CVE-2026-60371

creationtimestamp| type| source ---|---|--- 2026-07-23 00:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbjtchhw62x 2026-07-23 01:15:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbnytie5e23 2026-07-23 16:52:59+00:00| seen|...

Oracle Linux 8 : acl (ELSA-2026-43420)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-43420 advisory. 2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186111 -...

Oracle VM VirtualBox (July 2026 CPU)

The 7.2.12 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12...

TencentOS Server 2: pam (TSSA-2025:1033)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1033 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

TencentOS Server 2: freerdp (TSSA-2026:0754)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0754 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

PT-2026-63574

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

PT-2026-63936

Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...

PT-2026-63944

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

PT-2026-63853

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

PT-2026-63864

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

PT-2026-63885

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

PT-2026-63898

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

PT-2026-63906

Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...

PT-2026-63943

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

PT-2026-63952

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

PT-2026-63899

Subscriber Broken Access Control in ListingPro = 2.9.10 versions...

PT-2026-63884

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

PT-2026-64177

Name of the Vulnerable Software and Affected Versions MZ Automation libIEC61850 affected versions not specified Description A NULL pointer dereference occurs in the L2 GOOSE and R-GOOSE shared parser. This issue allows a network-adjacent attacker to crash a subscribing application by sending a...

CVE-2026-14291: Improper Authentication

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

PT-2026-64211

Name of the Vulnerable Software and Affected Versions find-my-way versions prior to 9.7.0 Description A remotely triggerable Denial of Service DoS exists when the software is used with Node's HTTP/2 server. The lookup function passes the req.method variable into the find function, which then...