CVE-2026-6952

The CVE affects Zyxel AX7501-B1 firmware up to version 5.17(ABPC.7.2)C0, where a post-authentication command injection in the LogServer component of the syslog module is possible. An authenticated administrator can execute OS commands on the device, per the description. CVSS v3.1 metrics indicate...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

EUVD-2026-46145

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

PT-2026-61820

Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B1 versions prior to 5.17ABPC.7.2C0 Description A post-authentication command injection issue exists within the syslog component. An authenticated attacker with administrator privileges can execute arbitrary operating system...

CVE-2026-57495

creationtimestamp| type| source ---|---|--- 2026-07-20 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4icrfnis2e...

CVE-2026-53591

creationtimestamp| type| source ---|---|--- 2026-07-20 23:01:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4flzpkiu2m...

CVE-2026-64624

creationtimestamp| type| source ---|---|--- 2026-07-20 23:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fjxsamp2e 2026-07-21 00:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4j5mytxx2e...

CVE-2026-64650

creationtimestamp| type| source ---|---|--- 2026-07-20 22:55:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4fbegvcg23...

CVE-2026-53596

creationtimestamp| type| source ---|---|--- 2026-07-20 22:11:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4crfy6v32i...

CVE-2026-44583

creationtimestamp| type| source ---|---|--- 2026-07-20 21:57:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bzhro4d2i...

EUVD-2026-42313

Socket.IO: Engine.IO Polling Transport Connection Exhaustion...

CVE-2026-56624

creationtimestamp| type| source ---|---|--- 2026-07-20 21:30:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr4ai3v7co2r 2026-07-20 22:26:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4dmuhdiz24...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-60026

creationtimestamp| type| source ---|---|--- 2026-07-20 21:09:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr47dtknsf2o...

CVE-2026-8169

creationtimestamp| type| source ---|---|--- 2026-07-20 21:07:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr476wzvgh2i...

CVE-2026-56452

creationtimestamp| type| source ---|---|--- 2026-07-20 21:05:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr473himo32d 2026-07-20 22:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4c723ilb2q 2026-07-20 22:45:47+00:00| seen|...