CVE-2026-45616

Vvveb CMS contains a stored XSS in Posts that can lead to privilege escalation via the post editor. Affected before 1.0.8.3; fixed in 1.0.8.3. CVE-2026-45616. Exploitation details are not provided in the documents; CIRCL notes a published PoC on Telegram.

CVE-2026-45616 Vvveb: Stored XSS in Posts allows privilege escalation via post editor

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, This vulnerability is fixed in 1.0.8.3...

CVE-2021-47967

CVE-2021-47967 affects PHP Timeclock 1.04 with multiple cross-site scripting (XSS) vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can target login.php, timeclock.php, audit.php, and timerpt.php endpoints...

CVE-2021-47967 PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...

EUVD-2021-34822

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...

GHSA-RC6V-5RMX-W5MV arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and KMS TLS client. All require specific preconditions to exploit and do not allow direct code execution or immediate key extraction. A self-contained PoC is attached. Details 1 ACK...

arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and KMS TLS client. All require specific preconditions to exploit and do not allow direct code execution or immediate key extraction. A self-contained PoC is attached. Details 1 ACK...

CVE-2026-37541

creationtimestamp| type| source ---|---|--- 2026-05-15 13:03:31+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mlvfespgwk2k 2026-05-20 16:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmcbyhnwol2r...

CVE-2026-8398

creationtimestamp| type| source ---|---|--- 2026-05-15 10:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv35uqdzj2k 2026-05-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/11739434-0930-4569-82cd-80d659d1039f...

BIT-JUPYTERLAB-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager allowedextensionsuris is not correctly enforced by JupyterLab. The Py...

CVE-2026-7525

creationtimestamp| type| source ---|---|--- 2026-05-15 06:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlupjlfta42h...

CVE-2026-41553

creationtimestamp| type| source ---|---|--- 2026-05-15 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-7182 2026-05-15 14:31:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvkczupkk2c...

CVE-2026-41552

creationtimestamp| type| source ---|---|--- 2026-05-15 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-7182 2026-05-15 14:51:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvlgu5qpm2o...

CVE-2026-7182

creationtimestamp| type| source ---|---|--- 2026-05-15 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-7182...

CVE-2026-44051

creationtimestamp| type| source ---|---|--- 2026-05-15 04:08:09+00:00| seen| https://bsky.app/profile/slackers.it/post/3mluh44cimk2b 2026-05-21 13:44:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmekhwn57y2r 2026-05-22 09:00:34+00:00| seen|...

Malicious code in cdp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf55b093e3a93e8d3f536101e62e09cf7e86636cd42813d02f518138cbcb8ed The package ships cdpinject.js, which combines childprocess, fs, http/https, and base64 encoding to gather system information and exfiltrate it over...

CVE-2026-6811

creationtimestamp| type| source ---|---|--- 2026-05-15 02:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlubaimv242n...

CVE-2026-8612

creationtimestamp| type| source ---|---|--- 2026-05-15 02:05:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mluam7kbww2b...

CVE-2026-31233

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

Quantum Futures Interactive: A Live Demonstration of Post-Quantum Blockchain Security, Infrastructure Tradeoffs, and Sustainable Distributed Trust

Advances in quantum computing introduce long-term security challenges for widely deployed public-key cryptographic systems used across blockchain platforms and decentralized applications. Although post-quantum cryptography PQC standards are emerging, understanding quantum risk remains fragmented...