CVE-2026-18062 Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-14561

creationtimestamp| type| source ---|---|--- 2026-08-01 07:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mryx5qayy72o 2026-08-01 14:57:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzq4bs6742i 2026-08-01 14:57:23+00:00| seen|...

CVE-2026-58180

creationtimestamp| type| source ---|---|--- 2026-08-01 07:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryvtymowm24...

CVE-2026-58181

creationtimestamp| type| source ---|---|--- 2026-08-01 03:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryk4ibonf2r...

EUVD-2026-51655

A reflected cross-site scripting XSS vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

SUSE CVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-18420

creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrxtxdxa7w2c 2026-08-20 22:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkapnkb7h22...

CVE-2026-62999

creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxtwxnwbd2l 2026-08-01 00:15:22+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62999...

CVE-2025-69934

creationtimestamp| type| source ---|---|--- 2026-07-31 20:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxqvzbqfr2u...

CVE-2025-69935

creationtimestamp| type| source ---|---|--- 2026-07-31 20:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxqsg4hof2z...

CVE-2025-69936

creationtimestamp| type| source ---|---|--- 2026-07-31 20:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxqsew44y2m...

CVE-2026-56054

creationtimestamp| type| source ---|---|--- 2026-07-31 19:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxpopxkbu2t...

CVE-2026-57232

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-18481

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

EUVD-2026-51612

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-53501

Thumbor (open-source image thumbnail service by globo.com) is affected prior to version 7.8.0. The vulnerability stems from using Python’s .replace() to strip the signature from the URL before HMAC validation, which removes all occurrences of the substring. An attacker can insert the same signatu...