40918 matches found
EUVD-2023-60581
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to creat...
CVE-2026-11464
creationtimestamp| type| source ---|---|--- 2026-06-08 01:21:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqjemn5z62i...
CVE-2026-11466
creationtimestamp| type| source ---|---|--- 2026-06-08 01:06:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqijr7ejc26...
CVE-2026-11465
creationtimestamp| type| source ---|---|--- 2026-06-08 00:45:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqhdi5e4n2o...
PT-2026-47450
Name of the Vulnerable Software and Affected Versions WACRM versions prior to commit 73041bf Description An authorization bypass exists in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants. By providing an arbitrary contact id in th...
PT-2026-47542
Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...
VulnCheck KEV: CVE-2026-5027
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences '../'...
PT-2026-47275
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM Helpers::deserialize block attributes' method converting unicode-encoded...
PT-2026-47283
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An improper access control flaw exists where a limited administrator can bypass Fine-Grained Admin Permissions FGAP, which are detailed permissions that restrict administrative actions to...
WordPress plugin Sonaar Music 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
TencentOS Server 4: python-django (TSSA-2026:0341)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0341 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2026-11471
creationtimestamp| type| source ---|---|--- 2026-06-07 16:16:22+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-11471 2026-06-08 05:00:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqvlzouha2y...
CVE-2026-47430
creationtimestamp| type| source ---|---|--- 2026-06-07 12:56:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnp7ql7avr2p 2026-06-08 13:40:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrsnt5lla2i 2026-06-09 00:51:01+00:00| seen|...
CVE-2026-11458
creationtimestamp| type| source ---|---|--- 2026-06-07 09:02:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnosjyzka32k 2026-06-07 09:02:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116708004613032981...
CVE-2026-11455
creationtimestamp| type| source ---|---|--- 2026-06-07 09:02:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnosjxyvqf24...
CVE-2026-2500
The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the qckplydata function passing the user-supplied filename POST parameter directly to filegetcontents without any validation, sanitization, or path restriction. Th...
The Clock Is Already Ticking: Why Post-Quantum Cryptography Can’t Wait
There is a question I have been hearing more and more from CISOs, compliance officers, and security architects over the past year. It does not start with "we had a breach" or "we failed an audit." It starts with something that sounds almost philosophical: " Are we quantum-safe?" A year ago, that...
CVE-2026-8976
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action...
CVE-2026-45776
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. If an installation of Open XDMoD...
