EUVD-2026-46155

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

CVE-2026-55833

creationtimestamp| type| source ---|---|--- 2026-07-21 02:18:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4qlzdkjo2o 2026-07-22 16:00:04+00:00| seen| https://t.me/bdufstecru/3334 2026-07-22 22:35:22+00:00| published-proof-of-concept|...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

The CVE affects Zyxel AX7501-B1 firmware up to version 5.17(ABPC.7.2)C0, where a post-authentication command injection in the LogServer component of the syslog module is possible. An authenticated administrator can execute OS commands on the device, per the description. CVSS v3.1 metrics indicate...

EUVD-2026-46145

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

PT-2026-61820

Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B1 versions prior to 5.17ABPC.7.2C0 Description A post-authentication command injection issue exists within the syslog component. An authenticated attacker with administrator privileges can execute arbitrary operating system...

CVE-2026-57495

creationtimestamp| type| source ---|---|--- 2026-07-20 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4icrfnis2e...

CVE-2026-53591

creationtimestamp| type| source ---|---|--- 2026-07-20 23:01:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4flzpkiu2m...

CVE-2026-64624

creationtimestamp| type| source ---|---|--- 2026-07-20 23:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fjxsamp2e 2026-07-21 00:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4j5mytxx2e...

CVE-2026-64650

creationtimestamp| type| source ---|---|--- 2026-07-20 22:55:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4fbegvcg23...

CVE-2026-53596

creationtimestamp| type| source ---|---|--- 2026-07-20 22:11:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4crfy6v32i...

CVE-2026-44583

creationtimestamp| type| source ---|---|--- 2026-07-20 21:57:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bzhro4d2i...

EUVD-2026-42313

Socket.IO: Engine.IO Polling Transport Connection Exhaustion...

CVE-2026-56624

creationtimestamp| type| source ---|---|--- 2026-07-20 21:30:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr4ai3v7co2r 2026-07-20 22:26:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4dmuhdiz24...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...