CVE-2026-45055

CubeCart pre-authenticated password reset link poisoning via HTTP Host header (affecting 6.6.x–6.7.1) allows an unauthenticated attacker to cause password-reset tokens to be sent to a victim with a malicious domain (evil.com). Builds CC_STORE_URL from Host header without allowlist, embedding the ...

CVE-2026-45055 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CCSTOREURL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in...

CVE-2026-45055 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CCSTOREURL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in...

CVE-2026-8344

A weakness has been identified in D-Link DIR-816 1.10CNB05R1B011D88210. Affected by this vulnerability is the function sub445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

CVE-2026-42556

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/?share=true to another user. The preview page...

CVE-2026-34341

Double free in Windows Link-Layer Discovery Protocol LLDP allows an authorized attacker to elevate privileges locally...

CVE-2026-34648

creationtimestamp| type| source ---|---|--- 2026-05-13 20:22:12+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlr4y3gfhm25...

CVE-2026-34647

creationtimestamp| type| source ---|---|--- 2026-05-13 20:22:12+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlr4y2lind2e...

MAL-2026-3697 Malicious code in syntaxlogger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebc8a65895fc09c10b6e6bf23926076ec575582e80e084616e6779b091df947d When using the provided functionality, code silently downloads archives with executables to a location excluded from A scanning, and then executes them. The...

Malicious code in syntaxlogger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebc8a65895fc09c10b6e6bf23926076ec575582e80e084616e6779b091df947d When using the provided functionality, code silently downloads archives with executables to a location excluded from A scanning, and then executes them. The...

CVE-2026-44248

creationtimestamp| type| source ---|---|--- 2026-05-13 19:14:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlqz6y6isw2h...

CVE-2026-0250

creationtimestamp| type| source ---|---|--- 2026-05-13 19:03:32+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlqyl4hz4x23 2026-05-13 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260514 2026-05-13 21:00:00+00:00| seen...

CVE-2026-0243

creationtimestamp| type| source ---|---|--- 2026-05-13 19:03:20+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlqyl2vfox2c 2026-05-14 06:51:24+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-palo-alto-networks-1...

EUVD-2026-29912

Bytello Share Windows Edition installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer...

CVE-2026-40618

creationtimestamp| type| source ---|---|--- 2026-05-13 18:05:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlqvddnhbm2k 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/f5-products-multiple-vulnerabilities20260515...

GHSA-V25J-WQCW-FVHJ

creationtimestamp| type| source ---|---|--- 2026-05-13 16:40:29+00:00| seen| https://gist.github.com/alon710/b27f7301077d94aa9dd0bb4f02951091...

CVE-2026-43477

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: Configure VRR timings after enabling TRANSDDIFUNCCTL Apparently ICL may hang with an MCE if we write TRANSVRRVMAX/FLIPLINE before enabling TRANSDDIFUNCCTL. Personally I was only able to reproduce a hang on an Dell X...

CVE-2026-43487

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Disable LPM on ST1000DM010-2EP102 According to a user report, the ST1000DM010-2EP102 has problems with LPM, causing random system freezes. The drive belongs to the same BarraCuda family as the ST2000DM008-2FR102...

UBUNTU-CVE-2026-43487

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Disable LPM on ST1000DM010-2EP102 According to a user report, the ST1000DM010-2EP102 has problems with LPM, causing random system freezes. The drive belongs to the same BarraCuda family as the ST2000DM008-2FR102...

CVE-2026-3425

creationtimestamp| type| source ---|---|--- 2026-05-13 15:56:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlqo5e3wo72g 2026-05-18 18:00:47+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mm5hfskeat2c...