CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...

CVE-2026-33382

creationtimestamp| type| source ---|---|--- 2026-07-10 17:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqcmrjabny2r 2026-07-10 22:29:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd75hwwav2i 2026-07-11 00:20:09+00:00| seen|...

CVE-2026-60086

creationtimestamp| type| source ---|---|--- 2026-07-10 16:24:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckqcwydo2z 2026-07-10 20:23:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcy3aa7mh22...

GHSA-CWC9-CP4J-MCVV libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There is no cap on how many IDs a single frame may contain. The default LP frame limit is 4MB, which fits roughly 180,000 message IDs. Iteratin...

EUVD-2026-42409

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays...

CVE-2026-15298

creationtimestamp| type| source ---|---|--- 2026-07-10 14:10:12+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqcdablfyd2v...

CVE-2026-12955

creationtimestamp| type| source ---|---|--- 2026-07-10 12:13:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4oz4s4a2i 2026-07-10 21:13:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2vwd6tv2s...

CVE-2026-13010

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-13010 JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-13010

The CVE-2026-13010 entry concerns the JoomSport plugin for WordPress (Team & League, Football, Hockey & more). Affected versions: all up to and including 5.7.9. Vulnerability type: time-based SQL Injection via the 'event' shortcode attribute, caused by insufficient escaping of the user-supplied p...

CVE-2026-13010

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-42860

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-14342

creationtimestamp| type| source ---|---|--- 2026-07-09 22:36:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqap2iz3s32s...

CVE-2026-12418

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaoymz6fi2d...

CVE-2026-45780

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780

CVE-2026-45780 affects Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The issue arises in EventSerializer, which could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event ...

CVE-2026-45780

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780 Discourse: Private event sample invitees are serialized to non-invited event viewers

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780 Discourse: Private event sample invitees are serialized to non-invited event viewers

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

WordPress Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by PRISM in WordPress Plugin WP Event SOlution versions = 4.1.15...