CVE-2026-24431

creationtimestamp| type| source ---|---|--- 2026-01-26 19:31:44+00:00| seen| Telegram/NDMU8ynM5NBGoQ-dfQqZ42TSll7FDRAaTneXDBoOWPxOFo 2026-01-26 19:31:53+00:00| seen| Telegram/Ft8Tdl8Bw6eAk2e1pAEkH4ZR5l3Iv8W273PssTBQZEV2KvA...

CVE-2026-22709

creationtimestamp| type| source ---|---|--- 2026-01-26 19:10:38+00:00| seen| https://gist.github.com/alon710/1a9dd02522093ff2ceb805cf35c0f14f 2026-01-26 22:34:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdechvpf7f2g 2026-01-27 01:25:49+00:00| seen|...

CVE-2026-24433

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users...

CVE-2026-24433

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users...

CVE-2026-24433 Tenda W30E V2 Stored XSS via Username Field

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users...

CVE-2026-24433

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users...

CVE-2026-21509

creationtimestamp| type| source ---|---|--- 2026-01-26 17:40:52+00:00| seen| https://bsky.app/profile/dustinchilds.bsky.social/post/3mdds2s6f7c2j 2026-01-26 18:18:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mddu5zx7rs23 2026-01-26 18:32:41+00:00| seen|...

CVE-2020-36952

creationtimestamp| type| source ---|---|--- 2026-01-26 17:19:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mddquvbtou2m...

CVE-2025-69559

creationtimestamp| type| source ---|---|--- 2026-01-26 16:58:49+00:00| seen| https://gist.github.com/lih28984-commits/cd3a275dfd9c92a79b6a4a0e8801f4fa...

CVE-2025-69558

creationtimestamp| type| source ---|---|--- 2026-01-26 16:51:41+00:00| seen| https://gist.github.com/lih28984-commits/db0d866d792e83ec5be0674ab43e7b18...

CVE-2026-24056

creationtimestamp| type| source ---|---|--- 2026-01-26 15:43:05+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-m733-5w8f-5ggw 2026-01-27 01:21:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdelrufrxa2j...

CVE-2022-25369

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have...

BIT-SOLR-2026-22444 Apache Solr: Insufficient file-access checking in standalone core-creation requests

The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting...

BIT-CROSSPLANE-2023-37900 Crossplane vulnerable to denial of service from large image

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting i...

CVE-2016-15057

creationtimestamp| type| source ---|---|--- 2026-01-26 13:19:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdddhes64z2h 2026-01-26 15:49:29+00:00| seen| https://seclists.org/oss-sec/2026/q1/116 2026-01-26 17:31:30+00:00| seen|...

CVE-2025-59101

creationtimestamp| type| source ---|---|--- 2026-01-26 11:19:54+00:00| seen| Telegram/6yOZgNXwTf-n5fOlfg6wU2LSzQ1UiGQXBKx-ykvyN9Z3Kh8...

CVE-2025-59090 Unauthenticated SOAP API in dormakaba Kaba exos 9300

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled...

CVE-2025-59090

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled...

CVE-2026-1422

creationtimestamp| type| source ---|---|--- 2026-01-26 09:53:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdcxxht5oj2i...

CVE-2026-1429

creationtimestamp| type| source ---|---|--- 2026-01-26 07:33:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10655-59160-2.html 2026-01-26 09:38:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdcx4mgztz2j...