CVE-2026-29519 Lucee CFML Server Reflected XSS via URL Path Parsing

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-29519

CVE-2026-29519 affects Lucee CFML Server across 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines. It describes a reflected cross-site scripting vulnerability in URL path parsing, where unauthenticated remote attackers can cause arbitrary JavaScript to execute in a victim’s browser by embedding payloa...

CVE-2026-57227

creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25 2026-09-18 23:03:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvtbnkcmwv24 2026-09-18 23:11:55+00:00| seen|...

CVE-2026-60091 PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhookurl parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a...

CVE-2026-49241

creationtimestamp| type| source ---|---|--- 2026-07-10 13:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc7phehxg25...

CVE-2026-15104

creationtimestamp| type| source ---|---|--- 2026-07-10 12:11:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4lgpdfj2x 2026-07-10 21:17:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd34b3skm22 2026-07-11 00:46:26+00:00| seen|...

CVE-2026-12108

creationtimestamp| type| source ---|---|--- 2026-07-10 12:02:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc43ygvab2e 2026-07-10 21:13:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2v5rp452s 2026-07-10 21:13:31+00:00| seen|...

PDF CVE-2018-4993 GoToE NTLM Callback

Generate PDF PoCs for CVE-2018-4993: /GoToE action with UNC path NTLM and HTTPS URL variant. Phone-home validation for Adobe Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writegotoeunc,...

CVE-2026-40009

creationtimestamp| type| source ---|---|--- 2026-07-10 11:18:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbznn7c7g26 2026-07-10 12:15:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40009 2026-07-10 13:25:26+00:00| seen|...

CVE-2026-40006

creationtimestamp| type| source ---|---|--- 2026-07-10 10:57:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyhjhsfl2f 2026-07-10 12:15:37+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40006 2026-07-10 13:18:20+00:00| seen|...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-59721

creationtimestamp| type| source ---|---|--- 2026-07-10 09:14:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqbspbvraw27...

CVE-2026-21057

creationtimestamp| type| source ---|---|--- 2026-07-10 08:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbr6mzc2h2x 2026-07-10 09:56:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbv2z7uij2a 2026-07-10 09:56:43+00:00| seen|...

CVE-2026-21045

creationtimestamp| type| source ---|---|--- 2026-07-10 08:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbpamuqba27 2026-07-10 09:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbux2ewhl2e 2026-07-10 12:46:38+00:00| seen|...

CVE-2026-12685 EscortWP <= 3.6.2 - Content Deletion via Vendor-Authored Backdoor

The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator emai...

CVE-2026-59226

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgr7qezc26...

CVE-2026-59225

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgqlpmwx2e 2026-07-24 22:35:49+00:00| seen| https://gist.github.com/alon710/dc8fbe1b073218955707634edeb9a32e...

CVE-2026-12123

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locatio...

CVE-2026-59221

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6yf7g42s...

CVE-2026-59227

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6ejpes22 2026-07-24 18:35:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g...