CVE-2026-13116

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generatedocumentshortcode due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-15338

creationtimestamp| type| source ---|---|--- 2026-07-11 04:42:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdtxhnb7y2y 2026-07-11 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqduyrtsfv2k 2026-07-13 00:00:20+00:00| seen|...

CVE-2026-13353

creationtimestamp| type| source ---|---|--- 2026-07-11 04:40:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdtuqz2qt27 2026-07-11 05:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqduyyvv3g25 2026-07-11 06:37:34+00:00| seen|...

EUVD-2026-43138

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generatedocumentshortcode due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-15080

creationtimestamp| type| source ---|---|--- 2026-07-11 03:15:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdp4z5ww52s 2026-07-11 03:15:47+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqdp4z55v62o...

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of ON² for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker...

CVE-2026-15301

creationtimestamp| type| source ---|---|--- 2026-07-11 00:55:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhctfuzp2c 2026-07-11 00:55:53+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqdhcuf6pi2k...

CVE-2026-15374

creationtimestamp| type| source ---|---|--- 2026-07-10 22:10:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd62hzrn727 2026-07-10 22:38:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7n572pl2x 2026-07-11 00:15:42+00:00| seen|...

CVE-2026-11992

creationtimestamp| type| source ---|---|--- 2026-07-10 21:05:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2hn2jul2d 2026-07-10 21:05:55+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqd2ho65xv2o...

CVE-2026-55665 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-55665

Grist spreadsheet app vulnerable to DOM-based XSS prior to version 1.7.15. Two flaws allowed attacker-controlled values to appear in link hrefs without scheme validation, enabling a javascript URL to execute in a victim’s Grist origin on a single click. Specifically, on the account-selection page...

CVE-2026-55665 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-55464

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScrip...

CVE-2026-55464

Snipe-IT (IT asset/license management) is affected by CVE-2026-55464 prior to version 8.6.2. The issue arises from CommonMark escaping raw HTML but not sanitizing javascript: URIs in Markdown hyperlinks within a markdown-textarea custom field. A user with assets.edit permission can insert a malic...

CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScrip...

CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScrip...

CVE-2026-54149

creationtimestamp| type| source ---|---|--- 2026-07-10 16:58:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcmnbbo2l2x 2026-07-10 17:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqcmrccqct25 2026-07-10 22:11:21+00:00| seen|...

CVE-2026-15143

creationtimestamp| type| source ---|---|--- 2026-07-10 16:01:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcjgg6g4b26 2026-07-10 16:46:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqclx3547y2b 2026-07-10 22:19:41+00:00| seen|...

CVE-2026-56312

Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn...

CVE-2026-11990

creationtimestamp| type| source ---|---|--- 2026-07-10 12:32:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc5r4f2p52z 2026-07-10 13:23:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcamqmmvf22 2026-07-11 00:44:17+00:00| seen|...