50362 matches found
CVE-2026-80114
creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwgw4gw2g 2026-09-09 07:10:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117239827757083424 2026-09-09 07:10:13+00:00| seen|...
WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability
Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...
CVE-2026-18175
creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkainfhn2z 2026-09-09 22:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4kdac7kj2p...
CVE-2026-19274
creationtimestamp| type| source ---|---|--- 2026-09-04 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupijajral2w 2026-09-04 18:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupknjyxry22 2026-09-05 23:01:21+00:00| seen|...
CVE-2026-18149
creationtimestamp| type| source ---|---|--- 2026-09-04 17:24:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w 2026-09-29 23:30:32+00:00| seen| https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5 2026-09-30 12:01:15+00:00| seen|...
CVE-2026-18540
creationtimestamp| type| source ---|---|--- 2026-09-04 17:17:57+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muphtit3ps2w 2026-09-30 12:01:11+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcb3dlkw2b...
CVE-2026-84890
creationtimestamp| type| source ---|---|--- 2026-09-04 17:06:12+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muph6jb6xk2w 2026-09-12 08:40:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117257168610414149 2026-09-12 08:50:03+00:00| seen|...
CVE-2026-85008
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...
CVE-2026-85014
creationtimestamp| type| source ---|---|--- 2026-09-04 16:32:16+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupfbsvqe22w 2026-09-30 12:01:21+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcbehg3c2q...
CVE-2026-85024
creationtimestamp| type| source ---|---|--- 2026-09-04 16:24:24+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupetrfbmk2w 2026-09-28 23:30:32+00:00| seen| https://gist.github.com/alon710/ffd73e42aa4d7534770f3c09713af03e 2026-09-29 12:01:27+00:00| seen|...
CVE-2026-75170
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...
CVE-2026-85660
creationtimestamp| type| source ---|---|--- 2026-09-04 16:07:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupdvzwqlu2l 2026-09-04 17:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muphfhpcgq2t...
evil-winrm v4.1
Evil-WinRM !Version-shield !Ruby2.3-shield !Gem-Version !License-shield !Docker-shield The ultimate WinRM shell for hacking/pentesting Description & Purpose This shell is the ultimate WinRM shell for hacking/pentesting. WinRM Windows Remote Management is the Microsoft implementation of...
CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...
CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...
CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...
CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...
CVE-2026-85650
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...
CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...