CVE-2026-48528

CVE-2026-48528 affects Metacat versions 2.0.0–3.4.0 and describes an unauthenticated SQL injection in the /cn/v1/object and /cn/v2/object REST endpoints due to unsanitized nodeId input. The backend SQL queries concatenate user input, enabling arbitrary data extraction from PostgreSQL and potentia...

EUVD-2026-58740

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2017-17663

creationtimestamp| type| source ---|---|--- 2026-08-14 16:00:11+00:00| seen| https://t.me/purpsec/810 2026-08-15 00:00:12+00:00| seen| https://t.me/purpsec/810...

VulnScope

VulnScope POC Proof of Concept Vulnerability Verificati...

GO-2026-5529 vulnerabilities

Vulnerabilities for packages: dgraph...

GO-2026-6006 vulnerabilities

Vulnerabilities for packages: datadog-agent, tigera-operator-fips, datadog-agent-fips, gitlab-operator-fips, gitlab-operator, tigera-operator...

GO-2024-3072 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips, hubble...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: prometheus-podman-exporter, cadvisor, nvidia-container-toolkit-fips, node-feature-discovery, sriov-network-device-plugin-fips, buildah-fips, podman-fips, gpu-operator, nvidia-container-toolkit, k8s-device-plugin-fips, falco-no-driver, rancher,...

GO-2025-4098 vulnerabilities

Vulnerabilities for packages: grype-fips, skaffold, blob-csi-fips, node-feature-discovery, longhorn-share-manager, datadog-agent, newrelic-infrastructure-agent, amazon-k8s-cni-fips, kube-conformance, kubernetes-csi-driver-nfs, virt-launcher, xeol, mesosphere-vsphere-csi, kubescape,...

GO-2026-4602 vulnerabilities

Vulnerabilities for packages: karpenter-fips, kubernetes-dashboard-auth-fips, cephcsi, memcached-exporter, gogatekeeper, terragrunt, minify, nsc-fips, wuzz, grafana-mimir, teleport-operator-fips, request-1279, crossplane-provider-aws-cloudformation, yace, aws-network-policy-agent-fips,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: dex, terragrunt, fulcio, flux-kustomize-controller, timestamp-authority-fips, aactl, bank-vaults-fips, cloudflared, cosign, tkn, sops, spire-server, oauth2-proxy, tekton-chains, falcoctl-fips, fulcio-fips, cosign-fips, spire-server-fips, kubescape,...

GO-2022-0452 vulnerabilities

Vulnerabilities for packages: podman, ctop...

GO-2026-4868 vulnerabilities

Vulnerabilities for packages: buf, blobfuse2, renovate, cadvisor, telegraf, dgraph, gofumpt, nri-mssql, kubernetes-csi-external-attacher, redka, knative-eventing, pvc-autoresizer, http-echo, apisix-ingress-controller, tkn, spire-server, argo-rollouts, gitlab-pages, hey,...

GO-2025-4240 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, aws-efs-csi-driver, emissary, ip-masq-agent, argo-rollouts, mesosphere-vsphere-csi, rancher-agent, rancher, blob-csi, node-feature-discovery, kubernetes, vcluster, kubernetes-csi-driver-hostpath, docker-machine-driver-harvester, kapp,...

GO-2024-2609 vulnerabilities

Vulnerabilities for packages: controller-gen, kpt, paranoia, gitness, pombump, kubebuilder, nri-rabbitmq, cluster-proportional-autoscaler, dockerize, k3d, bazelisk, nri-nginx, cass-operator, sbom-scorecard, timoni, docker-credential-gcr, nri-mysql, src-fingerprint, buildkitd, capslock, k3s,...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...