CVE-2026-48113

The CVE-2026-48113 entry concerns Chisel, a TCP/UDP tunnel over SSH, where ACL restrictions provided by --authfile are bypassed on post-handshake SSH channels. Authenticated clients can open channels to arbitrary host:port destinations reachable from the server because ACL checks are performed on...

CVE-2026-69240

creationtimestamp| type| source ---|---|--- 2026-08-03 21:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h 2026-08-03 22:00:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g 2026-08-03 22:35:08+00:00|...

CVE-2026-18108

creationtimestamp| type| source ---|---|--- 2026-08-03 21:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fdcwaxk22 2026-08-03 23:11:10+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117034101614868174 2026-08-03 23:11:16+00:00| seen|...

EUVD-2026-52339

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

CVE-2026-68584

creationtimestamp| type| source ---|---|--- 2026-08-03 14:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyg64yp2u...

CVE-2026-18089

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-8793

creationtimestamp| type| source ---|---|--- 2026-08-03 12:50:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3ms6jxjcufv2l...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-17583

creationtimestamp| type| source ---|---|--- 2026-08-03 10:00:38+00:00| seen| https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html 2026-08-03 10:01:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms6ajowixy2u 2026-08-03 11:17:27+00:00|...

EUVD-2026-52257

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082

CTI-Transmute exposes a CSRF vulnerability in the admin user-deletion endpoint: /account/delete/ accepts HTTP GET, allowing an attacker to induce an authenticated admin to delete a user via a forged request. Exploitation requires an active admin session but no CTI-Transmute account or admin privi...

CVE-2026-12803

creationtimestamp| type| source ---|---|--- 2026-08-03 06:09:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2igor6ykz2if6 2026-08-03 11:22:47+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-12803...

EUVD-2026-52172

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

CVE-2026-15231

The CVE-2026-15231 entry affects the WordPress plugin “Tag, Category, and Taxonomy Manager” (TaxoPress) prior to version 3.51.0. Root cause: the plugin fails to verify a user’s authorization to access the referenced post before processing it and returning derived data. Impact: users with contribu...

EUVD-2026-52162

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

EUVD-2026-52163

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-16274

CVE-2026-16274 concerns the Classified Listing WordPress plugin, versions before 5.4.4. The issue arises from a missing capability/ownership check on an AJAX action that returns a post’s content. This allows users with contributor-level access and above to read content from any post, page, or cus...

PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

Advance Post Prefix WordPress plugin - Reflected XSS

Advance Post Prefix WordPress plugin through 1.1.1 contains a reflected cross-site scripting caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12734 info: name: Advance...