GHSA-5W46-G9PQ-WH6F

creationtimestamp| type| source ---|---|--- 2026-06-24 07:42:24+00:00| seen| https://gist.github.com/alon710/0cc6180222e375f03b77f1081a3811f5...

CVE-2026-11370

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...

CVE-2026-9175

creationtimestamp| type| source ---|---|--- 2026-06-24 07:16:19+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mozenibsvo2s...

GHSA-3FC8-8HP6-6JR4

creationtimestamp| type| source ---|---|--- 2026-06-24 07:11:47+00:00| seen| https://gist.github.com/alon710/ef60a8d2e003433e0632a30f0def6b96...

CVE-2022-28206

creationtimestamp| type| source ---|---|--- 2026-06-24 07:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moze4zc3pd2n...

CVE-2026-7761

CVE-2026-7761 affects the WordPress plugin Ultimate Member up to version 2.11.4. The description in connected sources details a chain of three logic flaws causing account takeover via password reset URL disclosure: (1) an MD5 hash fallback in get_directory_by_hash() allows routing to a crafted po...

CVE-2026-7761 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

EUVD-2026-38714

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

CVE-2026-7761

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

CVE-2026-12485

creationtimestamp| type| source ---|---|--- 2026-06-24 06:45:28+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mozcwcekfw25 2026-07-16 19:00:28+00:00| seen| Telegram/v6zEHK1Gj8NlOFeo8YsfoG14SZcYTyMq60BoqtegyteCqb8 2026-07-17 01:00:26+00:00| seen|...

CVE-2022-28205

creationtimestamp| type| source ---|---|--- 2026-06-24 06:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mozchexunc2k...

EUVD-2026-38660

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...

CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...

GHSA-44WP-G8F4-F4V5

creationtimestamp| type| source ---|---|--- 2026-06-24 04:42:12+00:00| seen| https://gist.github.com/alon710/f3efb3a6eb14f85378da7277ba2da374...

GHSA-6F75-X745-XCPR

creationtimestamp| type| source ---|---|--- 2026-06-24 02:11:40+00:00| seen| https://gist.github.com/alon710/3da2d0271b4ce13266c6eb8e48512bfd 2026-06-24 02:22:36+00:00| seen| https://gist.github.com/alon710/e0c0df432c86420f7e6e4e56d0b5a192...

CVE-2026-56116

A flaw was found in dhcpcd. An unauthenticated attacker on the same network link can exploit a memory leak vulnerability in the IPv6 Router Advertisement route information handling. By repeatedly sending specially crafted Router Advertisements with a zero lifetime, the attacker can cause the syst...

CVE-2026-54515

creationtimestamp| type| source ---|---|--- 2026-06-24 00:39:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyoilsxlk2y 2026-06-29 13:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgnhh3jnf2d...

CVE-2026-54514

creationtimestamp| type| source ---|---|--- 2026-06-24 00:24:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moynnqc2bg23...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...

PT-2026-51936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fwctl component where incorrect class initialization ordering can lead to a NULL pointer dereference during device removal. Because CXL is linked before fwctl in t...