CVE-2025-71401

creationtimestamp| type| source ---|---|--- 2026-08-03 04:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5os36ck22s 2026-08-04 11:24:49+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msavnlqgs323...

mariadb: mbstream: Unauthorized file creation via path traversal

A flaw was found in MariaDB's mbstream utility. This vulnerability allows a highly privileged local attacker, who can provide a specially crafted archive, to create files outside of the intended target directory. This is due to mbstream not properly validating paths containing directory traversal...

CVE-2026-59650

creationtimestamp| type| source ---|---|--- 2026-08-03 01:36:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5e6epot62u 2026-08-03 04:32:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/117029694758734914 2026-08-03 20:56:04+00:00| seen|...

CVE-2026-69088: Improper Control of Generation of Code

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

PT-2026-67081

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...

PT-2026-67503

Name of the Vulnerable Software and Affected Versions Shlink affected versions not specified Description Authenticated API key holders can trigger server-side request forgery SSRF, a flaw where the server is coerced into making unauthorized requests. By providing a crafted long URL during the sho...

PT-2026-67112

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...

CVE-2026-56672

creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o675pfx2b...

CVE-2026-65321

creationtimestamp| type| source ---|---|--- 2026-08-02 15:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms4cjulwnx2z 2026-08-02 16:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3j3v5ifejd7bh 2026-08-02 16:09:38+00:00| seen|...

CVE-2026-10774

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, netkeyscreate imports the Private Beacon Key into a PSA key slot under CONFIGBTMESHPRIVBEACONS enabled by default, but subnetkeysdestroy guarded the matchin...

EUVD-2026-52002

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, netkeyscreate imports the Private Beacon Key into a PSA key slot under CONFIGBTMESHPRIVBEACONS enabled by default, but subnetkeysdestroy guarded the matchin...

CVE-2026-10774

Summary. CVE-2026-10774 affects Zephyr’s Bluetooth Mesh implementation. The vulnerability arises when subnet keys are torn down: net_keys_create() imports the Private Beacon Key into a PSA key slot, but subnet_keys_destroy() did not balancedly free the slot due to a removed Kconfig guard. This cr...

CVE-2025-71399

creationtimestamp| type| source ---|---|--- 2026-08-02 13:49:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/25yfg6yzjd6mv 2026-08-02 15:00:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4aqy7bkd2b 2026-08-02 15:29:22+00:00| seen|...

CVE-2026-67356 ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity.createUser without permission checks. Attackers with UPDATESCHEMA permission can create triggers that execute JavaScript to create server-wid...

CVE-2026-67356 ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity.createUser without permission checks. Attackers with UPDATESCHEMA permission can create triggers that execute JavaScript to create server-wid...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-16256

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...

CVE-2026-13389 WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-13389 WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-16256

The POUCO Import Users WordPress plugin (versions through 1.0.0 ) is vulnerable to an unauthenticated privilege escalation flaw. The plugin fails to perform necessary capability or nonce checks on AJAX actions that allow for the creation and updating of WordPress accounts. Because the plugin trus...