K000162711: Vim vulnerability CVE-2026-28417

Security Advisory Description Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can...

CVE-2025-69938

creationtimestamp| type| source ---|---|--- 2026-07-31 15:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxcmapwft2y...

CVE-2026-28812

creationtimestamp| type| source ---|---|--- 2026-07-31 15:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxcm7hwyh2z...

CVE-2025-69941

creationtimestamp| type| source ---|---|--- 2026-07-31 15:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxcf26mcq2q...

CVE-2026-27060

creationtimestamp| type| source ---|---|--- 2026-07-31 15:44:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxcbkstiw2u 2026-07-31 17:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxiy5imiu2q...

CVE-2026-68577

creationtimestamp| type| source ---|---|--- 2026-07-31 14:12:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jef76ycbxltzi...

CVE-2026-68576

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-52539

creationtimestamp| type| source ---|---|--- 2026-07-31 12:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwxk5vccl2e...

EUVD-2026-51527

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

GHSA-XPXJ-F2FM-RQCH

creationtimestamp| type| source ---|---|--- 2026-07-31 10:32:17+00:00| seen| https://gist.github.com/alon710/ebcd683ed5c708ce9306a8ed3912a91a...

Server-Side Request Forgery (SSRF)

datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...

CVE-2026-11770

creationtimestamp| type| source ---|---|--- 2026-07-31 10:14:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4264s2zafk3mq 2026-07-31 12:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrwvrz7cro2l...

CVE-2026-15722

creationtimestamp| type| source ---|---|--- 2026-07-31 10:12:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/c763a3in7urxc 2026-07-31 12:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrwvs7kinr2e...

CVE-2026-65311

creationtimestamp| type| source ---|---|--- 2026-07-31 10:00:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dabbdkvhdeq2o...

CVE-2026-65310

creationtimestamp| type| source ---|---|--- 2026-07-31 09:54:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7a4bpwbxcymga 2026-07-31 14:34:32+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrx6em7wg22g...

CVE-2026-51276

creationtimestamp| type| source ---|---|--- 2026-07-31 09:39:51+00:00| seen| https://gist.github.com/programmervuln/20b6eaa7e49abd25bb2013ba60a8e233...

GHSA-JM28-2WCR-QF3H

creationtimestamp| type| source ---|---|--- 2026-07-31 09:31:22+00:00| seen| https://gist.github.com/alon710/4da77a0fb37a106d6065c5dabb250f4c...

CVE-2026-51248

creationtimestamp| type| source ---|---|--- 2026-07-31 08:58:36+00:00| seen| https://gist.github.com/programmervuln/e87d48c8a9e36ddf43cc02db54f5151f...

CVE-2026-14921

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-14833

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...