CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-9169 LUCID Vision Labs: DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

GHSA-PMHH-3W7G-XQP8

creationtimestamp| type| source ---|---|--- 2026-08-07 08:33:25+00:00| seen| https://gist.github.com/alon710/b4340b7774927252fafb9cfdb5e51a49...

CVE-2026-17505

creationtimestamp| type| source ---|---|--- 2026-08-07 06:03:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-17505.yaml 2026-08-08 00:02:14+00:00| confirmed|...

CVE-2026-15386 Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor includi...

CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

CVE-2026-14331

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2022-24355 — Updated!

CVE-2022-24355 Tplink wr841 v10 rce exploit without authorisation ⚠️ Disclaimer The code in this repository is provided as-is for educational and defensive security research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any...

CVE-2026-49163

creationtimestamp| type| source ---|---|--- 2026-08-07 05:00:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mshrkg7rfy2g 2026-08-07 15:12:52+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117054869893780449 2026-08-11 19:00:39+00:00| seen|...

CVE-2026-70559

creationtimestamp| type| source ---|---|--- 2026-08-07 05:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96974 2026-08-07 10:15:04+00:00| published-proof-of-concept| Telegram/WS6QG7O3daDhEGVi670FSZbAHcCdG6YEmYMAs3H7lOdyiY 2026-08-07 16:02:15+00:00| seen|...

GHSA-HMQG-CXWW-WQHQ

creationtimestamp| type| source ---|---|--- 2026-08-07 04:31:19+00:00| seen| https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930...

CVE-2026-19149

creationtimestamp| type| source ---|---|--- 2026-08-07 02:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mshkmnjejr2z 2026-08-07 04:46:06+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:46:45+00:00| seen|...

OESA-2026-3280 kronosnet security update

The kronosnet source Security Fixes: A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw...

GHSA-RVMM-V933-JGXQ

creationtimestamp| type| source ---|---|--- 2026-08-07 01:35:03+00:00| seen| https://gist.github.com/alon710/44b00a029eb5e56bac1f996f02574592...

CVE-2026-5857

creationtimestamp| type| source ---|---|--- 2026-08-07 00:37:02+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mshctz6ra52l 2026-08-10 02:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msoywprfwe23...

GHSA-596P-6JV8-775V

creationtimestamp| type| source ---|---|--- 2026-08-07 00:33:31+00:00| seen| https://gist.github.com/alon710/c7b44a1ea6b80e7066b89d9f2735b13f...

CVE-2026-70638

creationtimestamp| type| source ---|---|--- 2026-08-07 00:13:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ciicqoidlqxgn 2026-08-08 23:32:42+00:00| seen| Telegram/m7tRmG3nQSXvUZW6DMLMvOpR9GoJzg-MAOp80VZqy5JWD8 2026-08-09 00:05:53+00:00| published-proof-of-concept|...

CVE-2025-71413: Improper Check for Unusual or Exceptional Conditions

Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency...