CVE-2026-53598

creationtimestamp| type| source ---|---|--- 2026-07-16 16:02:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrmda6exv2n...

CVE-2026-12379

CVE-2026-12379 is an open redirect vulnerability in the Axivion Dashboard’s OAuth/OIDC login flow. The post-authentication redirect is not restricted to the application’s own origin, allowing an attacker to craft a login link that, after authentication, redirects the user to an untrusted external...

CVE-2026-35147

creationtimestamp| type| source ---|---|--- 2026-07-16 15:05:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrj54hrth22 2026-07-22 11:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mra6lx5u262s...

CVE-2026-30623

creationtimestamp| type| source ---|---|--- 2026-07-16 14:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrhlonigc2y 2026-07-17 16:01:54+00:00| seen| https://bsky.app/profile/moez19.bsky.social/post/3mqu4qhknhb2i 2026-07-22 17:00:05+00:00| seen|...

CVE-2026-15917

creationtimestamp| type| source ---|---|--- 2026-07-16 13:05:09+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrcfgib2s2a...

CVE-2026-20157

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrc566sg32e 2026-07-16 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-cisco-28...

CVE-2026-6424

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrc4snwj324 2026-07-16 14:22:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqrgqi6bdf2g...

Malicious code in @hibachi-xyz/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...

Malicious code in @hibachi-xyz/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...

Malicious code in @hibachi-xyz/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...

CVE-2026-15407

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-12978

creationtimestamp| type| source ---|---|--- 2026-07-16 07:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqr3rj5be2u...

CVE-2026-15407 Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-15407

The CVE-2026-15407 entry describes an authorization bypass in Themify Builder for WordPress up to version 7.7.7. The underlying issue is insufficient verification of a user’s authorization for actions performed via the tb_generate_on_fly AJAX action, enabling authenticated users with subscriber-l...

CVE-2026-12395

creationtimestamp| type| source ---|---|--- 2026-07-16 07:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqsfnohs22...

CVE-2026-12906

creationtimestamp| type| source ---|---|--- 2026-07-16 07:45:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqkgc65d22...

CVE-2026-15306

creationtimestamp| type| source ---|---|--- 2026-07-16 07:41:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqdhqwci2a...

CVE-2026-12906

The CVE-2026-12906 entry concerns RTMKit Addons for Elementor for WordPress. It affects the plugin prior to version 2.0.9, where an AJAX action does not perform a necessary capability check and returns a post identifier supplied in the request. This allows users with at least the Contributor role...

CVE-2026-12906 RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure

The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed pos...

EUVD-2026-44879

The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed pos...