CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

CVE-2026-45285

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:50+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45153

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-43321

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxyuivww2u...

CVE-2025-40949

creationtimestamp| type| source ---|---|--- 2026-05-12 12:19:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnrjhsgsn2g 2026-05-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12 2026-07-17 13:07:38+00:00| seen|...

CVE-2026-41125

creationtimestamp| type| source ---|---|--- 2026-05-12 12:13:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlnr6ey4dn2c 2026-06-09 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-160-02...

CVE-2026-33862

creationtimestamp| type| source ---|---|--- 2026-05-12 12:06:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlnqtmx2vw2h 2026-05-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04...

CVE-2026-2465

creationtimestamp| type| source ---|---|--- 2026-05-12 11:59:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnqfne7qw2t 2026-05-12 12:07:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnquvpw5o2z 2026-05-12 14:12:40+00:00| seen|...

CVE-2026-45211

creationtimestamp| type| source ---|---|--- 2026-05-12 11:58:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnqf2q7ij2w 2026-05-12 11:59:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnqg3vdmc2g...

CVE-2026-42741

creationtimestamp| type| source ---|---|--- 2026-05-12 11:55:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnq7agdwj2l...

CVE-2026-6813

creationtimestamp| type| source ---|---|--- 2026-05-12 11:42:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlnpi57c3y2t 2026-05-13 00:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlp2jsnit52s...

CVE-2026-25786

creationtimestamp| type| source ---|---|--- 2026-05-12 11:32:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlnow35agf2v 2026-05-13 13:51:56+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/116567593091474755 2026-05-14 10:00:00+00:00| seen|...

CVE-2026-33893

creationtimestamp| type| source ---|---|--- 2026-05-12 11:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnn6f3zup2l 2026-05-12 12:01:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlnqkoalkl2i 2026-05-14 10:00:00+00:00| seen|...

CVE-2026-41551

creationtimestamp| type| source ---|---|--- 2026-05-12 10:59:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnn2hmrty2s 2026-05-12 12:18:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlnrhdlmsn2e 2026-05-14 10:00:00+00:00| seen|...

CVE-2026-1460

creationtimestamp| type| source ---|---|--- 2026-05-12 10:21:58+00:00| seen| https://bsky.app/profile/ctsd-gmbh.bsky.social/post/3mlnkxp5i4e2q...

CVE-2026-28986

creationtimestamp| type| source ---|---|--- 2026-05-12 10:21:51+00:00| seen| https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review 2026-05-12 16:26:10+00:00| seen| https://bsky.app/profile/xint-io.bsky.social/post/3mlo7d2kl6k2a 2026-05-12 18:00:00+00:00| seen|...

EUVD-2026-29408

The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2. This is due to a missing capability check and missing nonce verification in the savesettings function, which is registered on the adminpostcccf7savesettings...

EUVD-2026-29395

The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the wpsbdpostcarousel shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-29400

The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

EUVD-2026-29393

The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. The vwrsrreview AJAX handler lacks both capability checks and nonce verification. The only access control is an isuserloggedin check...