CVE-2026-58246

creationtimestamp| type| source ---|---|--- 2026-07-28 11:57:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpe7pcpbp2q...

CVE-2026-14516

creationtimestamp| type| source ---|---|--- 2026-07-28 11:33:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpcvdklcz23...

WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting Detection

Wordpress Gwyn's Imagemap Selector plugin 0.3.3 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize the id and class parameters before returning them back in attributes. !/usr/bin/env python3 -- coding: utf-8 -- """Wordpress Gwyn's Imagemap Selector plugin 0.""...

BackupBuddy - Local File Inclusion Detection

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters. !/usr/bin/env python3 -- coding: utf-8 -- """BackupBuddy versions 8.""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Remita Merchant ID & API Key - Exposure Detection

Detected exposed Remita merchant IDs, API keys, and secret hashes in application source code, configuration files, or publicly accessible assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Remita merchant IDs, API keys, and secret hashes in application source code, configuratio...

WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in...

WordPress Page Builder KingComposer <=2.9.6 - Open Redirect Detection

WordPress Page Builder KingComposer 2.9.6 and prior does not validate the id parameter before redirecting the user to it via the kcgetthumbn AJAX action which is available to both unauthenticated and authenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Page Builder...

Php Debug Bar - Exposure Detection

The DebugBar integrates easily into projects and can display profiling data from any part of your application.This template detects exposed PHP Debug Bars by looking for known response bodies and the phpdebugbar-id in headers. !/usr/bin/env python3 -- coding: utf-8 -- """The DebugBar integrates...

ECTouch v2 - SQL Injection Detection

ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr'id' parameter at \default\helpers\insert.php. !/usr/bin/env python3 -- coding: utf-8 -- """ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr'id' parameter at /default/he.""" import re fro...

CVE-2026-10207

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

CVE-2026-64232

A flaw was found in the Linux kernel's block subsystem. The blkinsertclonedrequest function, used in stacked driver configurations, fails to correctly recompute the number of integrity segments. This oversight can lead to a system crash, resulting in a Denial of Service DoS for a local user...

SUSE-SU-2026:3336-1 Security update for ImageMagick

This update for ImageMagick fixes the following issue: - Extend CVE-2026-56379 patch by f63c78b bsc1268878...

CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait...

CVE-2026-10207

The CVE-2026-10207 issue affects the WordPress plugin PickPlugins Question Answer (WordPress) up to version 1.2.73 . The vulnerability is an SQL Injection caused by insufficient sanitization of the user-supplied input via the 'id' GET parameter in the user profile template, combined with wp_unsla...

CVE-2026-10207 PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

CVE-2026-10207

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

CVE-2026-10207 PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

CredSpy v1.1.0

CredSpy Enumerate Microsoft Entra ID authentication methods for email addresses using the public GetCredentialType API. This is the same endpoint the Microsoft login page uses when you enter a username. In contrast to most tools using the GetCredentialType method, CredSpy also shows the...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-14516

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...