-23 23:13:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mfkrozwk2k2l...

CVE-2025-70083

creationtimestamp| type| source ---|---|--- 2026-02-11 01:53:01+00:00| seen| https://gist.github.com/jonafk555/fd01bc033764e373d15fefc4bc818687...

PT-2026-7509

An attacker with access to the web application ZeusWeb of the provider Microcom in this case, registration is not necessary, but the action must be performed who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Surname’ parameter of the ‘Creat...

CVE-2026-25759: Improper Neutralization of Input During Web Page Generation

Statmatic is a Laravel and Git powered content management system CMS. From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Maliciou...

CVE-2019-25313: Cross-Site Request Forgery (CSRF)

FlexNet Publisher 11.12.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious HTML form to trick authenticated users into submitting a request that creates a new local admin accoun...

📄 Qualys Security Advisory - Exim 21Nails Advisory

Qualys audited central parts of the Exim mail server and discovered 21 vulnerabilities, with 11 being local vulnerabilities and 10 being remote vulnerabilities. This is older research from 2021 that was missing from the archive. Qualys Security Advisory 21Nails: Multiple vulnerabilities in Exim...

Microcom ZeusWeb 安全漏洞

Microcom ZeusWeb is a remote monitoring platform developed by the Spanish company Microcom. Version 6.1.31 of Microcom ZeusWeb contains a security vulnerability. This vulnerability stems from the injection of XSS payloads into the Surname parameter during the Create Account operation, which may...

PT-2026-7633

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.0.1 Description The software contains a flaw that could allow a user to obtain superuser privileges. This is achieved by creating a custom operator within the public schema and embedding malicious code...