CVE-2026-62218

creationtimestamp| type| source ---|---|--- 2026-07-17 02:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqdez4ne2l 2026-07-22 09:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr7zkz3jvo26...

CVE-2026-54001

creationtimestamp| type| source ---|---|--- 2026-07-10 22:22:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6q42vrb2z 2026-07-10 23:40:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdd3r4mkg2x...

CVE-2026-9570 Taskbuilder < 5.0.8 - Reflected XSS via Shortcode

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user...

CVE-2026-9280

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-44840

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0-rc1 Description A stack buffer overflow exists in the piv process history function within src/libopensc/card-piv.c. This issue allows a physically present attacker to cause memory corruption by using a specially...

CVE-2026-8425

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to ...

GHSA-F8H4-46XV-H7JJ Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. HTML Publisher Plugin 427.1 escapes job name and URL when...

Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

Summary The GET /api/website/title endpoint accepts an arbitrary URL via the websiteurl query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network...

MAL-2026-2026 Malicious code in pipinpeace-env (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b76166abb6c7173f1cc74e41509f4ded1be2de5cea682016e00001e4e23b75a9 Package is designed to exfiltrate env variables during installation. However, it requires providing a URL as an installation parameter, which suggests it's mor...

EUVD-2017-16758

Malware in sbrugna...

CVE-2025-2131: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friendly Links Handler. The manipulation of the argument Website Address leads to cross site scripting. The attack may be initiated remotely. Th...

PT-2025-10555

Name of the Vulnerable Software and Affected Versions dayrui XunRuiCMS versions up to 4.6.3 Description A vulnerability was found in the component Friendly Links Handler of dayrui XunRuiCMS. The manipulation of the Website Address argument leads to cross-site scripting. The attack may be initiate...

XunRuiCMS 代码注入漏洞

XunRuiCMS XunRuiCMS is a content management system for individual developers of XunRuiCMS. A code injection vulnerability exists in XunRuiCMS 4.6.3 and earlier versions, which stems from the incorrect operation of the parameter Website Address that can lead to cross-site scripting...

PT-2025-4114 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A problematic issue has been found in the file / parse/load job-details.php, where the manipulation of the business stream name and company website url arguments leads to cross site...

Security Vulnerabilities fixed in Firefox for iOS 134 — Mozilla

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address...

CVE-2024-38313

In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS 127...

Mozilla: Alert dialog could have been spoofed on another site

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website with the victim website's URL shown...

CVE-2022-29349

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

The vulnerability of Google Chrome’s browser allows a hacker to replace the URL.

The vulnerability of the ios/web/webstate/ui/crwwebcontroller.mm component in the Google Chrome browser does not guarantee that an invalid URL will be replaced with a about:blank page. Exploiting this vulnerability could allow a malicious actor to substitute a URL with a specially crafted website...

cPanel 11.x (Fantastico) Local File Include / SM-b0x

Exploit for php platform in category web applications cPanel 11.x Fantastico Local File Include / SM-b0x ////\ //\ //\ //\ //\ //\ //\ //\ //\ :::/\ ::\:.\ \::\ \ \ \ :\ \ ::: \ \::: \ \::\ \:::/ /: / \:::/ ::/\ .\ \ //\:\ \ :: \ \:: /:/ /: / /::/ /\/\:: ::\ \::::/ :...