50185 matches found
CVE-2026-86332
creationtimestamp| type| source ---|---|--- 2026-09-07 09:40:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hbqcusf43d73t...
CVE-2026-78410
creationtimestamp| type| source ---|---|--- 2026-09-07 02:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3muvfz7thww2s...
CVE-2026-78409
creationtimestamp| type| source ---|---|--- 2026-09-07 02:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3muvfz7thww2s...
CVE-2026-86235
creationtimestamp| type| source ---|---|--- 2026-09-07 01:47:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hbem2pqty2e3x...
CVE-2026-86234
creationtimestamp| type| source ---|---|--- 2026-09-07 01:35:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jkgjvni3vk4i6...
PT-2026-86679
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
CVE-2026-12757: Improper Control of Generation of Code
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-86416: Missing Authorization
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...
CVE-2026-86351: URL Redirection to Untrusted Site
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
CVE-2026-86538: Improper Limitation of a Pathname to a Restricted Directory
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...
CVE-2026-82758: Improper Authentication
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
CVE-2026-86437: Incorrect Authorization
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...
CVE-2026-82754: Improper Protection of Alternate Path
Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...
CVE-2026-86539: Server-Side Request Forgery (SSRF)
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...
CVE-2026-83534
creationtimestamp| type| source ---|---|--- 2026-09-06 17:53:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hjru5723mgrpw...
CVE-2021-38817
creationtimestamp| type| source ---|---|--- 2026-09-06 15:00:03+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag 2026-09-07 01:00:11+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag...
CVE-2026-19858
creationtimestamp| type| source ---|---|--- 2026-09-06 14:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muu5rh4ejm2v...
CVE-2026-84934
creationtimestamp| type| source ---|---|--- 2026-09-06 12:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mutx2l4nrq22...
CVE-2026-18480
creationtimestamp| type| source ---|---|--- 2026-09-06 11:59:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mutwyrwww62r 2026-09-06 16:01:40+00:00| seen| https://gist.github.com/ichintu/fe47c9308dfcae2743b09006cdd52579...