CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

CVE-2026-59866

creationtimestamp| type| source ---|---|--- 2026-07-16 15:54:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrluxqhxd2c 2026-07-16 16:50:14+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqroxp5a7c2p...

EUVD-2026-44947

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMANDRESULTS handler in ufo/server/ws/handler.py called getorcreatesession in ufo/server/services/sessionmanager.py without ownerclientid, allowing an authenticated client to create ...

CVE-2026-35147

creationtimestamp| type| source ---|---|--- 2026-07-16 15:05:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrj54hrth22 2026-07-22 11:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mra6lx5u262s...

CVE-2026-5674

creationtimestamp| type| source ---|---|--- 2026-07-16 14:14:25+00:00| seen| https://bsky.app/profile/suriq.io/post/3mqrgbdys5a2o 2026-07-16 14:25:45+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116930114006202187 2026-07-16 14:49:42+00:00| seen|...

CVE-2016-5192

creationtimestamp| type| source ---|---|--- 2026-07-16 14:00:05+00:00| seen| https://t.me/KaitNews/312 2026-07-17 00:00:51+00:00| seen| https://t.me/KaitNews/312...

CVE-2026-63306

creationtimestamp| type| source ---|---|--- 2026-07-16 13:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrel5f6pq2l 2026-07-16 14:54:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrijfgqcq2h...

CVE-2024-58360

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

CVE-2026-30623

A flaw was found in LiteLLM. This vulnerability allows a remote attacker to execute arbitrary operating system commands on the host where LiteLLM is running. This is possible because the application's MCP server creation functionality processes JSON configurations that can include unvalidated...

CVE-2026-15916

creationtimestamp| type| source ---|---|--- 2026-07-16 13:05:09+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrcfgib2s2a...

CVE-2026-55805

creationtimestamp| type| source ---|---|--- 2026-07-16 13:05:09+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrcfgib2s2a...

CVE-2016-1453

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:05+00:00| seen| https://t.me/KaitNews/224 2026-07-17 00:00:51+00:00| seen| https://t.me/KaitNews/224...

CVE-2016-5193

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:04+00:00| seen| https://t.me/KaitNews/312 2026-07-17 00:00:51+00:00| seen| https://t.me/KaitNews/312...

CVE-2007-5693

creationtimestamp| type| source ---|---|--- 2026-07-16 12:15:03+00:00| seen| MISP/c6bff539-f10a-42a7-bc8e-83795d457e7a...

CVE-2026-13741

creationtimestamp| type| source ---|---|--- 2026-07-16 10:40:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqr2civkdq2x 2026-07-16 12:00:11+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqr6rcvmum27...

CVE-2023-49900

creationtimestamp| type| source ---|---|--- 2026-07-16 10:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqqztryhh52d 2026-07-16 10:47:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqr2p73vnu2i...

CVE-2026-57709

creationtimestamp| type| source ---|---|--- 2026-07-16 08:16:26+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqsba2n3x2p...

WordPress GEO Plugin by Squirrly SEO plugin <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting vulnerability

Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.0.0...

CVE-2026-11866

creationtimestamp| type| source ---|---|--- 2026-07-16 07:52:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqwv3udz2h...

CVE-2026-12492

creationtimestamp| type| source ---|---|--- 2026-07-16 07:47:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqobblln2c 2026-07-16 16:40:30+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrofv6bjr2j...