CVE-2025-5017

Summary: The Catalyst Connect Zoho CRM Client Portal WordPress plugin (≤ 2.2.0) is vulnerable to time-based SQL Injection via the uid parameter. The root cause is insufficient escaping of user input and lack of proper query parameterization, enabling authenticated attackers with Administrator-lev...

CVE-2025-5017 Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter

The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-59213

creationtimestamp| type| source ---|---|--- 2026-07-11 01:30:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdjbip7kq2y 2026-07-24 22:35:49+00:00| seen| https://gist.github.com/alon710/9bcf9d1bd3d7650ebf44f14eff2dc08a...

[SECURITY] Fedora 44 Update: prometheus-3.13.0-1.fc44

The Prometheus monitoring system and time series database...

[SECURITY] Fedora 43 Update: prometheus-3.13.0-1.fc43

The Prometheus monitoring system and time series database...

GHSA-G5R6-GV6M-F5JV

creationtimestamp| type| source ---|---|--- 2026-07-11 00:42:57+00:00| seen| https://gist.github.com/alon710/1f4d78a54bd12c1ceab970579e216233...

CVE-2026-39246

creationtimestamp| type| source ---|---|--- 2026-07-11 00:31:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfxmi2yn2s...

CVE-2026-39243

creationtimestamp| type| source ---|---|--- 2026-07-11 00:28:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfr7vgij2i...

CVE-2026-55672

creationtimestamp| type| source ---|---|--- 2026-07-11 00:19:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfbfdqjr2i...

PT-2026-57404

Name of the Vulnerable Software and Affected Versions Catalyst Connect Zoho CRM Client Portal versions prior to 2.2.1 Description Insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow authenticated attackers with Administrator-level access and above to...

RockyLinux 8 : kernel-rt (RLSA-2026:36365)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36365 advisory. kernel: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath CVE-2026-43112 Tenable has extracted the preceding description block directly from the...

CVE-2025-5017: Improper Neutralization of Special Elements used in an SQL Command

The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-4661: Improper Neutralization of Special Elements used in an SQL Command

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck method...

CVE-2026-59868

creationtimestamp| type| source ---|---|--- 2026-07-10 23:59:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqde5mvdyk2d 2026-07-20 22:37:26+00:00| published-proof-of-concept| https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv...

CVE-2026-55659

creationtimestamp| type| source ---|---|--- 2026-07-10 22:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqd5lbrpnm2k 2026-07-13 23:17:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkt7jybgz2d...

CVE-2026-61371

creationtimestamp| type| source ---|---|--- 2026-07-10 21:53:30+00:00| seen| https://gist.github.com/thesmartshadow/2d099071f847de8db3dc4bbaf4dfa6df...

MAL-2026-10176 Malicious code in uncaxss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...

CVE-2026-56335

creationtimestamp| type| source ---|---|--- 2026-07-10 21:23:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd3gbkepx2y...

CVE-2026-56309

creationtimestamp| type| source ---|---|--- 2026-07-10 21:21:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd3czjglm2c...

CVE-2026-57230

OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an...