Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the /api/v1/sources/id/image-url endpoint, which fails to properly verify organizational ownership. An attacker can access and download OVA images containing sensitive data, such as...

CVE-2026-11436

creationtimestamp| type| source ---|---|--- 2026-06-06 16:45:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnn42sa3ui2b...

CVE-2026-11436

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mageai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirecturl results in cross site scripting. Remote...

CVE-2026-11436 Mage AI Sign-in Flow index.tsx useMutation cross site scripting

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mageai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirecturl results in cross site scripting. Remote...

CVE-2026-11436

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mageai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirecturl results in cross site scripting. Remote...

CVE-2026-11436

Mage AI up to version 0.9.79 is affected in the Sign-in Flow. The vulnerability is in the useMutation function within mage_ai/frontend/components/Sessions/SignForm/index.tsx, where manipulating the query.redirect_url argument triggers cross site scripting. Remote exploitation is possible, and the...

CVE-2026-11411

creationtimestamp| type| source ---|---|--- 2026-06-06 13:00:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmpi4r52i23...

CVE-2026-11412

creationtimestamp| type| source ---|---|--- 2026-06-06 12:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmow7vypb2d...

CVE-2026-6419

creationtimestamp| type| source ---|---|--- 2026-06-06 11:03:00+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnmiwbavbk27...

CVE-2026-9016

creationtimestamp| type| source ---|---|--- 2026-06-06 08:49:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmbhfnw6f2n 2026-06-14 12:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3moaqqe3bb626 2026-09-29 12:47:19+00:00| seen|...

CVE-2026-7624

creationtimestamp| type| source ---|---|--- 2026-06-06 08:44:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmb6h7h7r24...

CVE-2023-34282

creationtimestamp| type| source ---|---|--- 2026-06-06 05:01:16+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnlupg7x5h2r...

CVE-2026-9281

creationtimestamp| type| source ---|---|--- 2026-06-06 04:52:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlu7w5twa2d 2026-06-12 05:16:47+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mo2yeoi32w2w...

CVE-2026-8438

creationtimestamp| type| source ---|---|--- 2026-06-06 04:50:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlu3eviqm2n 2026-06-07 00:01:08+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnnufnkfqi2a...

CVE-2026-7796

The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping...

CVE-2026-7796 EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute

The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping...

CVE-2026-7796 EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute

The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping...

EUVD-2026-34951

The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping...

CVE-2026-7796

Technical details (affected plugin version, root cause, exploit specifics) are not provided in the supplied documents; monitor for updates.

CVE-2026-9280

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...