49699 matches found
PT-2026-61820
Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B1 versions prior to 5.17ABPC.7.2C0 Description A post-authentication command injection issue exists within the syslog component. An authenticated attacker with administrator privileges can execute arbitrary operating system...
CVE-2026-47413: Improper Privilege Management
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...
CVE-2026-43947: Incorrect Authorization
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...
MAL-2026-10990 Malicious code in ts-vitest (npm)
ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...
📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection
WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...
PT-2026-63303
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...
PT-2026-65345
Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...
📄 WordPress LeadConnector 1.7 Unauthenticated Arbitrary Post Deletion
WordPress LeadConnector plugin version 1.7 contains an unauthenticated arbitrary post deletion vulnerability. A remote attacker can delete arbitrary WordPress posts without authorization. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin...
CVE-2026-57495
creationtimestamp| type| source ---|---|--- 2026-07-20 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4icrfnis2e...
CVE-2026-53591
creationtimestamp| type| source ---|---|--- 2026-07-20 23:01:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4flzpkiu2m...
CVE-2026-64624
creationtimestamp| type| source ---|---|--- 2026-07-20 23:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fjxsamp2e 2026-07-21 00:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4j5mytxx2e...
CVE-2026-64650
creationtimestamp| type| source ---|---|--- 2026-07-20 22:55:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4fbegvcg23...
CVE-2026-53596
creationtimestamp| type| source ---|---|--- 2026-07-20 22:11:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4crfy6v32i...
CVE-2026-44583
creationtimestamp| type| source ---|---|--- 2026-07-20 21:57:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bzhro4d2i...
EUVD-2026-42313
Socket.IO: Engine.IO Polling Transport Connection Exhaustion...
CVE-2026-56624
creationtimestamp| type| source ---|---|--- 2026-07-20 21:30:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr4ai3v7co2r 2026-07-20 22:26:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4dmuhdiz24...
GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...