CVE-2026-50234

creationtimestamp| type| source ---|---|--- 2026-06-06 02:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnlkm5gd2r2q...

CVE-2026-6240

creationtimestamp| type| source ---|---|--- 2026-06-06 01:03:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlhgwbmmg2d...

EUVD-2026-34932

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action...

EUVD-2026-34922

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of unserialize without an allowedclasses restriction in the IdsToCollection::getidsfromstring function, which processes...

CVE-2026-45291

creationtimestamp| type| source ---|---|--- 2026-06-06 00:01:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnldwlm7i22k...

PT-2026-47124

Name of the Vulnerable Software and Affected Versions Page-list plugin for WordPress versions prior to 6.3 Description Missing authorization occurs in the pagelist unqprfx ext shortcode function, specifically within the 'pagelist ext' and 'pagelistext' shortcodes. The function accepts...

WordPress plugin Klamra Paycal for Aspaclaria 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

WordPress plugin RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-7654 Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of unserialize without an allowedclasses restriction in the IdsToCollection::getidsfromstring function, which processes...

CVE-2026-7654

The Admin Columns plugin for WordPress (up to version 7.0.18) is vulnerable to PHP Object Injection that leads to Remote Code Execution. Root cause: unserialize() used without an allowed_classes restriction in IdsToCollection::get_ids_from_string(), processing attacker-controlled post meta values...

CVE-2026-7654 Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of unserialize without an allowedclasses restriction in the IdsToCollection::getidsfromstring function, which processes...

CVE-2026-46397

creationtimestamp| type| source ---|---|--- 2026-06-05 21:40:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl42opps527...

CVE-2026-11419

creationtimestamp| type| source ---|---|--- 2026-06-05 20:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzcm7lbt24 2026-06-06 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnlsyefnvw23 2026-06-06 04:30:42+00:00| seen|...

CVE-2026-46389

creationtimestamp| type| source ---|---|--- 2026-06-05 20:01:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwkeya5p2k 2026-06-15 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moe3jinbbf2e 2026-06-22 00:36:43+00:00| seen|...

CVE-2026-5415

creationtimestamp| type| source ---|---|--- 2026-06-05 20:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwim4aqz2b 2026-06-06 00:00:16+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnldv73u4r2d 2026-06-13 05:16:07+00:00| seen|...

CVE-2026-7720

A weakness has been identified in Totolink WA300 5.2cu.7112B20190227. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument langType causes command injection. Remote exploitation of the attack ...

CVE-2026-38569

HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidatedetail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...

CVE-2026-5812

A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initia...

CVE-2026-10271

A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The affected element is an unknown function of the file admin/ of the component Admin Endpoint. This manipulation of the argument uid causes execution after redirect. It is possible to initiate...

CVE-2026-36613

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers...