CVE-2026-58306

creationtimestamp| type| source ---|---|--- 2026-07-09 11:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7lat5vwc2l...

CVE-2026-7829

creationtimestamp| type| source ---|---|--- 2026-07-09 11:37:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq7ka42nk62a...

CVE-2026-12418

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...

CVE-2026-12517

creationtimestamp| type| source ---|---|--- 2026-07-09 08:13:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76tg4nxx2g 2026-07-09 17:49:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6yw2ove2c...

CVE-2026-12418 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...

CVE-2026-12418

CVE-2026-12418 describes a vulnerability in the WordPress plugin “User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration” (versions up to 4.3.7). An insecure direct object reference exists via the wpuf_files_data parameter due to missing validation on ...

EUVD-2026-42542

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...

CVE-2026-12418

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...

CVE-2026-13253

Affected software. Ultimate Post plugin for WordPress (up to version 5.0.31). Vulnerability. Stored Cross-Site Scripting via the 'moreResultsText' attribute of the ultimate-post/advanced-search block. Root cause. Advanced_Search::content() concatenates the attribute value into an HTML attribute a...

EUVD-2026-42520

The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-13253

The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-13253 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute

The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-15134

creationtimestamp| type| source ---|---|--- 2026-07-09 04:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qs3wdao2q...

CVE-2026-15138

creationtimestamp| type| source ---|---|--- 2026-07-09 03:57:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qj5hmgs2w...

CVE-2026-15137

creationtimestamp| type| source ---|---|--- 2026-07-09 03:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qa72g7o2k...

CVE-2026-54778

creationtimestamp| type| source ---|---|--- 2026-07-09 01:59:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6jxcxorx2e...

CVE-2026-54781

creationtimestamp| type| source ---|---|--- 2026-07-09 01:40:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6iurvqor2z...

CVE-2017-10678

creationtimestamp| type| source ---|---|--- 2026-07-09 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq6fdh2sxx2f...

MAL-2026-10038 Malicious code in antsrcsrctest (npm)

The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....

PT-2026-56921

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description An authenticated arbitrary file write exists in the legacy web UI program-upload workflow. The application stores an attacker-supplied filename prog file into the Programs.File database field and uses this...