CVE-2026-11328

The CVE-2026-11328 vulnerability affects the WordPress plugin Exclusive Addons for Elementor, with Stored Cross-Site Scripting via the post title parameter in all versions up to 2.7.9.8. Root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers (Contributor+...

CVE-2026-11328

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-53641

creationtimestamp| type| source ---|---|--- 2026-07-07 00:34:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzeagtf7d2w...

CVE-2026-43921

creationtimestamp| type| source ---|---|--- 2026-07-07 00:17:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzdbnq6ex2h...

CVE-2026-43928

creationtimestamp| type| source ---|---|--- 2026-07-07 00:14:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzd56dnhg26...

CVE-2026-53642

creationtimestamp| type| source ---|---|--- 2026-07-07 00:12:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzcyzwgmt2a...

CVE-2026-53643

creationtimestamp| type| source ---|---|--- 2026-07-07 00:10:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzcv6vysq26...

GHSA-9G22-W2GR-VCMP

creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:42+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgcfkjb2s...

PT-2026-56214

Name of the Vulnerable Software and Affected Versions New API versions prior to 0.12.0-alpha.1 Description The email and WeChat account binding endpoints use GET requests for state-changing account operations. In deployments where session cookies are sent on cross-site navigations, an attacker ca...

Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with...

PT-2026-56149

Name of the Vulnerable Software and Affected Versions WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell versions prior to 3.12.8 Description Unauthenticated attackers can achieve Remote Code Execution by sending unsanitized values through the postData parameter. The plug...

PT-2026-56298

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions 0.1.0 through 1.6.10 @better-auth/sso versions 1.7.0-beta.x Description An SSRF flaw exists in the provider registration flow where OpenID Connect OIDC endpoint URLs are accepted without proper validation. When...

PT-2026-56135

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471 Description An authenticated user can inject additional shell statements that execute on the remote server during deployment. This occurs because pre-deployment and post-deployment commands are...

VulnCheck KEV: CVE-2026-59800

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint this route is not covered by the dashboard middleware matcher, so no authorization check is applied. The sudoPassword field from the request body is written to t...

CVE-2025-68052

creationtimestamp| type| source ---|---|--- 2026-07-06 23:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpz7t2bl2m2n...

CVE-2023-22886

creationtimestamp| type| source ---|---|--- 2026-07-06 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpz7eoby722b...

CVE-2026-41899

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

CVE-2026-54496

creationtimestamp| type| source ---|---|--- 2026-07-06 21:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpz2fiw6dh2r 2026-07-17 19:28:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquibd7ypf22 2026-07-19 08:00:58+00:00| seen|...

CVE-2026-34038

creationtimestamp| type| source ---|---|--- 2026-07-06 21:32:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpz22rxij323 2026-07-07 18:02:15+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mq36shckli2n 2026-07-08 11:48:08+00:00| seen|...

CVE-2026-54769

creationtimestamp| type| source ---|---|--- 2026-07-06 21:32:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpz22qfgd22g 2026-07-06 22:35:25+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-q9p7-wqxg-mrhc 2026-07-10...