GHSA-JM28-2WCR-QF3H

creationtimestamp| type| source ---|---|--- 2026-07-31 09:31:22+00:00| seen| https://gist.github.com/alon710/4da77a0fb37a106d6065c5dabb250f4c...

CVE-2026-51248

creationtimestamp| type| source ---|---|--- 2026-07-31 08:58:36+00:00| seen| https://gist.github.com/programmervuln/e87d48c8a9e36ddf43cc02db54f5151f...

CVE-2026-14921

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-14833

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...

CVE-2026-63223

creationtimestamp| type| source ---|---|--- 2026-07-31 06:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwcngx6kp2e 2026-07-31 07:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/d3wahrnexyoi5 2026-07-31 09:19:42+00:00| seen|...

CVE-2026-14921 Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

EUVD-2026-51418

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-14921

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

GHSA-7683-3W9X-CH42

creationtimestamp| type| source ---|---|--- 2026-07-31 05:31:42+00:00| seen| https://gist.github.com/alon710/14986c8aa9f0de6cc9812b6e85b52624...

CVE-2026-43832

creationtimestamp| type| source ---|---|--- 2026-07-31 05:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrw7fos4ox2e 2026-08-02 20:02:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4rjom5i62b...

CVE-2026-43831

creationtimestamp| type| source ---|---|--- 2026-07-31 05:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrw7c5jmrb2u...

CVE-2026-66410

creationtimestamp| type| source ---|---|--- 2026-07-31 04:45:16+00:00| seen| https://jvn.jp/en/vu/JVNVU92804348...

CVE-2026-57669

creationtimestamp| type| source ---|---|--- 2026-07-31 04:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrw5fetvn42q...

CVE-2026-6890

creationtimestamp| type| source ---|---|--- 2026-07-31 04:14:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/75upzhvzgudry...

CVE-2026-14540

creationtimestamp| type| source ---|---|--- 2026-07-31 03:54:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eimuhra2zjnpt 2026-07-31 12:48:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwygq2jw724 2026-08-01 04:58:43+00:00| seen|...

SUSE CVE-2026-3590

Mattermost versions 10.11.x = 10.11.12, 11.5.x = 11.5.0, 11.4.x = 11.4.2, 11.3.x = 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent...

SUSE CVE-2026-4054

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header e.g. image/png...

GHSA-2956-977X-2W3R

creationtimestamp| type| source ---|---|--- 2026-07-31 00:31:48+00:00| seen| https://gist.github.com/alon710/3970c6098c97c0a550d8b2c18182c3ad...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

CVE-2026-62324: Improper Neutralization of Input During Web Page Generation

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...