EUVD-2026-1800

The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level access and...

EUVD-2026-1811

Not used...

EUVD-2026-1795

Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory...

EUVD-2026-1788

Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code...

CVE-2026-0793

creationtimestamp| type| source ---|---|--- 2026-01-09 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-015/ 2026-01-09 17:15:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115866267395234635 2026-01-23 03:54:23+00:00| seen|...

CVE-2026-0760

creationtimestamp| type| source ---|---|--- 2026-01-09 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-026/ 2026-01-23 08:22:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md3bhob4nt26 2026-01-23 10:19:39+00:00| seen|...

EUVD-2026-1810

The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the order REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order a...

EUVD-2026-1772

EUVD-2026-1772...

SUSE CVE-2025-69264

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the...

EUVD-2026-1723

An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request...

RockyLinux 8 : libpng (RLSA-2026:0241)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0241 advisory. libpng: LIBPNG buffer overflow CVE-2025-64720 libpng: LIBPNG heap buffer overflow CVE-2025-65018 libpng: LIBPNG out-of-bounds read in pngimagereadcomposi...

WordPress plugin Frontend Admin by DynamiApps 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

EUVD-2026-1454

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

RHSA-2026:0322

creationtimestamp| type| source ---|---|--- 2026-01-08 17:52:24+00:00| seen| https://gist.github.com/Darkcrai86/44f9ff6358cf9beffa9e5c49830d40fd...

EUVD-2026-1491

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution RCE within the affected product. Affected Products: UBB-XG Version 1.2.2 and earlier UDB-Pro/UDB-Pro-Sector Version 1.4.1 and earlier UBB...

CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a...

EUVD-2026-1567

A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability...

CVE-2026-22589

creationtimestamp| type| source ---|---|--- 2026-01-08 11:25:09+00:00| published-proof-of-concept| https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr 2026-01-10 05:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mc2a4yog3v22 2026-01-10 05:02:44+00:0...

CVE-2025-67918

creationtimestamp| type| source ---|---|--- 2026-01-08 11:00:04+00:00| seen| https://gist.github.com/Darkcrai86/4dce34a100ae0fb464e734a9e9299134 2026-01-08 17:13:56+00:00| seen| Telegram/th--6IaDSr1rDlZynWZbWINS021pVM3F-S9Uc4QWGTyq7M...

EUVD-2026-1582

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host...