WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF

FluentCRM WordPress plugin = 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key. id: CVE-2026-7798 info: name:...

Subscribe to Category <= 2.7.4 - SQL Injection

The Subscribe to Category contains a sqlinjection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL commands, exploit requires user interaction. id: CVE-2023-32590 info: name: Subscribe to Category = 2.7.4 - SQL Injection author:...

miniupnpd_poc

Miniupnpd path that is greater than 526 bytes. The root cause is due to the lack of validating the return value of snprintf since snprintf returns the value of how many bytes it could of copied, not how many bytes it did copy. As of Jan-25-2019 the PoC within this repro has been successfully test...

CallStranger

CallStranger This script created by Yunus Çadırcı https://twitter.com/yunuscadirci to check against CallStranger CVE-2020-12695 vulnerability. An attacker can use this vulnerability for: Bypassing DLP for exfiltrating data Using millions of Internet-facing UPnP device as source of amplified...

hpfeeds

hpfeeds About hpfeeds is a lightweight authenticated publish-subscribe protocol. It has a simple wire-format so that everyone is able to subscribe to the feeds with their favorite language in almost no time. Different feeds are separated by channels and support arbitrary binary payloads. This mea...

CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - Unauthenticated SQL Injection Description The Subscribe to Category plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

MAL-2026-17408 Malicious code in whalibmob (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-12343)

Summary IBM MQ has addressed a denial of service vulnerability due to improper validation of RFH2 message header fields in queued publish/subscribe operations. Vulnerability Details CVEID:CVE-2026-12343 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service due to...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2026-12343)

Summary IBM MQ Appliance has addressed an improper validation vulnerability that could allow an authenticated attacker to cause a denial of service. Vulnerability Details CVEID:CVE-2026-12343 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service due to improper...

CVE-2026-12343

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...

CVE-2026-12343 IBM MQ Denial of Service

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...

EUVD-2026-104468

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...

CVE-2026-12343 IBM MQ Denial of Service

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...

CVE-2026-12343

IBM MQ is vulnerable to a Denial of Service condition. An authenticated attacker can exploit the improper validation of RFH2 message header fields during queued publish/subscribe operations. This flaw results in uncontrolled resource consumption (CWE-400), leading to a high availability impact. N...

CVE-2026-91831

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

WordPress Subscribe to Comments plugin < 2.3.3 - Author+ Email Header Injection vulnerability

Author+ Email Header Injection vulnerability discovered by Het Kalariya in WordPress Plugin Subscribe to Comments versions 2.3.3...

CVE-2026-91831

The Subscribe to Comments WordPress plugin versions before 2.3.3 is vulnerable to an Email Header Injection flaw. The application fails to sanitize newline characters in the notification sender-name setting before utilizing them in email headers. This allows users with Author-level access or high...

EUVD-2026-104101

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...