CVE-2026-1949

creationtimestamp| type| source ---|---|--- 2026-04-24 06:42:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk7wcyzbd22n 2026-04-24 07:15:43+00:00| seen| Telegram/wWQtDkhRnA9qn3zMxBPWcdzUosuSeXfPexeyw8Vo0UIcA 2026-04-24 07:55:46+00:00| seen|...

CVE-2026-5364

creationtimestamp| type| source ---|---|--- 2026-04-24 06:42:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk7wcrsxiu2f 2026-04-24 07:15:43+00:00| seen| Telegram/wWQtDkhRnA9qn3zMxBPWcdzUosuSeXfPexeyw8Vo0UIcA 2026-04-24 07:57:11+00:00| seen|...

CVE-2026-42313

creationtimestamp| type| source ---|---|--- 2026-04-24 06:09:54+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85 2026-05-11 18:25:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllviz63oy2n 2026-05-11...

CVE-2026-5347 WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admininit hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php...

CVE-2026-5347

The HM Books Gallery WordPress plugin is affected up to version 4.8.0 by Missing Authorization to unauthenticated settings updates. The vulnerability resides in the admin_init hook that processes permalink settings updates (lines around 205–209 in wp-books-gallery.php), where the code only checks...

EUVD-2026-25398

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admininit hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php...

CVE-2026-41068

creationtimestamp| type| source ---|---|--- 2026-04-24 05:18:58+00:00| seen| Telegram/kIuLSWSF-lSSH53f04z2OEjKv8ykvXtTNiYc9dOAOt4c 2026-04-24 05:46:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk7t5usvb52w...

CVE-2026-41317

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

CVE-2026-23902

creationtimestamp| type| source ---|---|--- 2026-04-24 03:05:46+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk7k7cbd5q2u 2026-04-24 22:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbjnkyle32z...

CVE-2026-41317

The CVE concerns Press, a Frappe-based app, where the API endpoint press.api.account.create_api_secret is vulnerable to CSRF-like exploits. The issue stems from the endpoint accepting unsafe HTTP methods (GET) and writing to the database, enabling unauthorized actions without user interaction. A ...

CVE-2026-41317 Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

CVE-2026-41317

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

CVE-2026-41317 Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

EUVD-2026-25386

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

CVE-2026-31952

creationtimestamp| type| source ---|---|--- 2026-04-24 01:17:38+00:00| seen| Telegram/y1cMF7MSs4iKIz6Tjc1sXNbleG9GlRmZjivyp4DyaM6b6bo 2026-04-25 00:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbqclg6wn2s...

EUVD-2026-25348

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

D-Link DIR-823X Command Injection Vulnerability

D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/setprohibiting via the corresponding function. The impacted product could be end-of-life EoL and/or end-of-service EoS...

PT-2026-34961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. The function smbd send batch flush already invokes smbd free send io, leading to a second call to smbd free send io after smbd post send mov...

PT-2026-34874

AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser. Critically, this...

PT-2026-34854

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php...