PT-2026-34631

The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl address' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

SWUpdate 缓冲区错误漏洞

SWUpdate is an embedded Linux system update tool developed by Stefano Babic. SWUpdate has a buffer error vulnerability, which stems from an integer underflow in the multipart upload parser in the mongoosemultipart.c file. This vulnerability allows unauthenticated attackers to cause...

PT-2026-42875

Name of the Vulnerable Software and Affected Versions Edimax BR-6428NS version 1.10 Description Command injection is possible via a remote attack in the POST Request Handler component. The issue exists within the formWlbasic function located in the /goform/formWlbasic file, where improper...

PT-2026-34605

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when safeMode is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit...

PT-2026-34748

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

EUVD-2026-22847

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classcontainer' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied...

EUVD-2026-22828

The Advanced Custom Fields ACF plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions witho...

EUVD-2026-22822

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...

CVE-2026-41167

creationtimestamp| type| source ---|---|--- 2026-04-22 21:24:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4gnbxyzv2q 2026-04-22 22:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116450723807217963 2026-04-22 22:30:33+00:00| seen|...

GHSA-W937-FG2H-XHQ2 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

Summary Versions of the locize client SDK the browser module that wires up the locize InContext translation editor prior to 4.0.21 register a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled,...

CVE-2026-34062

creationtimestamp| type| source ---|---|--- 2026-04-22 20:24:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk4dcrkwpm2t...

CVE-2026-34415

creationtimestamp| type| source ---|---|--- 2026-04-22 20:01:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4bzgzyko2r 2026-04-22 21:21:17+00:00| published-proof-of-concept| Telegram/he0Z1Xxb4PMjQ5eYVBKNYLHtJZg-G0d3XJmG72co7nWMuw 2026-04-23 07:30:28+00:00| seen|...

CVE-2026-41468

creationtimestamp| type| source ---|---|--- 2026-04-22 20:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4bz7iiyc2k 2026-04-22 21:21:17+00:00| published-proof-of-concept| Telegram/he0Z1Xxb4PMjQ5eYVBKNYLHtJZg-G0d3XJmG72co7nWMuw 2026-04-23 09:00:28+00:00| seen|...

CVE-2026-35368

creationtimestamp| type| source ---|---|--- 2026-04-22 19:03:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk46smokds2l 2026-04-22 19:23:16+00:00| seen| Telegram/y1XO5mBm2flLcrjS5YpFLtlumq47M984z8tJCHSwnxFgvg 2026-04-29 16:48:01+00:00| seen|...

CVE-2018-25270

creationtimestamp| type| source ---|---|--- 2026-04-22 17:12:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3yl7zcvv2h 2026-05-31 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn6ctysno32z...

CVE-2018-25269

creationtimestamp| type| source ---|---|--- 2026-04-22 16:37:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3wnoofme2i...

CVE-2018-25265

creationtimestamp| type| source ---|---|--- 2026-04-22 16:35:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3wis6de62v 2026-05-31 07:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn52mjrfc72v...

CVE-2018-25261

creationtimestamp| type| source ---|---|--- 2026-04-22 16:26:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3vyiwriq2p 2026-04-22 19:13:32+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk47dxvtxa25 2026-05-28 19:37:07+00:00| seen|...

CVE-2026-6862

creationtimestamp| type| source ---|---|--- 2026-04-22 16:20:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3voy6zmc2r...

CVE-2026-6855

creationtimestamp| type| source ---|---|--- 2026-04-22 15:17:53+00:00| seen| Telegram/QeC7MO7ScSSiOVGXLKN0WnA843zzLxkQwsFJUKCqjpspjuY 2026-04-22 16:10:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk3v4dutit25...