40337 matches found
CVE-2026-5464
creationtimestamp| type| source ---|---|--- 2026-04-23 11:16:37+00:00| seen| Telegram/wFSQsgW7X9YvnPcwQoIwWZcAEOwcl2-nLfGCKL8FlikswBY 2026-04-24 09:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mka7tvrujp2s...
Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure
The Ajax Load More – Infinite Scroll plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.6.0.2. The plugin's AJAX endpoint wpajaxnoprivalmgetposts allows unauthenticated users to access non-public posts draft, private, pending, future, tras...
Automated-CSRF-PoC-Generator
Description: A specialized Python script designed to automate th...
CVE-2026-42295
creationtimestamp| type| source ---|---|--- 2026-04-23 08:17:49+00:00| published-proof-of-concept| https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf 2026-05-09 04:50:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfh2xgpod2e...
CVE-2026-41564
creationtimestamp| type| source ---|---|--- 2026-04-23 07:54:13+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk5ju6g7262v 2026-04-23 15:16:16+00:00| published-proof-of-concept| Telegram/GpzWIna0u4Xk2Mxyx7IImpynDcGXZQ8MHW9U4L55IHFQ 2026-04-23 21:45:30+00:00| seen|...
CVE-2026-3361 WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsladdress' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress WP Store Locator plugin <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'wpsladdress' Post Meta vulnerability discovered by kai63001 in WordPress Plugin WP Store Locator versions = 2.2.261...
CVE-2026-41243
OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when safeMode is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit...
SWUpdate 缓冲区错误漏洞
SWUpdate is an embedded Linux system update tool developed by Stefano Babic. SWUpdate has a buffer error vulnerability, which stems from an integer underflow in the multipart upload parser in the mongoosemultipart.c file. This vulnerability allows unauthenticated attackers to cause...
Froxlor 后置链接漏洞
Froxlor is a set of lightweight server management software developed by the Froxlor team. Versions of Froxlor prior to 2.3.6 had a post-installation link vulnerability. This vulnerability stemmed from the DataDump.add function not passing the $fixedhomedir parameter when constructing the export...
PT-2026-34631
The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl address' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-34605
OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when safeMode is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit...
PT-2026-42875
Name of the Vulnerable Software and Affected Versions Edimax BR-6428NS version 1.10 Description Command injection is possible via a remote attack in the POST Request Handler component. The issue exists within the formWlbasic function located in the /goform/formWlbasic file, where improper...
PT-2026-34748
SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...
EUVD-2026-22847
The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classcontainer' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied...
EUVD-2026-22828
The Advanced Custom Fields ACF plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions witho...
EUVD-2026-22822
The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...
CVE-2026-41167
creationtimestamp| type| source ---|---|--- 2026-04-22 21:24:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4gnbxyzv2q 2026-04-22 22:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116450723807217963 2026-04-22 22:30:33+00:00| seen|...
GHSA-W937-FG2H-XHQ2 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
Summary Versions of the locize client SDK the browser module that wires up the locize InContext translation editor prior to 4.0.21 register a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled,...