GHSA-88QP-P4QG-RQM6

creationtimestamp| type| source ---|---|--- 2026-02-19 20:40:40+00:00| seen| https://gist.github.com/alon710/7f0b026aa3cc9fd728c23b8682ac26d2...

GHSA-34P4-7W83-35G2 Formwork Improperly Managed Privileges in User creation

Summary The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an...

Formwork Improperly Managed Privileges in User creation

Summary The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an...

GHSA-FH3F-Q9QW-93J9

creationtimestamp| type| source ---|---|--- 2026-02-19 20:10:40+00:00| seen| https://gist.github.com/alon710/85b1f7a719954f294f29981a82d63310...

CVE-2026-23608 GFI MailEssentials AI < 22.4 Email Management Mail Monitoring Rule Stored XSS

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint. An authenticated user can supply HTML/JavaScript in the JSON "name" field to /MailEssentials/pages/MailSecurity/MailMonitoring.aspx/Save, which is stored...

CVE-2026-23606 GFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSS

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation workflow. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$txtRuleName parameter to...

CVE-2026-23606 GFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSS

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation workflow. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$txtRuleName parameter to...

CVE-2026-23605 GFI MailEssentials AI < 22.4 Attachment Filtering Rule Stored XSS

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation workflow. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$TXBRuleName parameter to...

CVE-2026-23605

GFI MailEssentials AI (before 22.4) contains a stored XSS in the Attachment Filtering rule creation workflow. An authenticated user can inject HTML/JavaScript into the ctl00$ContentPlaceHolder1$pv1$TXB_RuleName parameter of /MailEssentials/pages/MailSecurity/attachmentchecking.aspx. The input is ...

CVE-2026-23604

GFI MailEssentials AI versions prior to 22.4 are affected by a stored cross-site scripting (XSS) vulnerability in the Keyword Filtering rule creation workflow. An authenticated user can inject HTML/JavaScript into the ctl00$ContentPlaceHolder1$pv1$TXB_RuleName parameter of the /MailEssentials/pag...

GHSA-9PPG-JX86-FQW7

creationtimestamp| type| source ---|---|--- 2026-02-19 17:10:40+00:00| seen| https://gist.github.com/alon710/7522c30fea1d97914f8cc887eb8aaf04 2026-02-19 17:40:35+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mfa5anzvrs2t 2026-03-06 02:48:42+00:00| seen|...

CVE-2026-25940

creationtimestamp| type| source ---|---|--- 2026-02-19 16:30:19+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mf7zczbkxv2o 2026-02-19 16:30:21+00:00| seen| https://infosec.exchange/users/offseq/statuses/116098244070941374 2026-02-19 16:31:25+00:00| seen|...

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Summary The batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. When either endpoint creates a Project resource, creation of subsequent resources from that same payload belonging in that Project's underlying Kubernetes namespac...

CVE-2026-24834

creationtimestamp| type| source ---|---|--- 2026-02-19 14:17:12+00:00| published-proof-of-concept| https://github.com/kata-containers/kata-containers/security/advisories/GHSA-wwj6-vghv-5p64 2026-02-19 16:10:40+00:00| seen| https://gist.github.com/alon710/190b52f5cf2955da46507c2a49f7b03c 2026-02-1...

CVE-2026-26358

creationtimestamp| type| source ---|---|--- 2026-02-19 10:19:40+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116096786442730361 2026-02-19 10:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116096829417091586 2026-02-19 10:30:33+00:00| seen|...

CVE-2026-1994

creationtimestamp| type| source ---|---|--- 2026-02-19 07:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116096121651199027 2026-02-19 07:30:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mf735tuyvq2n 2026-02-19 16:20:58+00:00| seen|...

CVE-2025-14357

The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setupwidgets function in core/includes/importer/whizzie.php in all versions up to, and including, 5.9. This makes it possible for authenticated attackers, wit...

CVE-2026-2492

creationtimestamp| type| source ---|---|--- 2026-02-19 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-116/...

CVE-2025-14357 Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change

The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setupwidgets function in core/includes/importer/whizzie.php in all versions up to, and including, 5.9. This makes it possible for authenticated attackers, wit...

CVE-2025-14357 Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change

The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setupwidgets function in core/includes/importer/whizzie.php in all versions up to, and including, 5.9. This makes it possible for authenticated attackers, wit...