58958 matches found
CVE-2026-11982
creationtimestamp| type| source ---|---|--- 2026-06-18 18:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moli5atuno2s...
WordPress STRABL – A checkout solution plugin <= 4.5 - Unauthenticated Arbitrary Webhook Creation vulnerability
Unauthenticated Arbitrary Webhook Creation vulnerability discovered by Teerachai Somprasong in WordPress Plugin STRABL – A checkout solution versions = 4.5...
MAL-2026-6138 Malicious code in randpicker (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 378d07b700aa25d356594d7b1c42db107def3dbd1cce734e4c1c50b411048eb6 When calling the Email function, the code creates a backdoor script and attempts to achieve persistence. The script connects to a Telegram bot and awaits...
CVE-2026-12565
creationtimestamp| type| source ---|---|--- 2026-06-18 17:11:50+00:00| seen| https://gist.github.com/alon710/8812bad8b22fe18c159a9af87742e425...
CVE-2026-12566
creationtimestamp| type| source ---|---|--- 2026-06-18 16:41:21+00:00| seen| https://gist.github.com/alon710/d4f4b73b0a184d9eef118aa0970357bf...
CVE-2026-52673
creationtimestamp| type| source ---|---|--- 2026-06-18 16:31:13+00:00| seen| https://gist.github.com/onehang01/93d233a8aef2fc73294c25db8ca3b424...
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
TL;DR This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header. It was possible to install the Panel = create the first admin user i...
Authorization Bypass Through User-Controlled Key
Overview praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the createissue and update processes. An attacker can manipulate project statistics of another...
GHSA-2FJJ-QQG8-FG7X praisonai-platform: Authorization Bypass Through User-Controlled Key
Summary The issue create and update endpoints in praisonai-platform accept a projectid in the request body and persist it without validating that the project belongs to the URL workspace. A user who is a member of workspace WB and has no access to workspace WA can create issues that reference a...
GHSA-JXCW-QP4H-6JFQ PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...
ALPINE-CVE-2026-42489
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these...
CVE-2026-42489
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these...
CVE-2026-42490
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these...
CVE-2026-8811
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations...
CVE-2026-44942
creationtimestamp| type| source ---|---|--- 2026-06-18 12:14:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moksjaduu422...
CVE-2026-56007
creationtimestamp| type| source ---|---|--- 2026-06-18 12:09:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moksabt2hg2l...
CVE-2026-8811
creationtimestamp| type| source ---|---|--- 2026-06-18 12:04:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokrxde2si2f...
CVE-2026-55744
creationtimestamp| type| source ---|---|--- 2026-06-18 08:38:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokggxn5qs27...
Replay Attack
Spring Web Services is vulnerable to Replay Attack. The vulnerability is due to Wss4jSecurityInterceptor not consistently applying Apache WSS4J ReplayCache instances during inbound WS-Security validation. As a result, replay protection for UsernameToken nonces, creation timestamps, Timestamp...