GHSA-PJWM-PJ3P-43MV

creationtimestamp| type| source ---|---|--- 2026-05-29 21:20:01+00:00| seen| https://gist.github.com/konard/e2cdc40115fd7e81d8828ab9496865a2...

CVE-2026-45633

creationtimestamp| type| source ---|---|--- 2026-05-29 20:21:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzefsabjs2g 2026-05-30 04:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mn262srnhk26...

CVE-2026-47744

creationtimestamp| type| source ---|---|--- 2026-05-29 20:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzdburqpr2d...

CVE-2026-49372

creationtimestamp| type| source ---|---|--- 2026-05-29 20:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzd7ww25p2i...

CVE-2026-47741

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...

CVE-2026-10066

creationtimestamp| type| source ---|---|--- 2026-05-29 18:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmz4jl542s27...

CVE-2026-49316

creationtimestamp| type| source ---|---|--- 2026-05-29 17:20:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmz2coquwy2x...

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

Summary filepath.Base on the Linux container does not strip backslashes , because \ is only a path separator on Windows. A multipart filename like ........\Windows\System32\evil.pdf survives Gotenberg's input sanitisation and lands verbatim as the zip entry name when a multi-output route...

CVE-2026-9509

creationtimestamp| type| source ---|---|--- 2026-05-29 15:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyvkahgvy27...

CVE-2026-45043

creationtimestamp| type| source ---|---|--- 2026-05-29 15:44:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyuvh4hpj2j...

EUVD-2018-21919

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST...

CVE-2018-25397

PHP-SHOP 1.0 is affected by a cross-site request forgery in the users.php endpoint. An unauthenticated attacker can craft a page with a hidden form that automatically POSTs parameters (name, email, password, permissions) to create an admin account, by convincing an authenticated administrator to ...

CVE-2018-25397 PHP-SHOP 1.0 Cross-Site Request Forgery via users.php

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST...

CVE-2026-49094

creationtimestamp| type| source ---|---|--- 2026-05-29 14:45:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmyrmbdqgh2a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Projects component when displaying project tags and popovers in administrative detail views due to improper sanitization of user-supplied project names. An attacker can execute arbitrary scripts in the...

CVE-2025-41272

creationtimestamp| type| source ---|---|--- 2026-05-29 13:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylqp4ykq2t 2026-06-22 07:01:35+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3moucvbux762v...

CVE-2025-41267

creationtimestamp| type| source ---|---|--- 2026-05-29 12:58:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylnj34qv2e...

CVE-2026-9558

creationtimestamp| type| source ---|---|--- 2026-05-29 12:05:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyio2hges2e 2026-05-31 01:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mn4ehkhlmf2h 2026-07-03 21:52:04+00:00| seen|...

CVE-2026-49197

creationtimestamp| type| source ---|---|--- 2026-05-29 11:45:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyhlin4q322 2026-06-22 06:31:54+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mouba73wwj22...

OESA-2026-2479 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...