CVE-2026-8825 Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, privat...

CVE-2026-12606

creationtimestamp| type| source ---|---|--- 2026-07-20 05:19:29+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr2kaioqa522...

CVE-2026-59674

creationtimestamp| type| source ---|---|--- 2026-07-20 04:41:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr2i3rtydj24...

CVE-2026-42566

creationtimestamp| type| source ---|---|--- 2026-07-20 01:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr23r6goaq2o 2026-07-20 01:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116949714689412114 2026-07-20 01:30:29+00:00| seen|...

CVE-2026-47276: NULL Pointer Dereference

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen is call...

CVE-2026-63429: Missing Authentication for Critical Function

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

Malicious code in akrai-report-new (npm)

The akrai-report-new package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

CVE-2026-35048: Improper Input Validation

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...

CVE-2026-58482: Cross-Site Request Forgery (CSRF)

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...

PT-2026-61740

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote...

CVE-2026-64169

creationtimestamp| type| source ---|---|--- 2026-07-19 18:08:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzeq25lom2e 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-64171

creationtimestamp| type| source ---|---|--- 2026-07-19 18:05:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzelkqwie23 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-64176

creationtimestamp| type| source ---|---|--- 2026-07-19 17:59:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqze7yij3u2j 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-64185

creationtimestamp| type| source ---|---|--- 2026-07-19 17:09:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqzbgngcud2e 2026-07-19 18:25:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzfooiglt23 2026-08-03 09:19:48+00:00| seen|...

CVE-2026-63828

creationtimestamp| type| source ---|---|--- 2026-07-19 16:45:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqza3tbw2h2q 2026-08-06 04:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-02 23:00:05+00:00|...

CVE-2026-63825

creationtimestamp| type| source ---|---|--- 2026-07-19 16:35:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz7jw45el2a 2026-07-19 19:39:22+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116948334138717850 2026-09-15 12:46:43+00:00| seen|...

CVE-2026-63833

creationtimestamp| type| source ---|---|--- 2026-07-19 16:20:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz6p2prrg2b 2026-07-20 18:42:55+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr3x55gnxp2l 2026-07-20 18:42:57+00:00| seen|...

CVE-2026-63819

creationtimestamp| type| source ---|---|--- 2026-07-19 15:58:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz5hrrrhl2e 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-63831

creationtimestamp| type| source ---|---|--- 2026-07-19 15:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz5dwlllj2s 2026-07-19 19:25:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116948280487732006 2026-07-20 06:00:26+00:00| seen|...

CVE-2026-63822

creationtimestamp| type| source ---|---|--- 2026-07-19 15:50:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz4zqhqnb2x 2026-08-06 04:47:10+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-15 12:46:43+00:00| seen...