GHSA-5X7J-XJPX-PMM5

creationtimestamp| type| source ---|---|--- 2026-05-28 00:01:41+00:00| seen| https://t.me/GithubRedTeam/86181...

CVE-2026-8361

creationtimestamp| type| source ---|---|--- 2026-05-28 00:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmupqwidc72z 2026-05-28 04:18:30+00:00| seen| https://www.acn.gov.it/portale/w/gladinet-disponibili-poc-per-nuove-vulnerabilita-in-triofox...

PT-2026-44732

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.19.4 Description An authenticated user can perform an arbitrary read of any file accessible by the Arcane backend process. This occurs because the ProjectService.CreateProject function writes attacker-supplied compos...

RockyLinux 9 : linux-sgx (RLSA-2026:18868)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18868 advisory. qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-15284 node-tar: tar: node-tar: Arbitrary file overwrite and symlink...

MAL-2026-4954 Malicious code in @cloudplatform-single-spa/observability (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

PT-2026-44580

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended versions prior to 0.9.2.6 Description The plugin is subject to privilege escalation through a validation bypass. The after validate save post function trusts the acf post id POST parameter without authenticatio...

PT-2026-44744

Name of the Vulnerable Software and Affected Versions WP Maps Pro versions prior to 6.1.1 Description An unauthenticated privilege escalation flaw exists due to a temporary access feature intended for support troubleshooting. The wpgmp temp access ajax AJAX action is registered for unauthenticate...

PT-2026-44249

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description An issue exists in the RDMA mana component where the mana destroy wq obj cleanup process in mana ib create qp rss is handled...

PT-2026-44383

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via PO...

MAL-2026-5003 Malicious code in @cloudplatform-single-spa/vpn (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

CVE-2026-44720

creationtimestamp| type| source ---|---|--- 2026-05-27 23:48:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmuozqgbbg2q...

CVE-2026-45083

creationtimestamp| type| source ---|---|--- 2026-05-27 23:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmumewrcwo2c 2026-05-27 23:38:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmuohtjb252p...

CVE-2026-46538

creationtimestamp| type| source ---|---|--- 2026-05-27 22:52:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmulur5st42p...

CVE-2026-46427

creationtimestamp| type| source ---|---|--- 2026-05-27 19:56:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmuc3mlhfr2k...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the output option in server mode. An attacker can create or append to arbitrary files on the host filesystem by sending crafted requests to the REST API, as the file path is taken directly from...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the output option in server mode. An attacker can create or append to arbitrary files on the host filesystem by sending crafted requests to the REST API, as the file path is taken directly from...

WordPress Visualizer: Tables and Charts Manager for WordPress plugin <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Chart Creation and Modification vulnerability discovered by davidfdzmorilla in WordPress Plugin Visualizer versions = 3.11.14...

CVE-2026-45716

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured the default for self-hosted Budibase instances,...

CVE-2026-45089

Dalfox AOSS (CVE-2026-45089) allows unauthenticated arbitrary file creation/append when running in REST server mode. Before v2.13.0, the API accepts attacker-controlled OutputFile, OutputAll, and Debug in model.Options; the logger writes to the attacker-specified path via os.OpenFile with O_APPEN...

CVE-2026-45089 Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated...