27635 matches found
EUVD-2026-42786
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' and 'checkoutdate' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...
CVE-2026-11392
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' and 'checkoutdate' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...
CVE-2026-11392
The CVE-2026-11392 affects the WordPress WP Hotel Booking plugin up to version 2.3.1. It is a Reflected Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping in the check_in_date and check_out_date parameters. This allows unauthenticated attackers to inj...
CVE-2026-11392 WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' and 'checkoutdate' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...
GHSA-H74C-Q9J7-MPCM
creationtimestamp| type| source ---|---|--- 2026-07-10 01:12:43+00:00| seen| https://gist.github.com/alon710/c57bf8187a7fb4d8c5e9247f7948a17b...
[SECURITY] Fedora 43 Update: python-pendulum-3.2.0-1.fc43
Unlike other datetime libraries for Python, Pendulum is a drop-in replacement for the standard datetime class it inherits from it, so, basically, you can replace all your datetime instances by DateTime instances in you code. It also removes the notion of naive datetimes: each Pendulum instance is...
GHSA-Q9P7-WQXG-MRHC
creationtimestamp| type| source ---|---|--- 2026-07-10 00:54:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqawqmhsco2b...
CVE-2026-59833
creationtimestamp| type| source ---|---|--- 2026-07-10 00:45:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqawawpeym27...
GHSA-28JH-G32X-V9V4
creationtimestamp| type| source ---|---|--- 2026-07-10 00:42:13+00:00| seen| https://gist.github.com/alon710/5cf8fa01fdabad32641db4fb6525028d...
CVE-2026-59832
creationtimestamp| type| source ---|---|--- 2026-07-10 00:17:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqauoqehek25 2026-07-10 03:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqb5uebh3r25...
GHSA-QCQ2-496W-V96P
creationtimestamp| type| source ---|---|--- 2026-07-10 00:11:47+00:00| seen| https://gist.github.com/alon710/ac77807be35ab79d5b8543a7caac77a2...
PT-2026-57259
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation RAG corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced...
Linux Distros Unpatched Vulnerability : CVE-2026-14741
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain ...
PT-2026-60780
Name of the Vulnerable Software and Affected Versions HTTP::Date versions prior to 6.08 Description An issue exists where the parse date function, which is also used by str2time, is susceptible to Regular Expression Denial of Service ReDoS. This occurs because several regex patterns use unbounded...
CVE-2026-33390
creationtimestamp| type| source ---|---|--- 2026-07-09 23:11:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqz5gnqp2i 2026-07-10 17:45:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcpbcku2j2s...
CVE-2026-43515
creationtimestamp| type| source ---|---|--- 2026-07-09 22:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqaq242enr2q 2026-07-13 22:00:23+00:00| seen| https://t.me/GithubRedTeam/89626 2026-07-14 00:00:38+00:00| seen| https://t.me/GithubRedTeam/89626 2026-07-15...
CVE-2026-31982
creationtimestamp| type| source ---|---|--- 2026-07-09 22:31:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaorjqils2e 2026-07-10 17:26:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcoa34a5y2y...
CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST...
CVE-2026-58459
creationtimestamp| type| source ---|---|--- 2026-07-09 19:04:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqadagsstr26 2026-07-13 18:29:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd43obcc2x 2026-07-14 21:37:07+00:00| seen|...