CVE-2026-48017

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

CVE-2026-52719

creationtimestamp| type| source ---|---|--- 2026-06-15 20:26:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe4m3klva2b...

CVE-2026-48838

CVE-2026-48838 covers an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Post SMTP plugin, versions

EUVD-2026-36845

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

CVE-2026-48838 WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

CVE-2026-39474

The CVE CVE-2026-39474 concerns the WordPress Post Duplicator plugin (versions

CVE-2026-39474 WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...

CVE-2026-50886

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-50882

An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2026-54294

creationtimestamp| type| source ---|---|--- 2026-06-15 20:15:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe3z77vp32w...

CVE-2026-54292

creationtimestamp| type| source ---|---|--- 2026-06-15 20:04:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe3fg4bph2e...

CVE-2026-9259

creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 03:57:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moevt6c3uo2i 2026-06-16 04:31:16+00:00| seen|...

Malicious code in cardano-addresses-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d99ae2a620ac8a3db31cde344d6d1e46914f785b3d5f4b8debdb20d64fa9c75 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js collects host identifiers os.hostname,...

CVE-2026-49764

creationtimestamp| type| source ---|---|--- 2026-06-15 18:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3modvd23ofh22 2026-06-15 21:13:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe77xkqrv2m 2026-06-16 05:00:55+00:00| seen|...

MAL-2026-5787 Malicious code in @solana-labs/spl-toke (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 490ce5d7e43d8a79aa85bbd24e7140ed074eee472f375092ab9b4cd650ce41f8 Package name @solana-labs/spl-toke is a one-character omission of the legitimate @solana-labs/spl-token package, abusing the official Solana Labs...

GHSA-95QP-CMMW-MGQV @angular/service-worker: Request Credential & Cache Policy Stripping

An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During thi...

CVE-2018-25437

creationtimestamp| type| source ---|---|--- 2026-06-15 16:52:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3modqnrcxe32b...

CVE-2019-25746

creationtimestamp| type| source ---|---|--- 2026-06-15 16:47:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3modqest7632u...

WordPress Abandoned Contact Form 7 plugin <= 2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by g0wthr in WordPress Plugin Abandoned Contact Form 7 versions = 2.5...

Malicious code in neural-network-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898c75e5a6ae94d115820736ffd2ca4cb948f72655d5c0175a3432cec835768c The package ships a collect.js script that imports childprocess and performs an HTTP POST carrying host identifiers hostname referenced multiple time...