CVE-2026-42591

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint /forms/libreoffice/convert passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely...

CVE-2026-40931

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but...

CVE-2026-35604

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to...

CVE-2026-46496 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting XSS vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the component. The component allows javascript: URIs in the source attribute, which are executed when the page is...

CVE-2026-5415

The WP Captcha PRO the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajaxruntool AJAX handler relying solely on a nonce check...

EUVD-2026-34888

The WP Captcha PRO the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajaxruntool AJAX handler relying solely on a nonce check...

CVE-2026-5415 WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

The WP Captcha PRO the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajaxruntool AJAX handler relying solely on a nonce check...

CVE-2026-49492 Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latexengine code-chunk attribute. On Windows, a crafted...

CVE-2026-49492 Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latexengine code-chunk attribute. On Windows, a crafted...

CVE-2026-42795

creationtimestamp| type| source ---|---|--- 2026-06-05 09:52:49+00:00| seen| https://bsky.app/profile/janvhs.com/post/3mnjujssgpk2p 2026-06-05 10:19:37+00:00| seen| https://bsky.app/profile/janvhs.com/post/3mnjvzqchfk2a...

CVE-2026-11136

creationtimestamp| type| source ---|---|--- 2026-06-05 09:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnjrmorehg2f 2026-06-05 09:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnjrmorehg2f 2026-06-05 13:24:13+00:00| seen|...

CVE-2026-21826

creationtimestamp| type| source ---|---|--- 2026-06-05 08:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnjrl6q2s42m 2026-06-05 08:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnjrl6q2s42m...

CVE-2026-11279

creationtimestamp| type| source ---|---|--- 2026-06-05 03:02:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnj5lde6ga2b 2026-06-05 13:24:40+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 18:00:00+00:00| seen|...

CVE-2026-11305

creationtimestamp| type| source ---|---|--- 2026-06-05 03:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnj5jg5xpe2p 2026-06-05 03:28:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnj72gcdjl25 2026-06-05 13:24:44+00:00| seen|...

CVE-2026-10586

creationtimestamp| type| source ---|---|--- 2026-06-05 01:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mniyhk3bqm2d 2026-06-05 01:30:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116694910594929909 2026-06-05 06:00:15+00:00| seen|...

PT-2026-47033

Name of the Vulnerable Software and Affected Versions WP Captcha PRO versions prior to 5.39 Description An authentication bypass exists due to the ajax run tool AJAX handler relying only on a nonce check via check ajax referer without performing capability checks. This is combined with the create...

Fedora 43 : cockpit (2026-58cee40a55)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-58cee40a55 advisory. Automatic update for cockpit-362-1.fc43. Changelog for cockpit Wed May 20 2026 Packit - 362-1 - Bug fixes and translation updates - Fix arbitrary code...

WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via $GET'search' in AVideo YouTubeAPI Gallery Pagination Summary A reflected Cross-Site Scripting vulnerability CWE-79 in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim...

CVE-2026-7774

tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall to write files outside the...

CVE-2026-7774

The CVE-2026-7774 entry concerns tarfile.data_filter in Python's tarfile handling. Crafted link entries, including symlinks with empty or directory-like names, can bypass checks to cause tarfile.extractall() to write files outside the intended extraction directory, limited by the extractor's perm...