CVE-2026-16223

1Panel-dev CordysCRM up to 1.4.1 is affected in the Third Party Edit Endpoint, specifically the IntegrationConfigService.getSqlBotSrc function. A manipulated appSecret can trigger server-side request forgery (SSRF) and the issue can be exploited remotely. The exploit has been publicly disclosed a...

react2shell-poc

react2shell-poc Proof-of-concept exploit for CVE-2025-55182...

CVE-2026-57857

creationtimestamp| type| source ---|---|--- 2026-07-18 23:52:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqxhjjuvhu2a...

Cross-site Scripting (XSS)

plone.app.textfield is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to returning unsanitized RichText content when the stored and output MIME types are identical, which allows an attacker to inject and execute arbitrary JavaScript in a victim's browser...

CVE-2026-11826

creationtimestamp| type| source ---|---|--- 2026-07-18 15:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116941575267749808 2026-07-18 15:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqwjrnagnc2i 2026-07-18 15:00:39+00:00| seen|...

CVE-2026-54243

creationtimestamp| type| source ---|---|--- 2026-07-17 23:51:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquwyzxvhl2b...

CVE-2026-48045

creationtimestamp| type| source ---|---|--- 2026-07-17 20:34:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqulyhoe352b...

plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

CVE-2026-38753

creationtimestamp| type| source ---|---|--- 2026-07-17 16:03:14+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqu4stvt3e2e...

CVE-2026-9602

Mattermost Desktop App versions =6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-8075

Mattermost Desktop App versions =6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermo...

CVE-2026-8075

Mattermost Desktop App versions =6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermo...

EUVD-2026-45157

Mattermost Desktop App versions =6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermo...

CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App

Mattermost Desktop App versions =6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermo...

CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App

Mattermost Desktop App versions =6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermo...

CVE-2026-9602

Mattermost Desktop App vulnerable versions:

CVE-2026-9602

Mattermost Desktop App versions =6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-62233

creationtimestamp| type| source ---|---|--- 2026-07-17 02:53:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqoxkcre2u 2026-08-21 19:50:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtmjso4lsr2m 2026-08-22 12:40:04+00:00| seen|...

CVE-2026-62319

creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:12+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr6vyls2w...

PT-2026-60894

Name of the Vulnerable Software and Affected Versions plone.app.textfield versions prior to 2.0.2 plone.app.textfield versions prior to 3.0.2 plone.app.textfield versions prior to 4.0.1 Description A stored Cross-Site Scripting XSS issue affects RichText fields. The RichTextValue.output function...