CVE-2026-49093

creationtimestamp| type| source ---|---|--- 2026-05-29 14:45:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmyrmbdqgh2a...

CVE-2026-42399

creationtimestamp| type| source ---|---|--- 2026-05-29 14:45:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmyrmbdqgh2a...

CVE-2026-42398

creationtimestamp| type| source ---|---|--- 2026-05-29 14:45:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmyrmbdqgh2a...

Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit

An unknown threat actor has been observed using a large language model LLM agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker compromised an...

CVE-2026-45610

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and...

CVE-2025-41279

creationtimestamp| type| source ---|---|--- 2026-05-29 13:20:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmymuebmrv27...

CVE-2026-45610 WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and...

EUVD-2026-33309

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and...

CVE-2026-45610

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and...

CVE-2025-41268

creationtimestamp| type| source ---|---|--- 2026-05-29 13:04:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylxnnadf22 2026-06-22 00:31:15+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motn3czgn52l...

Penetration-Testing-Exploitation-of-Vulnerable-Linux-Systems

Penetration-Testing-Exploitation-of-Vulnerable-Linux-Systems K...

CVE-2026-9509

CVE-2026-9509 affects Suprema BioStar 2 Server (versions 2.9.8, 2.9.10, 2.9.11). An unhandled exception triggered by unauthenticated HTTP POST requests to the /api/migration endpoint can cause a denial of service, halting critical processes and leaving the system offline until services or the ser...

CVE-2026-49201

creationtimestamp| type| source ---|---|--- 2026-05-29 11:55:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyi456rqi22 2026-06-03 18:30:06+00:00| seen| https://t.me/truesecator/8277 2026-06-04 17:01:01+00:00| seen|...

CVE-2026-10078

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to th...

CVE-2026-7054

creationtimestamp| type| source ---|---|--- 2026-05-29 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmyc2x7f2i2g...

CVE-2026-6324

creationtimestamp| type| source ---|---|--- 2026-05-29 09:44:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyarricgp2a 2026-06-05 13:08:09+00:00| published-proof-of-concept| https://t.me/bdufstecru/3219...

WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by dodoh4t in WordPress Plugin Disable Comments for Any Post Types Remove comments versions = 1.3.0...

CVE-2026-49216

creationtimestamp| type| source ---|---|--- 2026-05-29 07:32:44+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmxzgupjrn2c...

CVE-2026-49215

creationtimestamp| type| source ---|---|--- 2026-05-29 07:32:39+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmxzgqhaiq2p...

CVE-2026-6275

The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounteraddToTags function. The function is hooked to wphead...