CVE-2026-63222

creationtimestamp| type| source ---|---|--- 2026-07-31 11:00:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrwsfzyslz2z 2026-08-08 04:36:33+00:00| seen| https://gist.github.com/alon710/42c040ec6976f6b1c65452acd65815a5...

CVE-2026-11770

creationtimestamp| type| source ---|---|--- 2026-07-31 10:14:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4264s2zafk3mq 2026-07-31 12:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrwvrz7cro2l...

WordPress Meta Box AIO plugin <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Austin Ginder in WordPress Plugin Meta Box AIO versions = 3.8.0...

CVE-2026-18214

creationtimestamp| type| source ---|---|--- 2026-07-31 08:17:11+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrwjcekyhw2z...

CVE-2026-51275

creationtimestamp| type| source ---|---|--- 2026-07-31 08:03:05+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrwij65sge2l...

CVE-2026-14483

creationtimestamp| type| source ---|---|--- 2026-07-31 07:18:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwfyokgir24 2026-07-31 08:01:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gjlyfysyioviq 2026-08-01 21:00:04+00:00| seen|...

CVE-2026-12251

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a...

CVE-2026-65616

creationtimestamp| type| source ---|---|--- 2026-07-31 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrwdpgbz3b2c 2026-09-13 14:00:11+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102203 2026-09-14 00:00:13+00:00| published-proof-of-concept|...

CVE-2026-14845 NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users...

CVE-2026-14845

The NewStatPress WordPress plugin, specifically versions before 1.4.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape data received from unauthenticated visitor requests before it is stored and subsequently displayed within one of...

CVE-2026-51371

creationtimestamp| type| source ---|---|--- 2026-07-31 05:02:47+00:00| seen| https://bsky.app/profile/hermes71.bsky.social/post/3mrw6gqxai42n 2026-08-01 04:58:43+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mryoodbpnu2r...

CVE-2026-56673

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folderpaths.getannotatedfilepath and existsannotatedfilepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated craft...

CVE-2026-57669

creationtimestamp| type| source ---|---|--- 2026-07-31 04:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrw5fetvn42q...

CVE-2026-6889

creationtimestamp| type| source ---|---|--- 2026-07-31 04:06:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/33eyaxae7jcoj...

CVE-2026-65423

creationtimestamp| type| source ---|---|--- 2026-07-31 04:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrw2yalby42q 2026-07-31 12:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwy7ln6sl2s 2026-07-31 12:46:04+00:00| seen|...

SUSE CVE-2025-55073

Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11, 10.12.x = 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL...

CVE-2026-66420

creationtimestamp| type| source ---|---|--- 2026-07-31 01:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvqvtqxt22a 2026-07-31 12:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwy427mt52i...

SUSE CVE-2026-3637

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...

SUSE CVE-2026-4053

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints...

SUSE CVE-2026-5163

Mattermost versions 11.5.x = 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite...