CVE-2026-85614

creationtimestamp| type| source ---|---|--- 2026-09-04 13:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muozyctl5y2l 2026-09-04 14:07:35+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mup5762f3a2w...

CVE-2026-78583

creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoydcqpi623 2026-09-09 23:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4pe63ej32b...

CVE-2026-82299

creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoydcqpi623...

CVE-2026-78596

creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoydcqpi623...

Use of Single-factor Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication through the removeTwofactorConfig process and the twofactorenabled form field, which are accessible via POST...

CVE-2026-80536

creationtimestamp| type| source ---|---|--- 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...

CVE-2026-80583

creationtimestamp| type| source ---|---|--- 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...

CVE-2026-85403

creationtimestamp| type| source ---|---|--- 2026-09-04 11:08:16+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3muot6j7pgy2u...

CVE-2026-85546

creationtimestamp| type| source ---|---|--- 2026-09-04 10:56:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4hdkxyhjnkx75...

CVE-2026-84428

creationtimestamp| type| source ---|---|--- 2026-09-04 10:27:32+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muoqvmwms225 2026-09-04 13:06:39+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3muozs7o5py2y 2026-10-01 12:30:29+00:00| seen|...

GHSA-PFVF-FWFP-25MP

creationtimestamp| type| source ---|---|--- 2026-09-04 10:00:16+00:00| seen| https://bsky.app/profile/strawberry.rocks/post/3muopeviwkv2k 2026-10-09 16:30:32+00:00| seen| https://gist.github.com/alon710/3f4a231234c89945ddbbd06ebc24e753...

CVE-2026-76169

creationtimestamp| type| source ---|---|--- 2026-09-04 09:54:28+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muop2ikyjc25 2026-10-01 10:30:31+00:00| seen| https://gist.github.com/alon710/a1265d04bb89bd5ad393ac2683538928...

CVE-2026-85094

creationtimestamp| type| source ---|---|--- 2026-09-04 07:04:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j5vsxotiacu2n 2026-09-04 08:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muoip2kztd2l 2026-10-10 14:05:24+00:00| seen|...

DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-84066

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions before 8.9 ) is vulnerable to an arbitrary post metadata write. The root cause is a failure to verify that a requesting user owns the post before writing uploaded file references to its metadata. ...

CVE-2026-84146

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.8 , contains a vulnerability where it fails to perform required capability or post-status checks. This allows unauthenticated visitors to retrieve sensitive details—including title, price, SKU, description, and sto...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9 - Subscriber+ Arbitrary Post Meta Write vulnerability

Subscriber+ Arbitrary Post Meta Write vulnerability discovered by ryan zegar in WordPress Plugin Directorist versions 8.9...