CVE-2026-54347

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:28+00:00| published-proof-of-concept| https://github.com/froxlor/froxlor/security/advisories/GHSA-43gm-9rr3-cx7g...

CVE-2026-55593

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:23+00:00| published-proof-of-concept| https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j 2026-08-19 11:32:39+00:00| seen| https://gist.github.com/alon710/3948341428804c685cf1bc5b4fc0d3f1...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

MeshCentral has unsanitized data fields

Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc OS description field in its coreinfo message. The server stores this value with zero HTML sanitization meshagent.js:1903 only checks typeof == 'string'. When an admin views the device details panel, t...

CVE-2026-61696

Forem versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c render unsanitized feedback_message[message] via raw() in app/views/admin/feedback_messages/_feedback_message.html.erb, enabling stored XSS when an admin views an abuse report. The unauthenticated FeedbackMessagesController acc...

EUVD-2026-61141

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-45128 MyBB: ACP Users View Manager default CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

PT-2026-77182

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

PT-2026-77078

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

PT-2026-77267

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback messagemessage is stored without sanitization and rendered in app/views/admin/feedback messages/ feedback message.html.erb throu...

CVE-2026-19994

A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack ma...

BIT-GHOST-2026-70594 Ghost: Session Fixation in Ghost Admin

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

BIT-GHOST-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-13424 Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-19838

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The...

EUVD-2026-58709

A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has...

CVE-2026-19836

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

CVE-2026-19834

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

MINI-CF7V-M64R-GPR2

Bulletin has no description...

CVE-2026-15217

creationtimestamp| type| source ---|---|--- 2026-08-13 10:21:54+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-20 2026-08-13 14:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxssijrld2m 2026-08-13 20:15:15+00:00| seen|...