PT-2026-50994

Name of the Vulnerable Software and Affected Versions Joomla! Component vBizz version 1.0.7 Description An unrestricted file upload issue allows authenticated attackers to upload arbitrary PHP files. This is achieved by submitting malicious files through the profile pic parameter via POST request...

CVE-2026-50196

creationtimestamp| type| source ---|---|--- 2026-06-18 23:05:10+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3molwuneim227...

Exploit for Improper Access Control in Widgetfactorylimited Jce

Joomla JCE CVE-2026-48907 — PoC Validation, Webshell Artifacts...

CVE-2026-25865

creationtimestamp| type| source ---|---|--- 2026-06-18 21:28:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molri5cm7q2z...

OpenClaw: Exported session HTML could keep unsafe markdown links

Summary Exported session HTML could keep unsafe markdown links. In affected versions, content rendered into an exported session could preserve unsafe javascript: or data: links in generated HTML. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...

CVE-2025-32437

creationtimestamp| type| source ---|---|--- 2026-06-18 18:36:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molhuccpkl2s...

CVE-2026-54105

creationtimestamp| type| source ---|---|--- 2026-06-18 18:21:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molgzgtqsw2s...

CVE-2026-5667

creationtimestamp| type| source ---|---|--- 2026-06-18 18:13:12+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3molgkjvhag2n 2026-06-18 18:54:32+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3moliuhtdar2v 2026-07-15 12:00:04+00:00| published-proof-of-concept...

CVE-2025-32436

creationtimestamp| type| source ---|---|--- 2026-06-18 17:54:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molfj6oi6x2s...

CVE-2025-32424

creationtimestamp| type| source ---|---|--- 2026-06-18 17:48:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molf6ewx2p2o...

CVE-2026-55204

creationtimestamp| type| source ---|---|--- 2026-06-18 17:38:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molemhxkms2d 2026-06-29 13:15:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgl23bd472u 2026-07-01 02:44:41+00:00| seen|...

CVE-2026-44691

creationtimestamp| type| source ---|---|--- 2026-06-18 17:33:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moledjigad2w...

CVE-2026-54105

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

EUVD-2026-37912

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

CVE-2026-54105 U.S. GAO EPDS and CBCA EDS user information disclosure

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

CVE-2026-54105

The CVE concerns CVE-2026-54105 affecting the GAO EPDS and CBCA EDS systems. The vulnerability arises from the update-profile/ API endpoint, where a remote, unauthenticated attacker can supply an arbitrary user_id and receive a JSON response containing account-specific information, including the ...

CVE-2026-54105

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

EUVD-2026-37910

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...

CVE-2026-54103

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...

CVE-2026-54103 U.S. GAO EPDS and CBCA EDS unauthenticated password change

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...