CVE-2026-9732 EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update

The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the formsettingsui settings save handler, procedural include scope functio...

CVE-2026-8726

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin ...

CVE-2026-42342

creationtimestamp| type| source ---|---|--- 2026-06-02 21:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mndiistrbd2h 2026-06-03 21:41:07+00:00| seen| https://gist.github.com/alon710/7cf799e784cb7e5d54b5d97af1f62323...

CVE-2026-0611

creationtimestamp| type| source ---|---|--- 2026-06-02 18:01:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnd6gyxgaw2d 2026-06-02 19:19:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mndcspr76u27 2026-06-03 05:02:32+00:00| seen|...

CVE-2026-7312

creationtimestamp| type| source ---|---|--- 2026-06-02 18:01:35+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnd6h2hiip2w 2026-06-03 02:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mndz7plsio22 2026-06-04 14:37:07+00:00| seen|...

CVE-2026-24221

creationtimestamp| type| source ---|---|--- 2026-06-02 18:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnd6febj5d2q...

CVE-2026-48861

creationtimestamp| type| source ---|---|--- 2026-06-02 16:59:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnd2xy373n2o 2026-07-10 00:35:21+00:00| published-proof-of-concept| https://github.com/elixir-mint/mint/security/advisories/GHSA-2pg6-44cx-c49v 2026-07-10 04:12:07+00:00|...

CVE-2026-42685

creationtimestamp| type| source ---|---|--- 2026-06-02 13:22:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncotwrjow2j...

CVE-2026-9730

creationtimestamp| type| source ---|---|--- 2026-06-02 09:38:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncccz3fz32j 2026-06-03 09:15:21+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mneriy7rga2c...

CVE-2026-4071

creationtimestamp| type| source ---|---|--- 2026-06-02 09:25:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncblnna7424...

CVE-2025-5085

creationtimestamp| type| source ---|---|--- 2026-06-02 09:07:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncahxfd6b2w 2026-06-03 07:15:25+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mneksk7tcn2t...

CVE-2026-10567

creationtimestamp| type| source ---|---|--- 2026-06-02 05:39:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnbuyl7os72v...

CVE-2026-10566

creationtimestamp| type| source ---|---|--- 2026-06-02 05:36:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnbupmoxoy2b...

PT-2026-48942

A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Kirill...

CVE-2025-60495

creationtimestamp| type| source ---|---|--- 2026-06-01 22:52:24+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnb6a5sfpy2a...

CVE-2026-49433

The DeepAI endpoint 'https://api.deepai.org/changeuseremail' accepts POST requests without any CSRF protection. If an attacker can trick a logged-in user into clicking a malicious link, the attacker can change the user's email address and take over their account. Fixed on 2026-05-20...

CVE-2026-45729

creationtimestamp| type| source ---|---|--- 2026-06-01 20:44:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnax3vobbu2z 2026-07-22 17:00:04+00:00| seen| Telegram/tTAffE3ecNhvRTBphw7K5bpufit0HCKjFX6WbbNQmiqRs00 2026-07-23 00:00:10+00:00| published-proof-of-concept|...

CVE-2026-45544

creationtimestamp| type| source ---|---|--- 2026-06-01 20:42:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnawwz7jj32h...

CVE-2026-8206

creationtimestamp| type| source ---|---|--- 2026-06-01 20:00:04+00:00| seen| https://t.me/GithubRedTeam/86883 2026-06-01 23:00:14+00:00| seen| Telegram/WmCsGmCxw3llm8l2PpPL4TbSd7NmUffJbXR2OZgq87qhTE 2026-06-02 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnbr4mqu6h2j...

CVE-2026-49433 DeepAI api.deepai.org/change_user_email CSRF

The DeepAI endpoint 'https://api.deepai.org/changeuseremail' accepts POST requests without any CSRF protection. If an attacker can trick a logged-in user into clicking a malicious link, the attacker can change the user's email address and take over their account. Fixed on 2026-05-20...