CVE-2026-11866

creationtimestamp| type| source ---|---|--- 2026-07-16 07:52:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqwv3udz2h...

CVE-2026-12492

creationtimestamp| type| source ---|---|--- 2026-07-16 07:47:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqobblln2c 2026-07-16 16:40:30+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrofv6bjr2j...

CVE-2026-12906

creationtimestamp| type| source ---|---|--- 2026-07-16 07:45:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqkgc65d22...

CVE-2026-53366

creationtimestamp| type| source ---|---|--- 2026-07-16 07:43:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqgthqbh2s 2026-07-16 17:31:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116930842680877521 2026-07-20 17:28:37+00:00| seen|...

CVE-2026-12492

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

CVE-2026-15925

creationtimestamp| type| source ---|---|--- 2026-07-16 06:45:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqn5t5xvw2i 2026-07-16 07:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqqph67fpj2c 2026-07-17 16:15:54+00:00| seen|...

CVE-2026-12492 Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

CVE-2026-12492

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

CVE-2026-58317

creationtimestamp| type| source ---|---|--- 2026-07-16 04:45:03+00:00| seen| https://jvn.jp/en/jp/JVN65294474 2026-07-17 11:44:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtoero3vu2u...

CVE-2026-14987

creationtimestamp| type| source ---|---|--- 2026-07-16 03:56:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqdqdmvsl2u...

CVE-2026-21729

creationtimestamp| type| source ---|---|--- 2026-07-16 03:44:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqd3lprw32a...

CVE-2026-20298

creationtimestamp| type| source ---|---|--- 2026-07-16 02:11:53+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqq5vdvydd2i 2026-07-16 19:00:32+00:00| seen| https://t.me/truesecator/8417 2026-07-17 00:00:49+00:00| seen| https://t.me/truesecator/8417 2026-08-21...

[SECURITY] Fedora 43 Update: perl-Imager-1.033-1.fc43

Imager is a module for creating and altering images. It can read and write various image formats, draw primitive shapes like lines,and polygons, blend multiple images together in various ways, scale, crop, render text and more...

Command Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Command Injection in the createmcpclient function, which passes a user-supplied command value into StdioServerParameters and executes it as a subprocess on the proxy host...

PT-2026-60496

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND RESULTS handler in ufo/server/ws/handler.py called get or create session in ufo/server/services/session manager.py without owner client id, allowing an authenticated client to...

PT-2026-61613

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.5 Description Issues in the Cluster Distributed API DAPI handling allow a cluster peer or any actor authenticated to the cluster channel using the shared cluster key to force the master node to deserialize and...

CVE-2024-58360: Improper Use of Validation Framework

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

CVE-2026-12492: Improper Authentication

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

CVE-2026-63087: Missing Authentication for Critical Function

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...