CVE-2026-65896: External Control of File Name or Path

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...

CVE-2026-14481: Improper Neutralization of Input During Web Page Generation

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-9577: Improper Neutralization of Input During Web Page Generation

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

PT-2026-63907

Unauthenticated Broken Access Control in Event post = 6.0.1 versions...

CVE-2026-60372

creationtimestamp| type| source ---|---|--- 2026-07-22 23:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrbiodo4x62j 2026-07-23 00:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbjunxony2e 2026-07-23 01:20:25+00:00| seen|...

CVE-2026-60369

creationtimestamp| type| source ---|---|--- 2026-07-22 23:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrbiksnd2z2i 2026-07-23 00:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbjsv4isa2e 2026-07-23 01:10:24+00:00| seen|...

CVE-2026-60366

creationtimestamp| type| source ---|---|--- 2026-07-22 23:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrbih7zxst2q 2026-07-23 00:45:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbme6owj322 2026-07-23 01:00:55+00:00| seen|...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending...

CVE-2026-16629

creationtimestamp| type| source ---|---|--- 2026-07-22 23:04:25+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrbgolijbe2c...

CVE-2026-63684

creationtimestamp| type| source ---|---|--- 2026-07-22 22:50:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbfvljljw2i...

CVE-2026-63685

creationtimestamp| type| source ---|---|--- 2026-07-22 22:40:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbfdnvrpm2a...

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...

CVE-2026-64798

creationtimestamp| type| source ---|---|--- 2026-07-22 22:25:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbeiry47627...

CVE-2026-64797

creationtimestamp| type| source ---|---|--- 2026-07-22 22:21:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbeb2p2lt2o...

CVE-2026-63683

creationtimestamp| type| source ---|---|--- 2026-07-22 22:13:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbdueogpd2i...

CVE-2026-63281

creationtimestamp| type| source ---|---|--- 2026-07-22 22:10:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbdoyoply27...

CVE-2025-50327

creationtimestamp| type| source ---|---|--- 2026-07-22 21:53:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbcqjj6fp2i...

CVE-2025-50330

creationtimestamp| type| source ---|---|--- 2026-07-22 21:52:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbcnorrdo24...

emp3r0r v4.6.1

emp3r0r Self‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents. What is emp3r0r? emp3r0r is an advanced, zero-trust post-exploitation framework and command & control C2 system designed for Linux and Windows target environments. Built from the...

CVE-2026-13078

creationtimestamp| type| source ---|---|--- 2026-07-22 21:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrb7qtya562a 2026-07-24 04:46:05+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...