CVE-2025-59109

The dormakaba registration units 9002 PIN Pad Units have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an...

CVE-2025-59090 Unauthenticated SOAP API in dormakaba Kaba exos 9300

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled...

EUVD-2025-206366

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled...

CVE-2026-23005

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATEBVi in guest XSAVE state whenever XFDi=1 When loading guest XSAVE state via KVMSETXSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled features in the saved or to be restored XSTATEBV...

CVE-2026-1421

creationtimestamp| type| source ---|---|--- 2026-01-26 09:22:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdcw7cfi5m2r...

Fedora 44 : retroarch (2026-5e8ffdd3b9)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e8ffdd3b9 advisory. Automatic update for retroarch-1.22.0-20.fc44. Changelog Mon Jan 26 2026 Artem Polishchuk - 1.22.0-20 - Disable 7zip support due CVE - rhbz2432835 Tenable ha...

GHSA-CH7P-MPV4-4VG4

creationtimestamp| type| source ---|---|--- 2026-01-24 21:26:48+00:00| seen| https://gist.github.com/alon710/8ba7ed49e46933dff872240af51e2b2d 2026-01-24 22:42:10+00:00| seen| https://gist.github.com/alon710/09b665ccbc9a4582770dd271d38993ea...

RHSA-2026:0383

creationtimestamp| type| source ---|---|--- 2026-01-24 21:25:55+00:00| seen| https://gist.github.com/alon710/d7f08bcd33b6c370d97dd604754351e7 2026-01-24 22:41:18+00:00| seen| https://gist.github.com/alon710/1ebd78b25a55363e86004a46cf589989...

EUVD-2026-4540

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction function in all versions up to, and including, 10.0.04. This makes it possible for authenticated attackers, with...

Exploit for CVE-2026-24061

No d...

EUVD-2026-4565

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without...

EUVD-2026-4548

The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mbgallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Author-level access and abov...

EUVD-2026-4549

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fields in all versions up to, and including, 20251210 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-4583

The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive...

EUVD-2026-4592

Not used...

CVE-2026-24411

creationtimestamp| type| source ---|---|--- 2026-01-24 03:34:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5bub7irk2g...

WordPress plugin “Set Bulk Post Categories” has a cross-site request forgeing vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

WordPress plugin ZT Captcha has a cross-site request forgeing vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress plugin Simple Crypto Shortcodes has a cross-site request forgeing vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

EUVD-2026-4290

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the changeparams.php script. Attackers can inject malicious JavaScript payloads that execute when users interact with the address text box, potentially enabling client-side script execution...