CVE-2026-59691

creationtimestamp| type| source ---|---|--- 2026-07-09 12:15:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7menybku26...

CVE-2026-13441

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-42559

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-12516

creationtimestamp| type| source ---|---|--- 2026-07-09 08:10:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76ngzyvh2x 2026-07-09 17:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6jrqqi327...

CVE-2026-47840

creationtimestamp| type| source ---|---|--- 2026-07-09 07:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq75qsv2b42w 2026-07-09 08:41:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7afnzxnt27 2026-07-09 17:37:25+00:00| seen|...

CVE-2026-44934

creationtimestamp| type| source ---|---|--- 2026-07-09 03:28:04+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mq6ov4q7ot2f 2026-07-09 03:28:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6ov5pniv27...

PT-2026-56994

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description The EventSerializer could expose invited group names, sample invitees, and attendan...

PT-2026-56837

Name of the Vulnerable Software and Affected Versions pyload affected versions not specified Description The EventManager module manages Client instances for event subscriptions. When the get events API is called with a unique uuid, a new Client instance is created and added to the clients list...

PT-2026-56829

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.2 through 0.9.x Description An issue exists in the SKILL MENTION RE and strip re regular expressions within the backend/open webui/utils/middleware.py file. These expressions parse skill mentions in the format using...

CVE-2026-56669

creationtimestamp| type| source ---|---|--- 2026-07-08 22:17:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65jzfhdo2e...

CVE-2026-59803

creationtimestamp| type| source ---|---|--- 2026-07-08 22:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq64ouacqi2t 2026-07-09 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59803...

GHSA-37H2-6P4F-MP3Q

creationtimestamp| type| source ---|---|--- 2026-07-08 21:42:03+00:00| seen| https://gist.github.com/alon710/faf458b17f73f7d92e775ebdde2a6b10...

CVE-2026-57480

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

CVE-2026-49866

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...

CVE-2026-57480

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

CVE-2026-49866

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...

CVE-2026-49866

CVE-2026-49866 affects the JavaScript libp2p implementation, specifically the @libp2p/gossipsub component. The root cause is defaultDecodeRpcLimits allowing maxIhaveMessageIDs and maxIwantMessageIDs to be Infinity prior to v16.0.0, enabling oversized IHAVE/IWANT control message arrays in message/...

GHSA-V5PX-423J-PF7P Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Summary Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow into this string without adequate sanitization: - event.headers keys — interpolated verbatim insi...

CVE-2018-3728

creationtimestamp| type| source ---|---|--- 2026-07-08 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5wanheje2f...

CVE-2026-59929

creationtimestamp| type| source ---|---|--- 2026-07-08 20:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5w64e2ij2q 2026-07-20 22:35:21+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2...