CVE-2026-56765

creationtimestamp| type| source ---|---|--- 2026-07-10 16:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcltiwe322h 2026-07-12 07:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7kzfna2w...

CVE-2026-56261

creationtimestamp| type| source ---|---|--- 2026-07-10 16:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqclthdrpr2f 2026-07-12 07:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7rjqh62r 2026-07-14 03:07:06+00:00| seen|...

CVE-2026-61456

creationtimestamp| type| source ---|---|--- 2026-07-10 16:37:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqclhnwrcu2e 2026-07-10 20:20:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxwefthh2a 2026-07-10 22:19:19+00:00| seen|...

EUVD-2026-42950

grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST...

CVE-2026-59190 Grav Admin Plugin — IDOR Privilege Escalation via saveUser()

grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST...

CVE-2026-1667 SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-1667

The CVE concerns the SEO Plugin by Squirrly SEO for WordPress (up to version 14.0.0) with a vulnerability in savePost() that allows unauthenticated users to create arbitrary posts and, if Advanced Custom Fields is installed, to inject stored XSS scripts. Root cause is a leak of an API token and i...

CVE-2026-1667 SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-61444

creationtimestamp| type| source ---|---|--- 2026-07-10 16:15:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqck7yabkh27 2026-07-10 16:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqclwzjjnb2f 2026-07-10 20:16:31+00:00| seen|...

CVE-2026-61434

creationtimestamp| type| source ---|---|--- 2026-07-10 16:10:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcjxeiech2k 2026-07-10 20:19:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxuudb3h2a 2026-07-10 23:30:34+00:00| seen|...

CVE-2026-61455

creationtimestamp| type| source ---|---|--- 2026-07-10 16:04:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcjml5p5g2q 2026-07-10 20:20:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxvm3lsn26 2026-07-10 20:20:06+00:00| seen|...

MAL-2026-10128 Malicious code in ohcm-culture-formatting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5679f4434881406ce5af055e04a3ab7403158df3404c928a7fbc67596d0e9631 [email protected] declares a preinstall hook "preinstall": "node index.js" that auto-executes on npm install. index.js uses...

CVE-2026-59792

creationtimestamp| type| source ---|---|--- 2026-07-10 15:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcgw3rsma2f 2026-07-10 20:17:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxqwt2442e 2026-07-11 00:32:28+00:00| seen|...

CVE-2026-54149 MaxKB MCP tool import validation bypass allows post-authentication remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chatpipeline/step/chatstep/impl/basechatstep.py do not consistently validate MCP transport type, allowing an...

CVE-2026-57228

creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25 2026-09-18 23:03:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvtbnrwv222v 2026-09-25 08:40:04+00:00| seen|...

CVE-2026-61456

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile method validates only the file extension and never invokes Security::sanitizeSVG, so an authenticated attacker with t...

CVE-2026-50178

creationtimestamp| type| source ---|---|--- 2026-07-10 12:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc5ztca3w25...

CVE-2026-41877

creationtimestamp| type| source ---|---|--- 2026-07-10 12:19:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc4zrjog72z 2026-07-10 14:17:53+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcdnxnpgv26 2026-07-10 14:21:14+00:00| seen|...

CVE-2026-40005

creationtimestamp| type| source ---|---|--- 2026-07-10 12:15:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40005 2026-07-10 13:12:36+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqc7zcfut62u 2026-07-10 17:46:05+00:00| seen|...

CVE-2026-15026

creationtimestamp| type| source ---|---|--- 2026-07-10 12:12:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4nfrcot2a 2026-07-10 21:07:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2ki4go22e...