CVE-2026-9619

CVE-2026-9619 affects the Reviews and Rating – Docplanner WordPress plugin, vulnerable in all versions up to 1.1.4 due to insufficient authorization checks for an action (sync_reviews AJAX). This allows authenticated users with subscriber-level access and above to trigger outbound scraping, write...

PT-2026-52030

Warp is an agentic development environment. From 0.2024.02.20.08.01.stable 01 until 0.2026.05.06.15.42.stable 01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the...

PT-2026-51760

Server-Side Request Forgery SSRF CWE-918 in the PDF generation endpoint GET /api/reports/id/pdf backend/main.py in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the...

CVE-2026-48731: Improper Neutralization of Special Elements used in an OS Command

Warp is an agentic development environment. From 0.2024.02.20.08.01.stable01 until 0.2026.05.06.15.42.stable01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the expand...

Adobe ColdFusion < 2023.x < 2023u20 / 2025.x < 2025u9 Multiple Vulnerabilities (APSB26-64)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 20 or 2025.x update 9. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-64 advisory. - Improper Input Validation potentially leading to Arbitrary code execution...

CVE-2026-57296: Improper Limitation of a Pathname to a Restricted Directory

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can...

PT-2026-52068

Name of the Vulnerable Software and Affected Versions Ghost versions 6.0.9 through 6.21.0 Description Ghost is a Node.js content management system. An issue exists where the IP filter designed to prevent external requests from reaching internal services can be bypassed. This is achieved by using ...

Cisco Finesse File Path Execution

The vulnerability of the Cisco Finesse operator automation software lies in improper external control of file names or file paths. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or gain unauthorized access to protected information...

Pentaho Data Integration XXE

The vulnerability of the programming tool for data integration and analysis in Hitachi Vantara Pentaho Data Integration & Analytics relates to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

PT-2026-51806

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can...

PT-2026-51813

Name of the Vulnerable Software and Affected Versions Jenkins Assembla Plugin versions prior to 1.5 Description The XML parser is not configured to prevent XML external entity XXE attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets...

XXE vulnerability in assembla

assembla 1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when parsing responses from the configured Assembla server. This allows attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or...

Path traversal vulnerability in external-workspace-manager

external-workspace-manager 1.3.2 and earlier does not reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the resulting workspace path to escape the configured disk mount point. This allows attackers with Item/Configure permission...

CVE-2026-12488

creationtimestamp| type| source ---|---|--- 2026-06-23 21:00:08+00:00| seen| https://infosec.place/objects/7f6c82b9-c033-48e7-9877-68f6450948a2...

Malicious code in wagmi_util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44ca5f8da70044150618d34a591d8a6d72aa77a5e22eb30da3e86f4b74c76ef Package wagmiutil impersonates the popular wagmi package: it copies wagmi's tagline "React Hooks for Ethereum", re-exports wagmi's full React-hooks...

MAL-2026-6347 Malicious code in wagmi_util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44ca5f8da70044150618d34a591d8a6d72aa77a5e22eb30da3e86f4b74c76ef Package wagmiutil impersonates the popular wagmi package: it copies wagmi's tagline "React Hooks for Ethereum", re-exports wagmi's full React-hooks...

DEBIAN-CVE-2026-50574

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format such as an HLS/DASH stream, yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On...

CVE-2026-50574

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format such as an HLS/DASH stream, yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On...

CVE-2026-50019

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file downloa...

CVE-2026-45732

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate ...