PT-2026-40813

Name of the Vulnerable Software and Affected Versions CubeCart versions 6.6.x through 6.7.1 Description CubeCart builds the CC STORE URL constant directly from the Host request header during bootstrap without using an allowlist. This constant is embedded into transactional email links, specifical...

CVE-2026-4663

creationtimestamp| type| source ---|---|--- 2026-05-12 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlox6jegzl2s...

CVE-2026-44870

creationtimestamp| type| source ---|---|--- 2026-05-12 23:30:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlox25t4ew2p...

CVE-2026-6959

creationtimestamp| type| source ---|---|--- 2026-05-12 23:25:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlowr76vsy2n...

CVE-2026-44866

creationtimestamp| type| source ---|---|--- 2026-05-12 23:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlowcsfeb72i...

CVE-2026-44872

creationtimestamp| type| source ---|---|--- 2026-05-12 23:11:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlovxghm5q2o 2026-05-18 12:54:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116595677754011235...

CVE-2026-44865

creationtimestamp| type| source ---|---|--- 2026-05-12 23:06:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlovo2iyzu2i...

CVE-2026-44874

creationtimestamp| type| source ---|---|--- 2026-05-12 22:59:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlovchzeil2k...

CVE-2026-4301

creationtimestamp| type| source ---|---|--- 2026-05-12 22:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlott7s6ly2i...

CVE-2026-45781

creationtimestamp| type| source ---|---|--- 2026-05-12 21:41:52+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-2v5f-5r6w-p67r 2026-05-15 02:06:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mluaol6rpr2o...

Out-of-bounds Read

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Out-of-bounds Read in the input validation process. An attacker can gain unauthorized write access by tricking a user with high privileges into visiting a maliciously craft...

CVE-2026-36983

D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub42EF14 of the file /bin/alphapd. The manipulation of the argument LightSensorControl leads to command injection...

CVE-2025-65418

docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted url...

DEBIAN-CVE-2026-42338

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the Address6...

CVE-2026-42338

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the Address6...

CVE-2026-34647 Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain...

CVE-2026-34685 Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures...

CVE-2026-42338 ip-address: XSS in Address6 HTML-emitting methods

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the Address6...

CVE-2026-42338

CVE-2026-42338 affects the ip-address JavaScript library. Prior to version 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content when embedding results in HTML, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can include ...

CVE-2026-42338

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the Address6...