EUVD-2026-29893

After invoking $internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine through $where, $function, mapreduce reduce stage, etc. is used also in...

CVE-2026-44579 Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected...

CVE-2026-44579

Next.js vulnerability CVE-2026-44579 affects Next.js releases prior to 15.5.16 and 16.2.5 where Partial Prerendering via Cache Components can cause a connection-exhaustion DoS through crafted POST requests to a server action. A malicious request may trigger a request-body handling deadlock, leavi...

CVE-2020-37222

Kuicms Php EE 2.0 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted content through the bbs reply endpoint. Attackers can send POST requests to /web/?c=bbs&a=reply with HTML and JavaScript payloads in t...

CVE-2026-46300

creationtimestamp| type| source ---|---|--- 2026-05-13 16:13:56+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3mlqp45cmyy2s 2026-05-13 16:40:58+00:00| seen| https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mlqqk6pezwi2 2026-05-13 16:41:34+00:00| seen|...

CVE-2026-8369

creationtimestamp| type| source ---|---|--- 2026-05-13 16:12:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlqozhmhzy2k...

CVE-2026-42266

JupyterLab prior to 4.5.7 is affected: from 4.0.0 to 4.5.6 the allow-list for PyPI Extension Manager extensions could be bypassed, as allowed_extensions_uris was not properly enforced and not confined to the default PyPI index. This could allow an authenticated attacker to install unapproved/mali...

CVE-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager allowedextensionsuris is not correctly enforced by JupyterLab. The Py...

CVE-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager allowedextensionsuris is not correctly enforced by JupyterLab. The Py...

CVE-2020-37222 Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply

Kuicms Php EE 2.0 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted content through the bbs reply endpoint. Attackers can send POST requests to /web/?c=bbs&a=reply with HTML and JavaScript payloads in t...

CVE-2020-37222

Kuicms Php EE 2.0 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted content through the bbs reply endpoint. Attackers can send POST requests to /web/?c=bbs&a=reply with HTML and JavaScript payloads in t...

CVE-2020-37168

Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint,...

CVE-2020-37168

The CVE-2020-37168 entry concerns Ecommerce Systempay 1.0, where a weak cryptographic implementation exposes a 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint and perform a ...

CVE-2026-39803

CVE-2026-39803 – Bandit (Elixir) memory exhaustion via chunked HTTP/1 bodies. The issue occurs in the chunked path of Elixir.Bandit.HTTP1.Socket.read_data/2 where the caller-supplied length is ignored; every received chunk is buffered into an iolist and the entire body is materialized as a single...

CVE-2026-4873

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text via IMAP, SMTP, or POP3, a subsequent request to that same host bypasses the TLS requirement and instead transm...

CVE-2026-4782

creationtimestamp| type| source ---|---|--- 2026-05-13 12:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlqdbejomm2v 2026-05-13 14:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlqjfyf55y2h 2026-05-14 00:44:08+00:00| seen|...

CVE-2026-0265

creationtimestamp| type| source ---|---|--- 2026-05-13 10:50:42+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-462 2026-05-13 19:03:35+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlqylasqg32u 2026-05-13 20:00:00+00:00| seen|...

CVE-2026-2291

creationtimestamp| type| source ---|---|--- 2026-05-13 07:08:33+00:00| seen| https://bsky.app/profile/kompetenztraining.bsky.social/post/3mlpqmwyz5d2n 2026-05-13 12:31:36+00:00| seen| https://vulnerability.circl.lu/bundle/bb20f34e-4314-42f2-8e6b-cb2c917339bc 2026-06-01 09:00:04+00:00| seen|...

CVE-2017-3109

creationtimestamp| type| source ---|---|--- 2026-05-13 05:25:01+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlpktscrwu26...

CVE-2026-7051 Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...