PYSEC-2026-1779 PheonixAppAPI has visible Encoding Maps

Impact This is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc. The issue is that the map of encoding/decoding languages are visible in code. Patches The Problem was patched in 0.2.5, so you should try to upgrade to the...

CVE-2025-64636

creationtimestamp| type| source ---|---|--- 2026-07-07 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2s64b4pj24...

CVE-2026-40187

creationtimestamp| type| source ---|---|--- 2026-07-07 14:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2s2h3gp32g 2026-07-07 14:35:10+00:00| published-proof-of-concept| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7...

GHSA-26V7-H57M-GH9M New API is vulnerable to CSRF through user email binding

Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth...

CVE-2026-11340

creationtimestamp| type| source ---|---|--- 2026-07-07 11:56:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2keavs5r2n...

PYSEC-2026-1098 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

PYSEC-2026-1650 mlflow Path Traversal vulnerability

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...

PYSEC-2026-1387 Path traversal in flaskcode

An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI from views.py, allows attackers to write to arbitrary files...

PYSEC-2026-1249 Out of memory error when submitting the dataset form with a specially-crafted field

Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...

CVE-2026-48828

creationtimestamp| type| source ---|---|--- 2026-07-07 11:34:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2j5dmjes2x 2026-07-07 12:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2li2o6vg2w...

CVE-2026-11610

creationtimestamp| type| source ---|---|--- 2026-07-07 11:27:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2ipuz5va24 2026-07-08 01:23:42+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116881740056582551...

CVE-2026-57869

creationtimestamp| type| source ---|---|--- 2026-07-07 08:34:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq272f5jnd2y...

CVE-2026-12943

creationtimestamp| type| source ---|---|--- 2026-07-07 08:30:22+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mq26ttl6ou2f 2026-07-30 19:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv4ungbww2y 2026-07-30 19:02:13+00:00| seen|...

CVE-2026-8306

creationtimestamp| type| source ---|---|--- 2026-07-07 08:14:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq25wlek3u2w...

CVE-2026-14345

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values...

EUVD-2026-42009

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values...

CVE-2026-14345

The CVE-2026-14345 entry concerns the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (WordPress plugin). Affected versions up to and including 3.12.7 are vulnerable to Remote Code Execution via the postData parameter. The root cause is an unsanitized write of attacker...

CVE-2026-14345

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values...

CVE-2026-11328

creationtimestamp| type| source ---|---|--- 2026-07-07 04:51:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzsm2qgcy2y 2026-07-07 13:16:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2osqsegt2p 2026-07-07 13:22:18+00:00| seen|...

CVE-2026-42143

creationtimestamp| type| source ---|---|--- 2026-07-07 04:06:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzq464xi72a 2026-07-07 06:01:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpzwje4owm2u...