CVE-2026-77017: Exposure of Sensitive Information to an Unauthorized Actor

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-78285: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

PT-2026-82624

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case...

CVE-2026-81274: Missing Authorization

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

CVE-2026-16996

creationtimestamp| type| source ---|---|--- 2026-08-26 21:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtzc4oc2yq2y...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

Denial Of Service (DoS)

Bouncy Castle is vulnerable to Denial Of Service DoS. The vulnerability is due to an unbounded HSS public-key level count during verification, which allows an attacker to trigger excessive memory allocation and potentially cause a denial-of-service condition...

CVE-2026-80537 xfs: fix off-by-one in rtrefcount btree root level validation

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

GHSA-Q8GF-9RVJ-GMGJ

creationtimestamp| type| source ---|---|--- 2026-08-26 09:31:56+00:00| seen| https://gist.github.com/alon710/6e7bd6a50a933b1a1d184dc7dadb1e0f...

CVE-2026-39191

creationtimestamp| type| source ---|---|--- 2026-08-26 08:09:19+00:00| seen| https://gist.github.com/7h30th3r0n3/0417c90c483638a47c269ca535dfae99...

WordPress Reviews and Rating - Google Reviews plugin <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

WordPress Reviews and Rating - Google Reviews plugin = 5.10 - Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Reviews and Rating – Google My Business versions = 5.10...

CVE-2026-3002

Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin is vulnerable to Stored Cross-Site Scripting in multiple blocks (including animated-text, team, and chart) in all versions up to and including 4.0.2 . The root cause is insufficient input sanitization and output escaping , allow...

CVE-2026-54757

creationtimestamp| type| source ---|---|--- 2026-08-26 04:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtxh2skin32b 2026-08-28 18:35:44+00:00| published-proof-of-concept| https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx...

CVE-2026-65182

creationtimestamp| type| source ---|---|--- 2026-08-26 00:42:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/a2db2ktkirf4d 2026-08-26 12:30:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydl6w76z2k 2026-08-27 16:00:05+00:00| seen|...

CVE-2026-57171

creationtimestamp| type| source ---|---|--- 2026-08-26 00:34:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ar4qbv6h6ay2d 2026-09-24 19:52:34+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-r4vp-3vw6-r2x5 2026-09-25 03:30:32+00:00| seen|...

How Do LLM Agents Actually Get the Flag? Trace-Level Provenance for Agentic Offensive Security Evaluation

Capture-the-Flag CTF benchmarks are widely used to assess the offensive security capabilities of autonomous language-model agents. Evaluations rely on shallow binary judgments or aggregate scores, overlooking the agent's trajectory to the flag. Consequently actual exploitation is conflated with...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

PT-2026-82153

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the root level validation of the rtrefcount btree within the XFS file system. The functions xfs rtrefcountbt verify and xfs iformat rtrefcount incorrectly u...

CVE-2026-2388: Improper Neutralization of Input During Web Page Generation

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...