68923 matches found
PT-2026-64302
Name of the Vulnerable Software and Affected Versions Loytec LWEB-802 versions prior to 5.0.8 Description Reflected Cross-Site Scripting occurs when an unauthenticated remote attacker executes arbitrary JavaScript in a victim's browser. This allows the attacker to perform actions using the victim...
PT-2026-64224
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the priva...
CVE-2026-55729: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...
CVE-2025-71389
creationtimestamp| type| source ---|---|--- 2026-07-23 22:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdurrtxmt2v 2026-07-23 23:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwyjh62x2a 2026-07-28 20:00:07+00:00| seen|...
CVE-2026-65703
creationtimestamp| type| source ---|---|--- 2026-07-23 21:01:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdqbapxvq2d...
CVE-2026-65760
creationtimestamp| type| source ---|---|--- 2026-07-23 20:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdpxzoec52v...
CVE-2026-48013
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...
GHSA-WRJC-X8RR-H8H6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013
CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
EUVD-2026-48378
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-62548
creationtimestamp| type| source ---|---|--- 2026-07-23 18:20:56+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-61122
creationtimestamp| type| source ---|---|--- 2026-07-23 18:15:05+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-27 15:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrn7zczya523...
CVE-2026-44909
creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...