CVE-2026-65321

creationtimestamp| type| source ---|---|--- 2026-08-02 15:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms4cjulwnx2z 2026-08-02 16:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3j3v5ifejd7bh 2026-08-02 16:09:38+00:00| seen|...

CVE-2026-10774

CVE-2026-10774 : Zephyr’s Bluetooth Mesh subnet key teardown leaks one PSA Crypto key slot per subnet-key deletion due to a guard mismatch (destroy guarded by a removed CONFIG_BT_MESH_V1d1, import guarded by CONFIG_BT_MESH_PRIV_BEACONS). With default PSA slot count (16), repeated add/delete or ke...

EUVD-2026-52002

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, netkeyscreate imports the Private Beacon Key into a PSA key slot under CONFIGBTMESHPRIVBEACONS enabled by default, but subnetkeysdestroy guarded the matchin...

CVE-2025-71399

creationtimestamp| type| source ---|---|--- 2026-08-02 13:49:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/25yfg6yzjd6mv 2026-08-02 15:00:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4aqy7bkd2b 2026-08-02 15:29:22+00:00| seen|...

CVE-2026-67356 ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity.createUser without permission checks. Attackers with UPDATESCHEMA permission can create triggers that execute JavaScript to create server-wid...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-16256

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...

CVE-2026-13389 WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-16256

POUCO Import Users WordPress plugin (≤1.0.0) is affected. The vulnerability stems from missing capability/nonce checks on AJAX actions available to unauthenticated users and reliance on an attacker-supplied role, enabling unauthenticated attackers to create a new administrator account and take ov...

CVE-2026-18571

CVE-2026-18571 affects Keycloak’s user-creation flow when FGAP V2 is enabled. A sub-administrator allowed to create users can add those users to any group, including groups they are not authorized to manage, potentially enabling unauthorized access or elevated privileges for new users. The connec...

EUVD-2026-51925

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...

WSO2 User Registration - Arbitrary Account Creation

The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings. id: CVE-2024-7097 info: name: WSO2 User Registration - Arbitrary Account Creation author: iamnoooob,rootxharsh,pdresearch...

Telesquare TLR-2855KS6 - Arbitrary File Creation

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. id: CVE-2021-46418 info: name: Telesquare TLR-2855KS6 - Arbitrary File Creation author: DhiyaneshDK severity: high description: | An unauthorized file creation vulnerability in...

Blinko <= 1.8.3 - User Information Leak

Blinko = 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges. id: CVE-2026-23486 info: name:...

CVE-2026-13339

creationtimestamp| type| source ---|---|--- 2026-08-02 01:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtm67nw2n 2026-08-02 08:36:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ldebc5q2e 2026-08-02 08:36:59+00:00| seen|...