CVE-2026-9175

creationtimestamp| type| source ---|---|--- 2026-06-24 07:16:19+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mozenibsvo2s...

GHSA-3FC8-8HP6-6JR4

creationtimestamp| type| source ---|---|--- 2026-06-24 07:11:47+00:00| seen| https://gist.github.com/alon710/ef60a8d2e003433e0632a30f0def6b96...

CVE-2022-28206

creationtimestamp| type| source ---|---|--- 2026-06-24 07:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moze4zc3pd2n...

CVE-2026-7761

CVE-2026-7761 affects the WordPress plugin Ultimate Member up to version 2.11.4. The description in connected sources details a chain of three logic flaws causing account takeover via password reset URL disclosure: (1) an MD5 hash fallback in get_directory_by_hash() allows routing to a crafted po...

CVE-2026-7761 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

EUVD-2026-38714

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

CVE-2026-7761

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

CVE-2026-12485

creationtimestamp| type| source ---|---|--- 2026-06-24 06:45:28+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mozcwcekfw25 2026-07-16 19:00:28+00:00| seen| Telegram/v6zEHK1Gj8NlOFeo8YsfoG14SZcYTyMq60BoqtegyteCqb8 2026-07-17 01:00:26+00:00| seen|...

CVE-2022-28205

creationtimestamp| type| source ---|---|--- 2026-06-24 06:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mozchexunc2k...

EUVD-2026-38660

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...

CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...

GHSA-44WP-G8F4-F4V5

creationtimestamp| type| source ---|---|--- 2026-06-24 04:42:12+00:00| seen| https://gist.github.com/alon710/f3efb3a6eb14f85378da7277ba2da374...

GHSA-6F75-X745-XCPR

creationtimestamp| type| source ---|---|--- 2026-06-24 02:11:40+00:00| seen| https://gist.github.com/alon710/3da2d0271b4ce13266c6eb8e48512bfd 2026-06-24 02:22:36+00:00| seen| https://gist.github.com/alon710/e0c0df432c86420f7e6e4e56d0b5a192...

CVE-2026-56116

A flaw was found in dhcpcd. An unauthenticated attacker on the same network link can exploit a memory leak vulnerability in the IPv6 Router Advertisement route information handling. By repeatedly sending specially crafted Router Advertisements with a zero lifetime, the attacker can cause the syst...

CVE-2026-54515

creationtimestamp| type| source ---|---|--- 2026-06-24 00:39:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyoilsxlk2y 2026-06-29 13:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgnhh3jnf2d 2026-09-25 05:40:11+00:00| seen|...

CVE-2026-54514

creationtimestamp| type| source ---|---|--- 2026-06-24 00:24:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moynnqc2bg23 2026-09-25 05:40:11+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n4e3ul2w 2026-09-28 21:01:07+00:00| seen|...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...

CVE-2026-23879: Improper Link Resolution Before File Access

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file write vulnerability, which allows symbolic links to be recreated outside the destination directory via crafted malicious...

CVE-2026-7761: Missing Authorization

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

CVE-2026-47110: Improper Handling of Unexpected Data Type

Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri functio...