41253 matches found
MAL-2026-4387 Malicious code in @euqns/nudge-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b1e494fee8148b95f98e5de04cc4ecd78ed793ff2d019ae672e2b22d2debc3b The package ships dist/setup.js which performs HTTP POST requests at install time to a hardcoded external endpoint at...
CVE-2026-6864
creationtimestamp| type| source ---|---|--- 2026-05-22 07:13:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgf3hprox2k 2026-05-25 05:49:15+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnrs6gp4q2l...
CVE-2026-7509
creationtimestamp| type| source ---|---|--- 2026-05-22 06:58:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgeamfjm22k 2026-05-25 04:25:55+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnn56cp2o2s...
CVE-2026-39832
creationtimestamp| type| source ---|---|--- 2026-05-22 06:36:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgd2bheui2t 2026-06-26 14:12:20+00:00| seen| https://gist.github.com/alon710/ef1198280eb29f6a5974c2c64ac1ec7a 2026-07-15 16:40:08+00:00| seen|...
CVE-2026-39833
creationtimestamp| type| source ---|---|--- 2026-05-22 06:18:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgbzgl2hw2k 2026-05-22 20:40:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116620160885281925 2026-07-15 16:40:08+00:00| seen|...
CVE-2026-3481
The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the rendershortcodepreview function. The function receives user inpu...
CVE-2026-3481
The CVE-2026-3481 entry concerns the WP Blockade WordPress plugin (versions
CVE-2026-3481 WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter
The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the rendershortcodepreview function. The function receives user inpu...
CVE-2026-34911
creationtimestamp| type| source ---|---|--- 2026-05-22 04:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmg2dhtakh2s 2026-05-26 16:30:06+00:00| seen| https://t.me/truesecator/8245 2026-05-27 06:38:42+00:00| seen|...
CVE-2026-25607
creationtimestamp| type| source ---|---|--- 2026-05-22 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-25606 2026-05-22 12:56:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgybe5ykk2p...
CVE-2026-9104 Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to...
CVE-2026-9104
The CVE concerns the Draft List plugin for WordPress, affecting all versions up to 2.6.3. It describes a Stored Cross-Site Scripting (XSS) vulnerability in draft post titles caused by insufficient input sanitization and output escaping. Exploitation requires at least author-level access; authenti...
EUVD-2026-31362
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...
GHSA-WMW3-3FV3-H54W Concrete CMS has a session-hardening bypass and allows password change without reauthorization
Concrete CMS 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current password ...
PT-2026-42733
The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the save widget context settings function. This makes it possible for unauthenticated attackers to modify widget...
BentoML 后置链接漏洞
BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Versions of BentoML prior to 1.4.38 contained a post-link vulnerability. This vulnerability stemmed from the fact that the bui...
PT-2026-42723
Name of the Vulnerable Software and Affected Versions WP Blockade versions prior to 0.9.15 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation, allowing attackers to execute scripts in the...
WordPress plugin Ditty 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
RockyLinux 8 : python3 (RLSA-2026:2128)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2128 advisory. cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-0865 cpython: IMAP command injection in user-controlled commands...