PT-2026-36856

Name of the Vulnerable Software and Affected Versions PPTAgent versions prior to commit 418491a Description An agentic framework for reflective PowerPoint generation allows arbitrary file write and directory creation through the markdown table to image function. Recommendations Update to commit...

PT-2026-36843

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

Apache Polaris 输入验证错误漏洞

Apache Polaris is a data management and query service component of the Apache Foundation. Apache Polaris has a vulnerability related to input validation. This vulnerability arises from the lack of verification or proper retention of valid table locations during the creation of phase tables,...

EUVD-2026-27001

wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...

PT-2026-36832

wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...

CVE-2026-38669

wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...

CVE-2026-38669

wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...

PT-2026-37052

Name of the Vulnerable Software and Affected Versions apko versions 0.14.8 through 1.2.4 Description A crafted .apk file can install a TypeSymlink tar entry with a target pointing outside the build root. Subsequent directory-creation or file-write entries in the same or later archive can traverse...

PPTAgent 路径遍历漏洞

PPTAgent is an open-source intelligent presentation generation tool based on large models developed by ICIP-CAS. Previous versions of PPTAgent, such as 418491a, contained a path traversal vulnerability. This vulnerability stemmed from issues with the markdowntabletoimage function, which could lea...

WCMS 跨站脚本漏洞

WCMS is a content management system CMS developed by Vedegis for individual users. Version wCMS v.1.4 has a cross-site scripting vulnerability, which stems from cross-site scripting attacks when creating new blogs...

CVE-2026-40776

creationtimestamp| type| source ---|---|--- 2026-05-03 23:00:13+00:00| seen| Telegram/zMIGDiZKcsuCchc0aPmk0dRYccv5m6M1w-Y-ifos8swuOP4 2026-05-04 03:00:05+00:00| seen| Telegram/xOE6u0S4AhmTrHPBDYscPzMv6FpE3fbyPNbn5dJYZfuDoSw 2026-05-06 23:00:13+00:00| seen|...

CVE-2026-7704

creationtimestamp| type| source ---|---|--- 2026-05-03 20:31:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkxyu2d77q2r...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940-POC cPanel/WHM Authentication Bypass Proof of...

CVE-2026-5299

creationtimestamp| type| source ---|---|--- 2026-05-03 10:37:15+00:00| seen| https://t.me/itarmyofrussianews/379...

CVE-2026-44337

creationtimestamp| type| source ---|---|--- 2026-05-03 05:26:18+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3643-7v76-5cj2 2026-05-08 17:42:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlebpa6xin2k...

CVE-2026-7671

creationtimestamp| type| source ---|---|--- 2026-05-02 21:00:04+00:00| seen| Telegram/FLV6t7Va3cw7z9NmSu7nucQbg4vUfz1QpezNhFqmTOM...

CVE-2026-4100

The CVE concerns the Paid Memberships Pro plugin for WordPress, affecting all versions up to 3.6.5. The root cause is missing capability checks on three AJAX handlers: wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook. This allows a...

CVE-2026-4100 Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the wpajaxpmprostripecreatewebhook, wpajaxpmprostripedeletewebhook, and...

EUVD-2026-26782

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the wpajaxpmprostripecreatewebhook, wpajaxpmprostripedeletewebhook, and...

SUSE CVE-2026-31713

In the Linux kernel, the following vulnerability has been resolved: fuse: abort on fatal signal during sync init When sync init is used and the server exits for some reason error, crash while processing FUSEINIT, the filesystem creation will hang. The reason is that while all other threads will...