CVE-2026-77164: Server-Side Request Forgery (SSRF)

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

WordPress Core <= 7.1 - Author+ Private Parent Post Title Disclosure vulnerability

Author+ Private Parent Post Title Disclosure vulnerability discovered by HDWSec in WordPress core versions = 7.1...

WordPress Core <= 7.1 - Contributor+ Arbitrary Post Overwrite vulnerability

Contributor+ Arbitrary Post Overwrite vulnerability discovered by Anthropic in WordPress core versions = 7.1...

The vulnerability of the set_qosMib_list()/goform/formSetQosBand function in the Tenda A18 router software allows a attacker to trigger a service failure.

The vulnerability of the setqosMiblist /goform/formSetQosBand function in the Tenda A18 router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the form_fast_setting_wifi_set() function (/goform/fast_setting_wifi_set) in the Tenda A18 router microprogramming software allows a hacker to trigger a service failure.

The vulnerability of the formfastsettingwifiset function /goform/fastsettingwifiset in the Tenda A18 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST...

The vulnerability of the fromRouteStatic function (/goform/RouteStatic) in the Tenda CX12L Wi-Fi router software allows a hacker to trigger a service failure.

The vulnerability of the fromRouteStatic function /goform/RouteStatic in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the fromNatStaticSetting function (/goform/NatStaticSetting) in the Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.

The vulnerability of the fromNatStaticSetting function /goform/NatStaticSetting in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the fromwebExcptypemanFilter() function (/goform/webExcptypemanFilter) in the httpd component of the Tenda F451 router microprogramming system, which allows a hacker to cause a service failure.

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the httpd component of the Tenda F451 router microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the page parameter. Exploiting this...

The vulnerability of the fromAddressNat function (/goform/addressNat) in Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.

The vulnerability of the fromAddressNat function /goform/addressNat in Tenda CX12L Wi-Fi routers is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the fromwebExcptypemanFilter function (/goform/webExcptypemanFilter) in the Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST reque...

CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

WordPress WP Easy Pay – Payment and Donation Form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Modification / Site-Wide Template Takeover vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

CVE-2026-24074

creationtimestamp| type| source ---|---|--- 2026-09-17 11:38:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvpkxewi3z2b...

DEBIAN-CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...