CVE-2026-11279

creationtimestamp| type| source ---|---|--- 2026-06-05 03:02:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnj5lde6ga2b 2026-06-05 13:24:40+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 18:00:00+00:00| seen|...

CVE-2026-11305

creationtimestamp| type| source ---|---|--- 2026-06-05 03:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnj5jg5xpe2p 2026-06-05 03:28:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnj72gcdjl25 2026-06-05 13:24:44+00:00| seen|...

CVE-2026-10586

creationtimestamp| type| source ---|---|--- 2026-06-05 01:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mniyhk3bqm2d 2026-06-05 01:30:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116694910594929909 2026-06-05 06:00:15+00:00| seen|...

PT-2026-47033

Name of the Vulnerable Software and Affected Versions WP Captcha PRO versions prior to 5.39 Description An authentication bypass exists due to the ajax run tool AJAX handler relying only on a nonce check via check ajax referer without performing capability checks. This is combined with the create...

Fedora 43 : cockpit (2026-58cee40a55)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-58cee40a55 advisory. Automatic update for cockpit-362-1.fc43. Changelog for cockpit Wed May 20 2026 Packit - 362-1 - Bug fixes and translation updates - Fix arbitrary code...

WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via $GET'search' in AVideo YouTubeAPI Gallery Pagination Summary A reflected Cross-Site Scripting vulnerability CWE-79 in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim...

CVE-2026-7774

tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall to write files outside the...

EUVD-2026-34282

tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall to write files outside the...

CVE-2026-7774

The CVE-2026-7774 entry concerns tarfile.data_filter in Python's tarfile handling. Crafted link entries, including symlinks with empty or directory-like names, can bypass checks to cause tarfile.extractall() to write files outside the intended extraction directory, limited by the extractor's perm...

Important: Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update

Multicluster Global Hub v1.6.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

RLSA-2026:21676 Important: cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fixes: cockpit: Cockpit: Arbitrary command execution via crafted links in...

cockpit security update

An update is available for cockpit. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Cockpit enables users to administer GNU/Linux servers using a web browser. I...

CVE-2026-50226 Firmware Theft & IMEI Spoofing via Connect-OTA

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

CVE-2026-50226

CVE-2026-50226 affects the AcerConnect OTA application. The issue arises from fixed AES-128-CBC keys inside the app, allowing attackers to forge authorization credentials for arbitrary IMEI numbers. This enables unauthorized actors to list catalog items and extract protected binaries from pre-sig...

EUVD-2026-34231

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

CVE-2026-49185

creationtimestamp| type| source ---|---|--- 2026-06-04 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116689956169057665 2026-06-04 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mngs2jmfpk2q 2026-06-04 06:54:06+00:00| seen|...

CVE-2026-41860

creationtimestamp| type| source ---|---|--- 2026-06-04 03:20:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mngo5dkpkj2f 2026-06-04 04:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mngqeycd7q2k 2026-06-04 09:07:08+00:00| seen|...

CVE-2026-41011

creationtimestamp| type| source ---|---|--- 2026-06-04 03:00:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mngmzjmk3y2q 2026-06-04 03:00:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/116689602129166209 2026-06-04 03:19:28+00:00| seen|...

CVE-2026-10737

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the viewfile function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links f...

CVE-2026-10737

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the viewfile function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links f...