log4j-detector

Log4-detector Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228 CRITICAL, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It...

WordPress Themify Builder < 7.5.8 - Open Redirect

The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tbredirectfail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites. id: CVE-2024-3032 info: name:...

Gitea 1.22.0 - Cross-Site Scripting

Gitea 1.22.0 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session. id: CVE-2024-6886 info: name: Gitea 1.22.0 - Cross-Site Scripting...

ROOT-OS-UBUNTU-2204-CVE-2025-71289 CVE-2025-71289 in linux - Patched by Root

Root has patched CVE-2025-71289 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-46187 CVE-2026-46187 in linux - Patched by Root

Root has patched CVE-2026-46187 in the linux package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-76383

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's tokenserial parameter is not masked...

CVE-2026-70859

creationtimestamp| type| source ---|---|--- 2026-08-19 17:45:02+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-23 15:07:23+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtr2wkpx2y23...

PT-2026-78810

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token serial parameter is not masked...

CVE-2026-27365

The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...

CVE-2026-45124

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=doreports Mark Selected as Read handler is reachable with...

CVE-2026-73343

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

WordPress ECS plugin < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload vulnerability

Unauthenticated Private Content Disclosure via ecsload vulnerability discovered by Jashid Sany in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...

ROS-20260818-73-0019

A vulnerability in Mariadb 11.8 is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75060

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools...

CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

EUVD-2026-58380

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability...

CVE-2026-66464

Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...