CVE-2026-59097: Missing Authorization

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary...

Malicious code in @marketfront/bannerpopup (npm)

The @marketfront/bannerpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

PT-2026-54910

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image Backup::remove function where backup file paths stored in post meta are used directly in file deletion operations witho...

PT-2026-54948

Name of the Vulnerable Software and Affected Versions PIA affected versions not specified Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a...

PT-2026-54939

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get single symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata an...

PT-2026-54640

Name of the Vulnerable Software and Affected Versions Request a Quote versions prior to 2.5.6 Description The Request a Quote plugin for WordPress allows unauthenticated attackers to perform code injection. The issue occurs because the emd delete file function derives a PHP function name from the...

PT-2026-54614

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-14336: Server-Side Request Forgery (SSRF)

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

CVE-2026-55791

creationtimestamp| type| source ---|---|--- 2026-07-01 23:58:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpvmvzr52u 2026-07-02 16:32:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpohhzys7f2w...

CVE-2026-14390

creationtimestamp| type| source ---|---|--- 2026-07-01 23:54:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpphwqn62e 2026-07-02 07:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116849208764595962 2026-07-02 07:30:31+00:00| seen|...

CVE-2026-14424

creationtimestamp| type| source ---|---|--- 2026-07-01 23:51:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpjx4mny2v 2026-07-02 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116848500782460057 2026-07-02 04:30:28+00:00| seen|...

CVE-2026-14067

creationtimestamp| type| source ---|---|--- 2026-07-01 23:41:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmoyeg24d2d 2026-07-02 03:40:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn4d3bn6e2t 2026-07-02 07:51:16+00:00| seen|...

CVE-2026-50279 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Craft CMS is a content management system CMS. IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author...

penetration-testing-labs-htu

Penetration Testing Labs – HTU Hands-on penetration testing p...

CVE-2026-53352

creationtimestamp| type| source ---|---|--- 2026-07-01 22:47:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlxnkdke2y 2026-07-06 06:53:18+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-09-15 12:46:43+00:00|...

CVE-2026-53349

creationtimestamp| type| source ---|---|--- 2026-07-01 22:47:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlwvpaaw2r 2026-07-06 06:53:14+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-09-15 12:46:43+00:00|...

CVE-2026-53350

creationtimestamp| type| source ---|---|--- 2026-07-01 22:46:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlvbdcrx2y 2026-07-06 06:53:16+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-09-15 12:46:43+00:00|...

CVE-2026-53353

creationtimestamp| type| source ---|---|--- 2026-07-01 22:41:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlly3lrl2y 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-53344

creationtimestamp| type| source ---|---|--- 2026-07-01 22:36:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlddysy32i 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-53327

creationtimestamp| type| source ---|---|--- 2026-07-01 22:29:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkw2hdf22o 2026-07-06 06:52:56+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-07-24 13:25:32+00:00|...