CVE-2026-41246

creationtimestamp| type| source ---|---|--- 2026-04-23 19:33:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qvtzqbz2z 2026-04-23 21:26:07+00:00| published-proof-of-concept| Telegram/wY3PGk1V7kusFG8GbDK0g0CtGhXXIm9UsDC-frBku-7BiY 2026-07-23 16:07:07+00:00| seen|...

CVE-2026-41271 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery SSRF vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests t...

CVE-2026-41043

creationtimestamp| type| source ---|---|--- 2026-04-23 18:25:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk6n4dcaab2j...

CVE-2026-21841

creationtimestamp| type| source ---|---|--- 2026-04-23 18:19:41+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mk6mslzmsa24...

Insertion of Sensitive Information into Log File

Overview n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol MCP Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the POST /mcp endpoint. An attacker can cause sensitive information such as bearer tokens, API...

CVE-2026-35333

creationtimestamp| type| source ---|---|--- 2026-04-23 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk675r76zg27 2026-05-14 11:00:13+00:00| published-proof-of-concept| Telegram/KyHCshI6yZBJj8Foftsx5hfP7GLhbMmJ81CYC3g7d-oupU...

CVE-2026-35334

creationtimestamp| type| source ---|---|--- 2026-04-23 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk675r76zg27...

GHSA-W5HQ-G745-H8PQ

creationtimestamp| type| source ---|---|--- 2026-04-23 12:01:01+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mk5xnhyzsk2o 2026-05-05 06:40:28+00:00| seen| https://gist.github.com/alon710/cc4d9b85509a9bc85167e4592e568bc8 2026-05-07 12:01:09+00:00| seen|...

CVE-2026-6903

creationtimestamp| type| source ---|---|--- 2026-04-23 11:16:50+00:00| seen| Telegram/ktjXxLVyV5R1pEh3LQjVpZ79M83Qn9HPDb5Pz3RQONWfCA 2026-04-23 21:45:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6ycevudf2t...

CVE-2026-5464

creationtimestamp| type| source ---|---|--- 2026-04-23 11:16:37+00:00| seen| Telegram/wFSQsgW7X9YvnPcwQoIwWZcAEOwcl2-nLfGCKL8FlikswBY 2026-04-24 09:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mka7tvrujp2s...

Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure

The Ajax Load More – Infinite Scroll plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.6.0.2. The plugin's AJAX endpoint wpajaxnoprivalmgetposts allows unauthenticated users to access non-public posts draft, private, pending, future, tras...

Automated-CSRF-PoC-Generator

Description: A specialized Python script designed to automate th...

CVE-2026-42295

creationtimestamp| type| source ---|---|--- 2026-04-23 08:17:49+00:00| published-proof-of-concept| https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf 2026-05-09 04:50:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfh2xgpod2e...

CVE-2026-41564

creationtimestamp| type| source ---|---|--- 2026-04-23 07:54:13+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk5ju6g7262v 2026-04-23 15:16:16+00:00| published-proof-of-concept| Telegram/GpzWIna0u4Xk2Mxyx7IImpynDcGXZQ8MHW9U4L55IHFQ 2026-04-23 21:45:30+00:00| seen|...

CVE-2026-3361 WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta

The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsladdress' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress WP Store Locator plugin <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'wpsladdress' Post Meta vulnerability discovered by kai63001 in WordPress Plugin WP Store Locator versions = 2.2.261...

CVE-2026-41243

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when safeMode is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit...

Froxlor 后置链接漏洞

Froxlor is a set of lightweight server management software developed by the Froxlor team. Versions of Froxlor prior to 2.3.6 had a post-installation link vulnerability. This vulnerability stemmed from the DataDump.add function not passing the $fixedhomedir parameter when constructing the export...

PT-2026-34631

The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl address' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

SWUpdate 缓冲区错误漏洞

SWUpdate is an embedded Linux system update tool developed by Stefano Babic. SWUpdate has a buffer error vulnerability, which stems from an integer underflow in the multipart upload parser in the mongoosemultipart.c file. This vulnerability allows unauthenticated attackers to cause...