EUVD-2026-1243

EUVD-2026-1243...

CVE-1999-0063

Cisco IOS 12.0 and other versions can be crashed by malicious UDP packets to the syslog port...

CVE-1999-0637

The systat service is running...

CVE-2019-12121

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected...

CVE-2019-12743

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits including self-hosted ones by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure...

EUVD-2026-1347

The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTPXFORWARDEDFOR to determine the client's IP address without proper validation or considering if the server is...

CVE-2025-1908

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

EUVD-2026-1350

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ualshookwploginfailed' lacks a capability check and writes failed usernames directly into updateoption calls. This makes it possible for unauthenticated attacker...

EUVD-2026-1284

The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kffieldfiguredefaultcolorrender function in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-15079

creationtimestamp| type| source ---|---|--- 2026-01-07 06:48:21+00:00| seen| https://seclists.org/oss-sec/2026/q1/35 2026-01-07 07:51:28+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/115852724607348302 2026-01-07 08:21:38+00:00| seen|...

EUVD-2026-1274

The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only...

CVE-2025-15471

creationtimestamp| type| source ---|---|--- 2026-01-06 21:54:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115850377807051367 2026-01-07 02:04:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbsev2vuft2u 2026-01-07 03:01:30+00:00| seen|...

GHSA-GG4X-FGG2-H9W9

creationtimestamp| type| source ---|---|--- 2026-01-06 19:51:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849892053733021 2026-01-24 21:30:31+00:00| seen| https://gist.github.com/alon710/ecdbc01c3c96ce665a77ba8b31b2fc40 2026-01-24 21:30:33+00:00| seen|...

EUVD-2026-0952

Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSS Feed Widget: from n/a through = 3.0.2...

EUVD-2026-1014

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e-plugins JobBank allows Reflected XSS.This issue affects JobBank: from n/a through 1.2.2...

CVE-2020-36916

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 17:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbri2npaq62g 2026-01-07 21:03:10+00:00| seen|...

CVE-2020-36920

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 17:23:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrhrp7hkx22 2026-01-07 21:03:12+00:00| seen|...

EUVD-2026-1030

Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption...

How to Avoid Phishing Incidents in 2026: A CISO Guide

Phishing in 2026 is harder to detect and verify. Learn how CISOs can speed up investigations, reduce noise, and respond with confidence...

EUVD-2026-1061

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘islinking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...