CVE-2025-67919

creationtimestamp| type| source ---|---|--- 2026-01-08 10:59:25+00:00| seen| https://gist.github.com/Darkcrai86/1ae580200e97bb963012f305f8abb336 2026-01-08 17:05:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbwhpxrw5t2p 2026-01-08 17:14:13+00:00| seen|...

EUVD-2026-1582

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host...

EUVD-2026-1577

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webaware NextGEN Download Gallery nextgen-download-gallery allows Retrieve Embedded Sensitive Data.This issue affects NextGEN Download Gallery: from n/a through = 1.6.2...

EUVD-2026-1430

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in zozothemes Corpkit corpkit allows PHP Local File Inclusion.This issue affects Corpkit: from n/a through = 2.0...

EUVD-2026-1537

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in brandexponents Oshine oshin allows PHP Local File Inclusion.This issue affects Oshine: from n/a through = 7.2.7...

CVE-2026-21883

creationtimestamp| type| source ---|---|--- 2026-01-08 02:38:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbuxagdnzk2q 2026-01-24 21:30:26+00:00| seen| https://gist.github.com/alon710/1a8cdfc9ee48e8684ff81a0e3d627083...

EUVD-2026-1502

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.installpackage RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands wi...

CVE-2017-20216

creationtimestamp| type| source ---|---|--- 2026-01-07 23:26:03+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115856399563013611 2026-01-08 01:55:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbuuubwihd2m 2026-01-08 21:03:02+00:00| seen|...

GHSA-38JV-5279-WG99

creationtimestamp| type| source ---|---|--- 2026-01-07 22:20:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115856142351388778 2026-01-07 23:09:50+00:00| seen| Telegram/Hv7piurWFmTJB7c7iHri9T0M-meMIfk5qPkk7ikOJpSuKtA 2026-01-24 21:26:41+00:00| seen|...

CVE-2025-13151

creationtimestamp| type| source ---|---|--- 2026-01-07 21:34:44+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115855961867696249 2026-01-07 22:51:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbukljqwrf2v 2026-01-07 23:09:29+00:00| seen|...

CVE-2025-69139

creationtimestamp| type| source ---|---|--- 2026-01-07 20:05:49+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115855612215838975...

EUVD-2026-1211

An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service...

EUVD-2026-1243

EUVD-2026-1243...

CVE-1999-0063

Cisco IOS 12.0 and other versions can be crashed by malicious UDP packets to the syslog port...

CVE-1999-0637

The systat service is running...

CVE-2019-12121

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected...

CVE-2019-12743

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits including self-hosted ones by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure...

EUVD-2026-1347

The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTPXFORWARDEDFOR to determine the client's IP address without proper validation or considering if the server is...

CVE-2025-1908

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

EUVD-2026-1350

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ualshookwploginfailed' lacks a capability check and writes failed usernames directly into updateoption calls. This makes it possible for unauthenticated attacker...