National Security Agency Ghidra 路径遍历漏洞

National Security Agency Ghidra is a software reverse-engineering framework developed by the National Security Agency NSA. Prior to version 12.1 of National Security Agency Ghidra, there was a path traversal vulnerability. This vulnerability stemmed from SameDirDebugInfoProvider failing to valida...

bit7z 后置链接漏洞

bit7z is a file compression/uncompression tool developed by Riccardo as an individual project. Versions of bit7z prior to 4.0.12 had a post-installation link vulnerability. This vulnerability stemmed from the use of symbolic links during archive updates, allowing for arbitrary file overwriting...

WordPress plugin Simple Link Directory 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-48555

Simple Link Directory through 9.0.4 interpolates the sld no results found option into a JavaScript string literal without encoding. Because sanitize text field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor...

PT-2026-48516

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX12 v1 TP-Link Archer AX17 v1 TP-Link Archer AX18 v1 TP-Link Archer AX1300 v1.6 Description An OS command injection issue exists in the VPN module. This occurs due to improper filtering of special characters, allowing an...

PT-2026-48550

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type...

CVE-2026-46433

lldpd is an implementation of IEEE 802.1ab LLDP. Prior to version 1.0.22, lldpddecode in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove to shift the frame payload 4 bytes left. The third argument byte count is s - 2 ETHERADDRLEN but should be s - 2...

CVE-2026-47955

creationtimestamp| type| source ---|---|--- 2026-06-09 23:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvchp5ryl2u...

CVE-2026-46433

CVE-2026-46433 affects lldpd (LLDP implementation). Prior to version 1.0.22, lldpd_decode() incorrectly shifts frame payload when removing 802.1Q VLAN tags, using a length calculation that causes a 4-byte heap OOB read if the frame size equals the interface MTU. This vulnerability is fixed in ver...

CVE-2026-47938

creationtimestamp| type| source ---|---|--- 2026-06-09 22:17:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv7yh5zg627 2026-06-10 07:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnw5bdy7s42s 2026-07-05 01:00:01+00:00| seen|...

GHSA-7QJX-GP9H-65QJ

creationtimestamp| type| source ---|---|--- 2026-06-09 22:11:08+00:00| seen| https://gist.github.com/alon710/663cf40e16b6dd064b1d29749e82124d...

CVE-2026-48291

creationtimestamp| type| source ---|---|--- 2026-06-09 22:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnv73bc46r2y...

CVE-2026-11822

creationtimestamp| type| source ---|---|--- 2026-06-09 21:36:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv5qarrqa2v 2026-06-09 22:21:02+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnva7gqqpy2r 2026-06-18 17:10:37+00:00| seen|...

CVE-2026-48305

creationtimestamp| type| source ---|---|--- 2026-06-09 21:23:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv4wilsd32v...

CVE-2026-6444

creationtimestamp| type| source ---|---|--- 2026-06-09 21:19:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv4rm2yem23...

CVE-2026-11555

A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Interface. Such manipulation leads to least privilege violation. The attack may be launched remotely. The attack requires a high level of...

CVE-2026-10732

A flaw was found in the decompress package. A remote attacker can exploit this by providing a crafted ZIP archive with two entries at the same path: a symlink to an arbitrary target and a regular file. Due to microtask processing order, the file content is written through the symlink before it is...

GHSA-8XX5-H6M3-JR33

creationtimestamp| type| source ---|---|--- 2026-06-09 19:20:17+00:00| seen| https://gist.github.com/pseudo7777/6fb3ec2f8f5b760f09161e11ad328b2f...

GHSA-5C37-5J7W-8MH8 LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default and documented configuration, so LSHttpRequest::checkIsAllowedHost results in no operation....

EUVD-2026-35624

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect Open Redirect vulnerability that could lead to account takeover. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this iss...