Missing Authentication

org.xwiki.platform, xwiki-platform-rest-server is vulnerable to Missing Authentication. The vulnerability is due to the POST /wikis/wikiName API executing a XAR import without performing authentication or authorization checks, which allows an unauthenticated attacker to create or update documents...

CVE-2026-46552

creationtimestamp| type| source ---|---|--- 2026-05-30 03:00:05+00:00| seen| Telegram/90RQ9hYtGaiQArsrNQjzkMS9V8ZquthAYQcfSQsotfwm9eA 2026-07-13 22:00:18+00:00| seen| https://t.me/GithubRedTeam/90510 2026-07-14 00:00:35+00:00| seen| https://t.me/GithubRedTeam/90510 2026-07-15 00:00:20+00:00|...

GHSA-3V7F-55P6-F55P

creationtimestamp| type| source ---|---|--- 2026-05-30 02:23:48+00:00| seen| https://gist.github.com/konard/ddaf1c7a82581f9e29a8359316e48df3 2026-05-30 12:07:18+00:00| seen| https://gist.github.com/konard/f3567870039c68dff77f077e839add9b...

CVE-2026-46402

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled taskname value directly when constructing session log paths. An authenticated client can supply path traversal sequences in taskname and cause...

Exploit for CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privil...

CVE-2026-45613

creationtimestamp| type| source ---|---|--- 2026-05-29 22:23:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzlahikt42i...

CVE-2026-44422

creationtimestamp| type| source ---|---|--- 2026-05-29 22:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzjwzys5f23 2026-05-30 12:02:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116663420594857571...

CVE-2026-46599

creationtimestamp| type| source ---|---|--- 2026-05-29 21:57:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjr6anon23 2026-07-06 08:02:31+00:00| seen| https://gist.github.com/alon710/b509de249400d70367353eccad7c34f4...

GHSA-PJWM-PJ3P-43MV

creationtimestamp| type| source ---|---|--- 2026-05-29 21:20:01+00:00| seen| https://gist.github.com/konard/e2cdc40115fd7e81d8828ab9496865a2...

CVE-2026-45633

creationtimestamp| type| source ---|---|--- 2026-05-29 20:21:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzefsabjs2g 2026-05-30 04:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mn262srnhk26...

CVE-2026-47744

creationtimestamp| type| source ---|---|--- 2026-05-29 20:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzdburqpr2d...

CVE-2026-49372

creationtimestamp| type| source ---|---|--- 2026-05-29 20:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzd7ww25p2i...

CVE-2026-47741

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...

CVE-2026-10066

creationtimestamp| type| source ---|---|--- 2026-05-29 18:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmz4jl542s27...

CVE-2026-49316

creationtimestamp| type| source ---|---|--- 2026-05-29 17:20:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmz2coquwy2x...

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

Summary filepath.Base on the Linux container does not strip backslashes , because \ is only a path separator on Windows. A multipart filename like ........\Windows\System32\evil.pdf survives Gotenberg's input sanitisation and lands verbatim as the zip entry name when a multi-output route...

CVE-2026-9509

creationtimestamp| type| source ---|---|--- 2026-05-29 15:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyvkahgvy27...

CVE-2026-45043

creationtimestamp| type| source ---|---|--- 2026-05-29 15:44:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyuvh4hpj2j...

EUVD-2018-21919

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST...

CVE-2018-25397 PHP-SHOP 1.0 Cross-Site Request Forgery via users.php

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST...