CVE-2026-48148

creationtimestamp| type| source ---|---|--- 2026-05-21 08:44:47+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cv96-5348-p5p8 2026-05-27 19:35:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmuavyucc42o...

CVE-2026-48147

creationtimestamp| type| source ---|---|--- 2026-05-21 08:44:07+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-wxq7-x3qp-vcr8 2026-05-27 19:55:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmubzsxsj62o...

CVE-2026-8418

creationtimestamp| type| source ---|---|--- 2026-05-21 08:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmdyzpj3gm2c...

CVE-2026-6452

creationtimestamp| type| source ---|---|--- 2026-05-21 07:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmdvofn2xr2s...

CVE-2026-6279

creationtimestamp| type| source ---|---|--- 2026-05-21 06:53:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdtj6esyd2t 2026-05-21 11:32:28+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3mmed3x6lqk2s 2026-05-21 11:32:29+00:00| seen|...

CVE-2026-2734

creationtimestamp| type| source ---|---|--- 2026-05-21 06:48:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdta7xnen2p...

Malicious code in auth0-templates-scripts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed9a505fcbf6daef28b6625dcbde65ea1dd00b01c1a684debfdedfc7e5bc3643 Package name impersonates the Auth0 ecosystem. Its postinstall hook node index.js runs unconditionally on npm install and performs a multi-stage data...

CVE-2026-6279

The Avada Builder fusion-builder plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the wpconditionaltags case in FusionBuilderConditionalRenderHelper::getvalue passing attacker-controlled...

psqli

psqli Powerfull Automatic Sql injection Tools Pack Fast...

CVE-2026-1881

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the getsponsoredmeta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-40165

creationtimestamp| type| source ---|---|--- 2026-05-21 02:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmdd56ia522r...

CVE-2026-1881

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the getsponsoredmeta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-1881 Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the getsponsoredmeta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2026-31206

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the getsponsoredmeta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-1881 Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the getsponsoredmeta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2026-42494

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'db loader.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the POST...

PT-2026-42497

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description Authenticated attackers can perform a reflected cross-site scripting attack via the 'ics202.php' endpoint. The issue occurs when an unsanitized value is passed through the frm add str POST...

PT-2026-42495

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'delete module.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the modul...

tickets 跨站脚本漏洞

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the ref and modeorig POST parameters in oswatch.php, allowing uncleane...

tickets 跨站脚本漏洞

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of cleanup in the deletemodule.php file, allowing multiple POST paramete...