58198 matches found
CVE-2026-24698
creationtimestamp| type| source ---|---|--- 2026-07-08 15:20:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116885031205203938 2026-07-08 18:07:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pkgwrsc26...
GHSA-W54J-7WPM-CRHJ
creationtimestamp| type| source ---|---|--- 2026-07-08 14:44:37+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mq5e7yeusk2s...
CVE-2026-56401
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-42277
In Adalo’s no-code app builder, Versions 1 and 2 the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing...
CVE-2026-10706
In Adalo’s no-code app builder, Versions 1 and 2 the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing...
CVE-2026-56401
...
CVE-2026-56401 Wazuh - NULL Pointer Dereference in inventory_sync DataValue FlatBuffer Handling
Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventorysync FlatBuffer DataValue handling. An enrolled agent can send a verifier-valid DataValue message omitting the optional id field, causing wazuh-modulesd to crash when dereferencing...
CVE-2026-56217
Capgo versions before 12.128.2 contain a policy bypass vulnerability in app_versions update enforcement that lets app-scoped API keys downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions table via PostgREST to clear sessio...
MINI-445G-6XGH-8GGP
Bulletin has no description...
CVE-2026-5459
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the paymentpage function due to missing validation on the 'userid' user...
CVE-2026-6818
creationtimestamp| type| source ---|---|--- 2026-07-08 13:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq57bpuwyo2p...
CVE-2026-5459
The CVE-2026-5459 entry concerns the WordPress plugin “User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration” up to version 4.3.1. The vulnerability is an Insecure Direct Object Reference in the payment_page() function caused by missing validation on ...
CVE-2026-5459
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the paymentpage function due to missing validation on the 'userid' user...
CVE-2026-5356 LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it...
CVE-2026-15041
creationtimestamp| type| source ---|---|--- 2026-07-08 12:26:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq54jpsmpb27...
CVE-2026-57259
creationtimestamp| type| source ---|---|--- 2026-07-08 12:02:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq536mna3c26...
BIT-PYTHON-MIN-2026-4360 Tarfile.extract() doesn't fully respect filter parameter
In the Tarfile.extract function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract function...
BIT-LIBPYTHON-2026-4360 Tarfile.extract() doesn't fully respect filter parameter
In the Tarfile.extract function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract function...