PT-2026-58940

Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic create activity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...

CVE-2026-11802: Missing Authorization

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration function, accessible via the wpajaxnoprivregistrationaction AJAX action, lacks any nonce verification or capability check, and...

CVE-2026-60118: Missing Authorization

Hi.Events through v1.10.0-beta contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequenti...

PT-2026-85344

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the GET endpoints responsible for team creation and object binding. An attacker can cause unauthorized changes to team membership and permission structures by tricking a logged-in user with...

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

GHSA-PGCC-VFMC-7CW5 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

CVE-2026-55404

creationtimestamp| type| source ---|---|--- 2026-07-13 23:21:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktfz7kmj2d 2026-07-14 08:07:20+00:00| seen| https://gist.github.com/akib-h/a603a4aaf4aab24ac683c30e9a2ad670 2026-07-16 16:25:05+00:00| seen|...

CVE-2026-62195

creationtimestamp| type| source ---|---|--- 2026-07-13 23:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkt4djxzu2i 2026-07-15 09:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqoemwbh6j2f...

CVE-2026-62199

creationtimestamp| type| source ---|---|--- 2026-07-13 22:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrznklv22l 2026-07-15 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqohy7pg2g26...

CVE-2026-62197

creationtimestamp| type| source ---|---|--- 2026-07-13 22:46:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkricfkio2z...

CVE-2026-62185

creationtimestamp| type| source ---|---|--- 2026-07-13 22:44:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrepm4uj2g...

CVE-2026-62192

creationtimestamp| type| source ---|---|--- 2026-07-13 22:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrbdxlxy2t...

CVE-2026-15681

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...

CVE-2026-15682

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in orde...

CVE-2026-39259

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:23+00:00| seen| https://t.me/GithubRedTeam/89641 2026-07-14 00:00:38+00:00| seen| https://t.me/GithubRedTeam/89641 2026-07-15 00:00:17+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/89641...

CVE-2026-4253

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:18+00:00| seen| https://t.me/GithubRedTeam/90566 2026-07-14 00:00:34+00:00| seen| https://t.me/GithubRedTeam/90566 2026-07-15 00:00:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/90566 2026-07-16 19:00:31+00:00| seen|...

CVE-2026-36851

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:13+00:00| seen| https://t.me/GithubRedTeam/91767 2026-07-14 00:00:21+00:00| seen| https://t.me/GithubRedTeam/91767 2026-07-15 00:00:28+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/91767 2026-07-16 19:00:22+00:00| seen|...

GHSA-CM8G-8JFQ-887P

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:07+00:00| seen| https://t.me/GithubRedTeam/92588 2026-07-14 00:00:10+00:00| seen| https://t.me/GithubRedTeam/92588 2026-07-15 00:00:33+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/92588 2026-07-16 19:00:16+00:00| seen|...

CVE-2026-50980

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:05+00:00| seen| https://t.me/GithubRedTeam/92792 2026-07-14 00:00:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/92792 2026-07-16 19:00:13+00:00| seen| Telegram/t092y5BgJmODHc3D2a3Ra4fTCXsa-vHp4gQ4JjPUYAbfUJ0 2026-07-1...