CVE-2026-32991

creationtimestamp| type| source ---|---|--- 2026-05-14 02:46:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrsgkjgte2e 2026-05-20 06:20:46+00:00| seen| https://www.acn.gov.it/portale/w/cpanel-whm-e-wp-squared-poc-pubblico-per-lo-sfruttamento-della-cve-2026-29205...

CVE-2026-45138

creationtimestamp| type| source ---|---|--- 2026-05-14 01:57:30+00:00| published-proof-of-concept| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-2m69-jmvh-6chr 2026-07-20 01:55:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr26t62ufj2e...

CVE-2026-45053

creationtimestamp| type| source ---|---|--- 2026-05-14 01:00:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrmkdeov42p...

CVE-2026-44380

creationtimestamp| type| source ---|---|--- 2026-05-14 00:13:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrjvangu42k...

PT-2026-41155

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.0 Description The password reset flow in the resetRequest route of the modules/@apostrophecms/login/index.js component constructs the reset URL using req.hostname. When apos.baseUrl is not explicitly...

PostgreSQL 安全漏洞

PostgreSQL is a set of free object-relational database management systems developed by the PostgreSQL organization. This system supports most SQL standards and offers many other features, such as foreign keys, triggers, views, etc. Vulnerabilities existed in versions prior to PostgreSQL 18.4,...

Medium: amazon-ecr-credential-helper

Issue Overview: Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler cmd/compile. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption in programs compiled with...

PT-2026-41146

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.2.1 Description The render toc ul function builds a table-of-contents tree from a list of tuples. The id value, used for the href attribute, and the text value, used as the link label, are inserted into tags using a...

PT-2026-40867

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.10 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2 Description Missing Cross-Site Request Forgery CSRF protection—a flaw where an attacker tricks a victim into...

CVE-2025-27852

The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a reflected cross site scripting XSS attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is...

CVE-2026-45055

CubeCart pre-authenticated password reset link poisoning via HTTP Host header (affecting 6.6.x–6.7.1) allows an unauthenticated attacker to cause password-reset tokens to be sent to a victim with a malicious domain (evil.com). Builds CC_STORE_URL from Host header without allowlist, embedding the ...

CVE-2026-45055 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CCSTOREURL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in...

CVE-2026-45055 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CCSTOREURL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in...

CVE-2026-8344

A weakness has been identified in D-Link DIR-816 1.10CNB05R1B011D88210. Affected by this vulnerability is the function sub445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

CVE-2026-42556

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/?share=true to another user. The preview page...

CVE-2026-34341

Double free in Windows Link-Layer Discovery Protocol LLDP allows an authorized attacker to elevate privileges locally...

CVE-2026-34648

creationtimestamp| type| source ---|---|--- 2026-05-13 20:22:12+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlr4y3gfhm25...

CVE-2026-34647

creationtimestamp| type| source ---|---|--- 2026-05-13 20:22:12+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlr4y2lind2e...

MAL-2026-3697 Malicious code in syntaxlogger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebc8a65895fc09c10b6e6bf23926076ec575582e80e084616e6779b091df947d When using the provided functionality, code silently downloads archives with executables to a location excluded from A scanning, and then executes them. The...

Malicious code in syntaxlogger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebc8a65895fc09c10b6e6bf23926076ec575582e80e084616e6779b091df947d When using the provided functionality, code silently downloads archives with executables to a location excluded from A scanning, and then executes them. The...