EUVD-2026-51101

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-54365 CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-16969

creationtimestamp| type| source ---|---|--- 2026-07-30 11:19:57+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrud2b6bws2m 2026-07-30 14:07:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/blcb3neggfspp...

Security update for libarchive

This update for libarchive fixes the following issues: Creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable bsc1254340. File descriptor leak in the mtree parser cleanup path could le...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

Missing Authorization

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

GHSA-WCHH-9X6H-7F6P

creationtimestamp| type| source ---|---|--- 2026-07-30 08:32:07+00:00| seen| https://gist.github.com/alon710/d12f2b2b8a8eb557d027885a6580665a...

CVE-2026-47858

creationtimestamp| type| source ---|---|--- 2026-07-30 06:51:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4pmcheqhxq63y 2026-07-30 16:15:06+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759 2026-08-20 03:00:04+00:00|...

GHSA-PM5P-7W5H-JM5Q

creationtimestamp| type| source ---|---|--- 2026-07-30 06:31:29+00:00| seen| https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

UBUNTU-CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

EUVD-2026-51009

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

WordPress Sync Post With Other Site plugin < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification vulnerability

Contributor+ Arbitrary Page Creation/Modification vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Sync Post With Other Site versions 1.9.3...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin, in versions prior to 1.9.3 , contains an authorization flaw due to an operator-precedence error . This flaw allows authenticated users with limited privileges, such as a Contributor (who only holds post-editing capabilities), to bypass intended rest...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531 Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...