PT-2026-48214

SemCms 5.0 is vulnerable to Cross Site Request Forgery CSRF via crafted POST request to /admin/semcms user.php...

SEMCMS 跨站请求伪造漏洞

SEMCMS is an open-source content management system CMS for foreign trade websites that supports multiple languages. Version SEMCMS 5.0 has a cross-site request forgeing vulnerability, which stems from improper handling of POST requests directed to /admin/semcmsuser.php. This vulnerability may lea...

cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache

cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache...

GHSA-273Q-QGH5-WRJ6 nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints

Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...

nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints

Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...

coruna-postexploit

Coruna Post-Exploitation Framework Overview This is a com...

CVE-2026-44631

creationtimestamp| type| source ---|---|--- 2026-06-08 23:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnsrxdvbsz27 2026-06-09 00:51:01+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-apache-http-server 2026-06-09 12:35:09+00:00| seen|...

CVE-2026-49141

creationtimestamp| type| source ---|---|--- 2026-06-08 21:04:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsledm6gl2f...

CVE-2026-52778

creationtimestamp| type| source ---|---|--- 2026-06-08 20:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnshvh27vg2y 2026-06-09 09:12:19+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mntu5424d22s 2026-07-09 21:42:04+00:00| seen|...

EUVD-2026-35194

WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...

CVE-2026-49141 WACRM Authorization Bypass via Automation Engine Endpoint

WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...

CVE-2026-11697

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 01:35:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnt2ls5wj626 2026-06-09 12:00:39+00:00| seen|...

CVE-2026-11701

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 01:40:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnt2uqtw5s2a 2026-06-15 18:00:00+00:00| seen|...

CVE-2026-11684

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 00:40:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsxk3lvs52i 2026-06-15 18:00:00+00:00| seen|...

CVE-2026-49755

creationtimestamp| type| source ---|---|--- 2026-06-08 17:44:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsabozbgi2a 2026-07-29 16:35:09+00:00| published-proof-of-concept| https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv...

CVE-2026-49756

creationtimestamp| type| source ---|---|--- 2026-06-08 17:34:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns7prs24r2y 2026-07-29 16:35:07+00:00| published-proof-of-concept| https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m...

CVE-2026-46274

creationtimestamp| type| source ---|---|--- 2026-06-08 16:55:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns5jr2z2a2r 2026-07-01 02:34:26+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260630 2026-08-03 08:01:05+00:00| seen...

EUVD-2026-35136

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2014-2855

creationtimestamp| type| source ---|---|--- 2026-06-08 16:20:55+00:00| seen| https://bsky.app/profile/ryan.m29.us.ap.brid.gy/post/3mns3k6sk7kx2...

CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...