CVE-2026-13116

CVE-2026-13116 affects the PDF Invoices & Packing Slips for WooCommerce plugin (WordPress) ≤ 5.14.0. Issue: Insecure Direct Object Reference via generate_document_shortcode caused by missing validation on a user-controlled key. Consequence: authenticated attackers with contributor+ access can min...

EUVD-2026-43124

The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...

CVE-2026-3367 Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting

The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...

CVE-2026-3367

The CVE-2026-3367 entry concerns the WordPress plugin Lockme Cal­endars Integration (

CVE-2026-57217

creationtimestamp| type| source ---|---|--- 2026-07-11 02:31:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdmncyj2p2w...

CVE-2026-55881

creationtimestamp| type| source ---|---|--- 2026-07-11 02:30:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdmmtbe2t2x 2026-07-14 04:17:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqldxubalv2i 2026-07-16 08:22:26+00:00| seen|...

CVE-2026-49838 vulnerabilities

Vulnerabilities for packages: cilium-cli, kube-vip...

CVE-2026-57158

creationtimestamp| type| source ---|---|--- 2026-07-11 02:15:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdlqhom4622...

CVE-2026-59217

creationtimestamp| type| source ---|---|--- 2026-07-11 00:34:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg4fw5q22i...

EUVD-2026-43096

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

CVE-2026-44383

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

CVE-2026-55687

creationtimestamp| type| source ---|---|--- 2026-07-10 23:10:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbgh23va2y 2026-07-11 20:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfhbirnbl2k 2026-07-11 20:00:28+00:00| seen|...

CVE-2026-59161

creationtimestamp| type| source ---|---|--- 2026-07-10 22:58:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdaqhoxmm2x 2026-07-10 23:42:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqddaddmyn2e 2026-07-17 11:37:06+00:00| seen|...

CVE-2026-54001

creationtimestamp| type| source ---|---|--- 2026-07-10 22:22:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6q42vrb2z 2026-07-10 23:40:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdd3r4mkg2x...

CVE-2026-8595

creationtimestamp| type| source ---|---|--- 2026-07-10 22:18:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6k6jia32c 2026-07-10 22:49:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdabfyz4f2y 2026-07-11 00:16:40+00:00| seen|...

CVE-2026-58499

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message senderid field was not validated as a path-safe identifier, unlike appid and projectid. During user-memory extraction, senderid i...

CVE-2026-58499 Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message senderid field was not validated as a path-safe identifier, unlike appid and projectid. During user-memory extraction, senderid i...

CVE-2026-58499

EverOS is affected by a path-traversal vulnerability in the POST /api/v1/memory/add ingestion endpoint prior to version 1.0.1. The per-message sender_id was not validated as a path-safe identifier, unlike app_id/project_id, and is used as owner_id to build the filesystem path for persisting extra...

GHSA-V853-W46P-FV2H vulnerabilities

Vulnerabilities for packages: geoserver, apache-tomee...

CVE-2026-55464

creationtimestamp| type| source ---|---|--- 2026-07-10 20:12:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxhgdnd325 2026-07-11 01:12:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdibdxcnr22...