CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-62996

creationtimestamp| type| source ---|---|--- 2026-08-07 16:35:38+00:00| published-proof-of-concept| https://github.com/smarty-php/smarty/security/advisories/GHSA-rjhh-76wf-8xmw...

UBUNTU-CVE-2026-62992

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...

CVE-2026-28145

creationtimestamp| type| source ---|---|--- 2026-08-07 16:15:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msixbjsnbw2i...

CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...

CVE-2026-48093

CVE-2026-48093 affects the Code Embed WordPress plugin (pre-2.6.1). The vulnerability is a stored XSS in the external URL embed feature used in post content: the code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without ou...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the Security::checkDir process. An attacker can access arbitrary files outside of trusted directories by creating a symbolic link within a trusted directory and causing a template to reference th...

GHSA-JFM3-95JQ-Q3RF

creationtimestamp| type| source ---|---|--- 2026-08-07 14:32:36+00:00| seen| https://gist.github.com/alon710/083e0c15dfeb9a6ae7deb8244b73b528...

CVE-2026-68742

creationtimestamp| type| source ---|---|--- 2026-08-07 14:05:27+00:00| published-proof-of-concept| https://t.me/bdufstecru/3369 2026-08-08 00:06:20+00:00| published-proof-of-concept| https://t.me/bdufstecru/3369...

GHSA-MH25-X5HQ-WRQP

creationtimestamp| type| source ---|---|--- 2026-08-07 13:34:35+00:00| seen| https://gist.github.com/alon710/09e2e2055df2711d8dcc906978bf0f47...

CVE-2026-48094

CVE-2026-48094 affects the ShareOpenly WordPress plugin (prior to 1.2.1). The issue is a Cross-Site Scripting (XSS) vulnerability caused by omitting WordPress esc_url() when rendering a URL into an HTML href. The vulnerable code builds the URL from home_url( add_query_arg( array(), $wp->reques...

CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

GHSA-265M-7826-WJQM

creationtimestamp| type| source ---|---|--- 2026-08-07 11:31:42+00:00| seen| https://gist.github.com/alon710/28df1596668f7d78b0163ad585068607...

CVE-2013-3821

creationtimestamp| type| source ---|---|--- 2026-08-07 11:00:20+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b5eb8264-164c-4d3e-b562-e6bfed5d81bd...

CVE-2026-54199

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-9169

creationtimestamp| type| source ---|---|--- 2026-08-07 10:06:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/b27ssjpfbtrcr...

CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

The vulnerability CVE-2026-54205 affects Tobit Laboratories AG TeamDavid’s Webbox link-storing functionality. The server-side code accepts a pathname parameter that can be a UNC network location (e.g., \Server\Share) without validation, causing outbound connections to attacker-controlled SMB endp...

EUVD-2026-54447

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...