58187 matches found
CVE-2026-10660
creationtimestamp| type| source ---|---|--- 2026-07-11 17:28:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqf6sm6c6o2f 2026-07-11 19:32:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqffoyschb2q...
CVE-2026-61454
creationtimestamp| type| source ---|---|--- 2026-07-11 14:33:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqeuzo3gme2w 2026-07-11 16:07:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqf2azlsnp27 2026-07-13 17:32:26+00:00| seen|...
MINI-5J32-2P4J-JR97
Bulletin has no description...
MINI-5655-CVJJ-8C2M
Bulletin has no description...
MINI-R2PR-2F8F-HFMH
Bulletin has no description...
MINI-VX7X-XFMW-37X7
Bulletin has no description...
CVE-2026-56296
Cap-go before 12.128.2 has an information disclosure flaw in the public.transfer_app RPC that returns distinct error messages for existing versus non-existing app IDs. This enables unauthenticated attackers to enumerate valid app IDs by observing error message differences when calling transfer_ap...
CVE-2026-29007
creationtimestamp| type| source ---|---|--- 2026-07-11 12:01:55+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqemjtarja2n...
MINI-FGWQ-8X22-F9F8
Bulletin has no description...
MINI-H328-3RPF-5237
Bulletin has no description...
CVE-2026-15010
creationtimestamp| type| source ---|---|--- 2026-07-11 07:37:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5qoz5cx22 2026-07-11 07:37:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqe5qog3a22o 2026-07-11 08:07:12+00:00| seen|...
CVE-2025-5017
The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
CVE-2026-11901
The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the webhookprocesspaypalstandard IPN handler selecting its PayPal validation endpoint from the attacker-controlled $REQUEST'testipn...
Server-Side Request Forgery (SSRF)
@better-auth/sso is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is enabled, which allows an authenticated attacker to persist...
GHSA-GCM7-57GF-953C
creationtimestamp| type| source ---|---|--- 2026-07-11 04:41:43+00:00| seen| https://gist.github.com/alon710/5b22d6c437eabc82b89ba6fa8ccee27d...
CVE-2026-13116
CVE-2026-13116 affects the PDF Invoices & Packing Slips for WooCommerce plugin (WordPress) ≤ 5.14.0. Issue: Insecure Direct Object Reference via generate_document_shortcode caused by missing validation on a user-controlled key. Consequence: authenticated attackers with contributor+ access can min...
CVE-2026-3367 Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...
EUVD-2026-43124
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...