CVE-2026-3640

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permissioncallback of returntrue, which allows all incoming requests...

GHSA-V2WW-5RH7-2H5V

creationtimestamp| type| source ---|---|--- 2026-06-19 08:11:42+00:00| seen| https://gist.github.com/alon710/4cbfed841590889a9a5bb73b59d8bf8b...

CVE-2026-3640

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permissioncallback of returntrue, which allows all incoming requests...

CVE-2026-3640

The STRABL WordPress plugin (versions

CVE-2026-3640 STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permissioncallback of returntrue, which allows all incoming requests...

GHSA-CW4Q-GQG5-G38H

creationtimestamp| type| source ---|---|--- 2026-06-19 06:12:11+00:00| seen| https://gist.github.com/alon710/303180a576c9b715b0944ef26db287db...

CVE-2026-53854

creationtimestamp| type| source ---|---|--- 2026-06-19 04:21:14+00:00| seen| https://gist.github.com/alon710/b45b870bc10a669d4ff8530bce9819db...

CVE-2026-12044

creationtimestamp| type| source ---|---|--- 2026-06-19 03:53:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3momgy6vhd72r 2026-06-19 05:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3momkr5ol5y2u 2026-08-02 08:00:28+00:00| seen|...

GHSA-2JX3-65F3-XR8R

creationtimestamp| type| source ---|---|--- 2026-06-19 02:11:47+00:00| seen| https://gist.github.com/alon710/d087f67b06897a54af2f681ad9224585...

CVE-2026-6716

creationtimestamp| type| source ---|---|--- 2026-06-19 01:44:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom7qsxmdr2m...

CVE-2026-47262

creationtimestamp| type| source ---|---|--- 2026-06-19 01:31:49+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mom72udh7u25 2026-07-01 19:59:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmckxbuhm2m 2026-07-02 10:29:25+00:00| seen|...

CVE-2026-8100

creationtimestamp| type| source ---|---|--- 2026-06-19 01:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom636yl5f2e...

GHSA-3PRJ-6HQW-CM82

creationtimestamp| type| source ---|---|--- 2026-06-19 01:11:33+00:00| seen| https://gist.github.com/alon710/ffff1d4eb6033a732c872d3aa4694b89...

RLSA-2026:26610 Important: xorg-x11-server security, bug fix, and enhancement update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fixes: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution du...

PT-2026-50849

Name of the Vulnerable Software and Affected Versions STRABL – A checkout solution plugin for WordPress versions prior to 4.6 Description The plugin contains a missing authentication flaw in the REST API webhook endpoint "/wp-json/strabl/webhook/order". The endpoint uses a permission callback set...

PT-2026-51058

Name of the Vulnerable Software and Affected Versions containerd versions prior to 2.1.9 containerd versions prior to 2.2.5 containerd versions prior to 2.3.2 Description The CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image...

PT-2026-51122

Name of the Vulnerable Software and Affected Versions Symfony UX Icons affected versions not specified Description The ux icon Twig function is marked as safe for HTML, which prevents Twig from escaping its output. The Icon::toHtml function inlines SVG source code directly into the page. Because...

CVE-2026-49257 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and...

CVE-2026-12407

creationtimestamp| type| source ---|---|--- 2026-06-18 20:37:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3molonccrzh25...

CVE-2026-48983 pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution

pamusb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pamusb uses a check-then-act pattern: it calls lstat to test for existence and then calls mkdir separate...