EulerOS Virtualization 2.12.0 : python-virtualenv (EulerOS-SA-2026-2113)

According to the versions of the python-virtualenv package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...

Exploit for CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python proof of concept for CVE-20...

CVE-2026-25623

creationtimestamp| type| source ---|---|--- 2026-06-05 20:48:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkz6zg3ke27...

CVE-2026-10580

creationtimestamp| type| source ---|---|--- 2026-06-05 20:01:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwkmd32g2p 2026-06-06 00:00:12+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnldv3nnpv2c 2026-06-06 21:00:04+00:00| published-proof-of-concept|...

CVE-2026-46389

creationtimestamp| type| source ---|---|--- 2026-06-05 20:01:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwkeya5p2k 2026-06-15 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moe3jinbbf2e 2026-06-22 00:36:43+00:00| seen|...

CVE-2026-5411

creationtimestamp| type| source ---|---|--- 2026-06-05 20:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwitip3v2b 2026-06-06 00:00:14+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnldv57rk32f 2026-06-14 23:16:10+00:00| seen|...

CVE-2025-66171

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the...

CVE-2026-38669

wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...

CVE-2026-36341

Cross-Site Scripting XSS vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint...

CVE-2026-6598

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsetting...

CVE-2026-45750

creationtimestamp| type| source ---|---|--- 2026-06-05 19:46:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkvpixkry26 2026-06-05 20:01:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwktpurz2b 2026-06-07 02:09:27+00:00| seen|...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

CVE-2026-2379

creationtimestamp| type| source ---|---|--- 2026-06-05 19:42:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkvhtescw26...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2025-40902

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags. When a victim attempts to delete a group containing...

CVE-2026-34722

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4...

CVE-2026-47741

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-23752

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can...