CVE-2026-11392

The CVE-2026-11392 affects the WordPress WP Hotel Booking plugin up to version 2.3.1. It is a Reflected Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping in the check_in_date and check_out_date parameters. This allows unauthenticated attackers to inj...

EUVD-2026-42786

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' and 'checkoutdate' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2026-11392

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' and 'checkoutdate' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2026-11392 WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' and 'checkoutdate' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

GHSA-H74C-Q9J7-MPCM

creationtimestamp| type| source ---|---|--- 2026-07-10 01:12:43+00:00| seen| https://gist.github.com/alon710/c57bf8187a7fb4d8c5e9247f7948a17b...

[SECURITY] Fedora 43 Update: python-pendulum-3.2.0-1.fc43

Unlike other datetime libraries for Python, Pendulum is a drop-in replacement for the standard datetime class it inherits from it, so, basically, you can replace all your datetime instances by DateTime instances in you code. It also removes the notion of naive datetimes: each Pendulum instance is...

GHSA-Q9P7-WQXG-MRHC

creationtimestamp| type| source ---|---|--- 2026-07-10 00:54:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqawqmhsco2b...

CVE-2026-59833

creationtimestamp| type| source ---|---|--- 2026-07-10 00:45:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqawawpeym27...

GHSA-28JH-G32X-V9V4

creationtimestamp| type| source ---|---|--- 2026-07-10 00:42:13+00:00| seen| https://gist.github.com/alon710/5cf8fa01fdabad32641db4fb6525028d...

CVE-2026-59832

creationtimestamp| type| source ---|---|--- 2026-07-10 00:17:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqauoqehek25 2026-07-10 03:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqb5uebh3r25...

GHSA-QCQ2-496W-V96P

creationtimestamp| type| source ---|---|--- 2026-07-10 00:11:47+00:00| seen| https://gist.github.com/alon710/ac77807be35ab79d5b8543a7caac77a2...

Linux Distros Unpatched Vulnerability : CVE-2026-14741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain ...

PT-2026-57259

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation RAG corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced...

PT-2026-57257

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced...

PT-2026-57230

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Webremium Istanbul Web Design Mezunum Satiyorum allows Stored XSS. This issue affects Mezunum Satiyorum: from 1.2.504 through 10072026. NOTE: The vendor was contacted early about this disclosure bu...

PT-2026-60780

Name of the Vulnerable Software and Affected Versions HTTP::Date versions prior to 6.08 Description An issue exists where the parse date function, which is also used by str2time, is susceptible to Regular Expression Denial of Service ReDoS. This occurs because several regex patterns use unbounded...

CVE-2026-33390

creationtimestamp| type| source ---|---|--- 2026-07-09 23:11:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqz5gnqp2i 2026-07-10 17:45:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcpbcku2j2s...

CVE-2026-43515

creationtimestamp| type| source ---|---|--- 2026-07-09 22:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqaq242enr2q 2026-07-13 22:00:23+00:00| seen| https://t.me/GithubRedTeam/89626 2026-07-14 00:00:38+00:00| seen| https://t.me/GithubRedTeam/89626 2026-07-15...

CVE-2026-31982

creationtimestamp| type| source ---|---|--- 2026-07-09 22:31:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaorjqils2e 2026-07-10 17:26:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcoa34a5y2y...

CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST...