PT-2026-37090

Name of the Vulnerable Software and Affected Versions OpenStack Horizon versions 25.6 through 25.7.2 OpenStack Horizon versions 25.7 through 25.7.2 Description A write operation occurs in the session storage backend before authentication, allowing unauthenticated requests to exhaust the storage...

PT-2026-36982

Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified Description A race condition occurs when processing badge-swipe data from specific HP multifunction devices. Under certain network conditions involving dropped packets and out-of-order sequence...

PT-2026-36979

Name of the Vulnerable Software and Affected Versions GenerateBlocks versions prior to 2.2.1 Description The plugin is subject to Insecure Direct Object Reference IDOR, a flaw where an application provides direct access to objects based on user-supplied input. The issue exists in the...

PT-2026-36954

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the futureaction shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The...

FacturaScripts 安全漏洞

FacturaScripts is an open-source ERP software developed by Carlos Garcia, a Spanish developer. Versions of FacturaScripts prior to 2025.92 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of the nick parameter in the POST request of the EditUser...

CVE-2026-42221

creationtimestamp| type| source ---|---|--- 2026-05-04 21:35:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2mueqssi2e 2026-05-04 22:32:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2q2ndiwr2i 2026-05-06 18:07:08+00:00| seen|...

CVE-2026-42222

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available...

CVE-2026-41926

creationtimestamp| type| source ---|---|--- 2026-05-04 21:01:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2kyfnef32k 2026-05-05 01:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116519379011969410 2026-05-05 01:30:28+00:00| seen|...

CVE-2026-42236

creationtimestamp| type| source ---|---|--- 2026-05-04 20:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2kph5rca2h 2026-05-13 18:30:06+00:00| seen| https://t.me/truesecator/8200...

CVE-2026-41925

creationtimestamp| type| source ---|---|--- 2026-05-04 20:42:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2jvukepv2v...

CVE-2026-41923

creationtimestamp| type| source ---|---|--- 2026-05-04 20:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2jdrriv32c...

CVE-2026-7686

A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.js of the component Legacy Premium Activation. Performing a manipulation results in improper access controls. Remote exploitation of the...

CVE-2026-5077

The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering thetitle inside HTML attribute context in the home blog section template. This makes it possible for authenticated...

CVE-2026-37459

creationtimestamp| type| source ---|---|--- 2026-05-04 20:18:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2ilegyf52n...

CVE-2026-41924

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the settime or StartSniffer functions. Attackers can...

CVE-2026-41923

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit...

CVE-2026-25863

creationtimestamp| type| source ---|---|--- 2026-05-04 19:28:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2fs6mh6j2e 2026-05-04 20:35:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2jj5y23l2t...

CVE-2026-42151

creationtimestamp| type| source ---|---|--- 2026-05-04 19:28:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2frpcll426 2026-05-07 18:07:47+00:00| seen| https://gist.github.com/cwayne18/c6798b17a9150ada7489927525e07176 2026-05-08 15:28:37+00:00| seen|...

CVE-2026-7768

creationtimestamp| type| source ---|---|--- 2026-05-04 19:21:22+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3ml2fex7c4s2n 2026-05-04 20:18:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2ikvmow326 2026-05-04 22:45:08+00:00| seen|...

CVE-2026-41927 WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgi

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to overwrite the saved return address by sending a POST request with a Content-Length header exceeding 5...