CVE-2026-53742 Simple Link Directory through 9.0.4 Stored XSS via Embed Shortcode Attributes

Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser...

CVE-2026-53741

CVE-2026-53741 affects Simple Link Directory up to version 9.0.4. The root cause is that the sld_no_results_found option is interpolated into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload can break out of the string and execute sc...

CVE-2026-53741 Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option

Simple Link Directory through 9.0.4 interpolates the sldnoresultsfound option into a JavaScript string literal without encoding. Because sanitizetextfield leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor...

CVE-2026-53741 Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option

Simple Link Directory through 9.0.4 interpolates the sldnoresultsfound option into a JavaScript string literal without encoding. Because sanitizetextfield leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor...

CVE-2026-53736 Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicatepost action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type...

PDM wheel installation leads to Path Traversal via overridden write_to_fs

InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe pathwithdestdir which validates via Path.resolve + isrelativeto with a bare os.path.join that performs no path validation. A malicious wheel with travers...

dotnet: .NET: Local file tampering via link following vulnerability

A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issu...

dotnet: .NET: Local file tampering via link following vulnerability

A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issu...

CVE-2026-20251

creationtimestamp| type| source ---|---|--- 2026-06-10 20:23:27+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnxk446ell2m 2026-06-11 00:32:43+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-splunk-3 2026-06-15 01:27:12+00:00| seen|...

CVE-2026-47939

creationtimestamp| type| source ---|---|--- 2026-06-10 20:06:05+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mnxj4zowxe2u...

CVE-2026-9151

creationtimestamp| type| source ---|---|--- 2026-06-10 20:02:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxivyjrix26...

CVE-2026-50569

creationtimestamp| type| source ---|---|--- 2026-06-10 19:52:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxie2wmbr24...

CVE-2026-50570

creationtimestamp| type| source ---|---|--- 2026-06-10 19:47:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxi34cuoo2h...

CVE-2026-46529

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside...

CVE-2026-46614

creationtimestamp| type| source ---|---|--- 2026-06-10 19:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxhs5smf72i...

CVE-2026-50568

creationtimestamp| type| source ---|---|--- 2026-06-10 19:37:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxhj5i6c42i...

CVE-2026-50638

creationtimestamp| type| source ---|---|--- 2026-06-10 19:23:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnxgqgtcdm22...

CVE-2026-46612

creationtimestamp| type| source ---|---|--- 2026-06-10 19:17:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxgfz4oop24...

CVE-2026-49822

creationtimestamp| type| source ---|---|--- 2026-06-10 19:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxgbtrwgb2e...

CVE-2026-0270

creationtimestamp| type| source ---|---|--- 2026-06-10 19:03:20+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mnxfmtixdo25 2026-06-10 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1917...