CVE-2026-31635

creationtimestamp| type| source ---|---|--- 2026-04-28 07:00:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjz5zurue2n 2026-05-17 13:37:26+00:00| seen| https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mm2i7sitqdt2 2026-05-18 02:30:46+00:00| seen|...

CVE-2026-4911

The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe function passing user-controlled $POST'amount' directly to the Stripe PaymentIntent API without validation, and the commitStripe function ignori...

CVE-2026-40556

creationtimestamp| type| source ---|---|--- 2026-04-28 06:20:00+00:00| seen| https://cert.pl/en/posts/2026/04/CVE-2026-40556 2026-04-28 16:50:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl25fsldf2o...

CVE-2026-6809

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated...

CVE-2026-31631

creationtimestamp| type| source ---|---|--- 2026-04-28 06:01:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjvswshzd2g...

CVE-2026-31630

creationtimestamp| type| source ---|---|--- 2026-04-28 06:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjvspm5r62w 2026-07-06 05:52:20+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-08-03...

CVE-2026-7229 code-projects Coaching Management System POST reply.php sql injection

A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the component POST Handler. Performing a manipulation of the argument complaintreply results in sql injection. It is possible to initiate the...

CVE-2026-31641

creationtimestamp| type| source ---|---|--- 2026-04-28 05:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjshk3y2f2e...

CVE-2026-6809 Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated...

EUVD-2026-25987

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated...

CVE-2026-6809 Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated...

CVE-2026-31640

creationtimestamp| type| source ---|---|--- 2026-04-28 04:28:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjqoeozm62s...

CVE-2026-1460

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50ABVY.7.1C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected...

CVE-2026-31663

creationtimestamp| type| source ---|---|--- 2026-04-28 03:10:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjm7lzm2m2n 2026-07-01 02:35:25+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260630...

CVE-2026-31656

creationtimestamp| type| source ---|---|--- 2026-04-28 03:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjlrlnhko2z 2026-05-05 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260506 2026-05-31...

CVE-2026-7159

creationtimestamp| type| source ---|---|--- 2026-04-28 02:14:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkjj7e25vv25...

CVE-2026-1460

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50ABVY.7.1C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected...

CVE-2026-0711

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50ABVY.7.1C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-0711

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50ABVY.7.1C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-41605

creationtimestamp| type| source ---|---|--- 2026-04-28 01:42:47+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkjhgmbnzi2m 2026-04-28 15:10:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkulfbutb2h...