CVE-2026-15451

creationtimestamp| type| source ---|---|--- 2026-09-12 14:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdak72smv2p 2026-09-12 16:01:52+00:00| seen| https://gist.github.com/ichintu/11d7f3c8a2e6716bcedbcab98b589bc5...

CVE-2026-90537

creationtimestamp| type| source ---|---|--- 2026-09-12 14:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdajxfe6n2m...

CVE-2026-90553

creationtimestamp| type| source ---|---|--- 2026-09-12 13:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdaiumtdh2z 2026-09-16 07:26:28+00:00| seen| https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmey7k4i22 2026-09-16 07:26:40+00:00| seen|...

redamon v6.14.1

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

CVE-2026-82851

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

EUVD-2026-76789

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

WordPress Masteriyo LMS plugin 1.14.0-3.4.0 - Instructor+ Arbitrary Post Disclosure vulnerability

Instructor+ Arbitrary Post Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.14.0-3.4.0...

CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

CVE-2026-82851

Masteriyo LMS WordPress plugin (versions 1.14.0–3.4.0 ) contains an IDOR (Insecure Direct Object Reference) vulnerability in its download/records endpoint. The plugin fails to verify ownership of, or restrict the type of, records a user requests for download, enabling any user with the instructor...

CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

CVE-2026-75722

creationtimestamp| type| source ---|---|--- 2026-09-12 04:59:25+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mvcccdvf422t...

CVE-2026-75735

creationtimestamp| type| source ---|---|--- 2026-09-12 04:59:24+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mvcccchd6f2w...

CVE-2026-88862

creationtimestamp| type| source ---|---|--- 2026-09-12 04:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvcbroayk42y...

enterprise-network-pentest-project

Enterprise Network Penetration Testing Lab A self-built, isol...

CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89268

QloApps through 1.7.0 contains a reflected cross-site scripting (XSS) vulnerability in the back-office list helper template (list_header.tpl). POST parameters from list filter forms are rendered into HTML value attributes without escaping , allowing an attacker to induce an authenticated user to ...

CVE-2026-89268: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-90539: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

Linux Distros Unpatched Vulnerability : CVE-2026-89661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before...

CVE-2026-90534: Authorization Bypass Through User-Controlled Key

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...