EUVD-2025-210560

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

CVE-2025-65341

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

PT-2026-66562

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An issue exists where the '/server info' endpoint returns sensitive API keys and SSL keyfile information. This occurs specifically when only the --admin-api-key is configured. Recommendations ...

PT-2026-66598

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...

PT-2026-66622

Name of the Vulnerable Software and Affected Versions MeshCentral version 1.1.21 Description A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the CheckWebServerOriginName function within...

PT-2026-66591

Name of the Vulnerable Software and Affected Versions Outstatic CMS versions prior to 2.2.0 Description The application contains a hardcoded JSON Web Token JWT signing secret. If the OST TOKEN SECRET environment variable is not configured, the system uses a default secret available in the public...

CVE-2026-52539

Outstatic CMS versions

CVE-2025-65341

Ecommerce Fruits Bazar version 1.0 is vulnerable to Cross-Site Scripting (XSS) within the admin/edit_product.php endpoint. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. No specific remediation or patch information is currently available in the prov...

PT-2026-66454

Name of the Vulnerable Software and Affected Versions Eaton Tripp Lite Series PADM firmware affected versions not specified Description Improper input validation in a session management interface allows an authenticated administrator to execute arbitrary commands within a restricted environment...

PT-2026-66389

Name of the Vulnerable Software and Affected Versions WP Real IP-based Access Control versions prior to 1.3.2 Description The plugin fails to perform capability or nonce checks before storing option values and does not escape these values on the settings page. This leads to Stored Cross-Site...

PT-2026-66601

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2 Description An authorization bypass exists in the BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. This allows authenticated users without administrative...

PT-2026-66597

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.7 Description TenantResource RawItems and Generators in internal/controllers/resources/collect.go, specifically within the handleRawItem and handleGeneratorItem functions, fail to apply the...

CVE-2026-11867: Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-16610: Unrestricted Upload of File with Dangerous Type

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2025-65341: Improper Neutralization of Input During Web Page Generation

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

CVE-2026-65834: Improper Input Validation

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-15831

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

EUVD-2026-50439

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

CVE-2026-67193 Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...