PT-2026-65318

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Contact Form 7 versions prior to 3.5.46 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...

PT-2026-65267

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description...

EUVD-2026-49046

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...

PT-2026-64787

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent version 2026.6.5 Description Improper access controls exist within the SimpleX Gateway Authorization component, specifically in the file hermes-agent/plugins/platforms/simplex/adapter.py. A remote attacker can exploit...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...

CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64274 Input: goodix - clamp the device-reported contact count

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

AWS CLI: Overly permissive File Permissions

Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...

WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.6 - Content Injection vulnerability

Content Injection vulnerability discovered by NosleeP++ in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.6...

MAL-2026-11031 Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

exploitarium

Statement This repo was incomplete when published. In regar...

CVE-2026-65540

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

EUVD-2026-48141

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

CVE-2026-64794

Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or...

CVE-2026-64794

Summary: CVE-2026-64794 affects Joomla extensions from regularlabs.com, specifically Users Anywhere and Articles Anywhere. The vulnerability stems from how user tags, filters, and conditions can access insufficiently restricted user fields, enabling exposure of authentication-related data, raw us...

EUVD-2026-47816

User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details...

CVE-2025-13146

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

EUVD-2025-210494

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2025-13146

The CVE-2025-13146 entry affects the WordPress plugin “Contact Form 7 – Dynamic Text Extension.” The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes by exploiting improper validation before do_shortcode, impacting all versions up to 5.0.6. A partial fix was introduc...