CVE-2026-12000

The CVE-2026-12000 entry concerns the Page and Post Restriction plugin for WordPress (affected versions up to and including 1.4.0). The issue arises because REST guards (papr_restrict_page_post_rest_api and the the_posts filter via papr_filter_posts) derive the restricted-ID list only from per-pa...

CVE-2026-7105

CVE-2026-7105 affects the WordPress plugin Xpro Addons up to version 1.5.1. The root cause is a missing capability check in the get_menu_content_editor() function, allowing authenticated users with Subscriber+ privileges to create arbitrary published posts of the xpro_content CPT. The created pos...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-16942 WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

EUVD-2026-53105

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

CVE-2020-9687

creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:08+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:56+00:00| seen| https://t.me/timcorehacking/946...

CVE-2026-67555

The CVE-2026-67555 entry concerns Apache Qpid Proton-Dotnet up to version 1.0.0, where the maximum number of transfer frames per incoming delivery could not be governed. This could allow an authenticated attacker to cause excessive resource usage and potential denial of service (availability impa...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

CVE-2020-1216

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:05+00:00| seen| https://t.me/timcorehacking/907 2026-08-06 00:00:54+00:00| seen| https://t.me/timcorehacking/907...

CVE-2020-6469

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:05+00:00| seen| https://t.me/timcorehacking/890 2026-08-06 00:00:53+00:00| seen| https://t.me/timcorehacking/890...

CVE-2026-70592

creationtimestamp| type| source ---|---|--- 2026-08-05 03:31:03+00:00| seen| https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14...

GHSA-MC57-H6J3-3HMV vulnerabilities

Vulnerabilities for packages: bento, opentelemetry-collector-contrib, dapr, splunk-otel-collector...

GHSA-W8J3-PQ8G-8M7W vulnerabilities

Vulnerabilities for packages: bento, opentelemetry-collector-contrib, dapr, splunk-otel-collector...

EUVD-2026-53022

A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit i...

SUSE CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

Photon OS 5.0: Ansible PHSA-2026-5.0-91-0881

An update of the ansible package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0881. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Alsa PHSA-2026-5.0-90-0755

An update of the alsa package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0755. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Openssl PHSA-2024-5.0-91-0313

An update of the openssl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0313. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Glibc PHSA-2024-5.0-91-0250

An update of the glibc package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0250. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : fence-agents (RHSA-2026:50655)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50655 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...