22403 matches found
CVE-2026-17497
creationtimestamp| type| source ---|---|--- 2026-07-26 16:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrkqtqq7or2l 2026-07-26 16:11:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrkrimr3t32u 2026-07-26 18:07:21+00:00| seen|...
Langflow < 1.7.0 - Path Traversal
Langflow 1.7.1 contains a path traversal caused by insufficient filtering of foldername and filename parameters in downloadprofilepicture endpoint, letting attackers read secretkey across directories, exploit requires crafted request. id: CVE-2026-33497 info: name: Langflow 1.7.0 - Path Traversal...
Spring Cloud Config Server - Path Traversal
Spring Cloud 3.1.x 3.1.13, 4.1.x 4.1.9, 4.2.x 4.2.3, 4.3.x 4.3.2, and 5.0.x 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. i...
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...
DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/dns.php Profile Name or notes field. id: CVE-2018-19914 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...
Profile Builder < 3.4.9 - Improper Authentication
The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...
CVE-2026-64377
creationtimestamp| type| source ---|---|--- 2026-07-25 23:05:05+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mriy4kdudc27 2026-07-25 23:05:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116983116934621098 2026-07-26 01:04:54+00:00| seen|...
CVE-2026-56167
creationtimestamp| type| source ---|---|--- 2026-07-25 11:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhpmyb3gk2m...
CVE-2026-14603
creationtimestamp| type| source ---|---|--- 2026-07-25 10:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhmbkn5gq2e...
EUVD-2026-48859
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...
CVE-2026-64515
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...
CVE-2026-64515
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...
CVE-2026-49743
creationtimestamp| type| source ---|---|--- 2026-07-25 09:00:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhiwg4atl2u...
WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...
WordPress Core <6.5.2 - Cross-Site Scripting
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...
User Profile Builder < 3.11.8 - File Upload
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. id: CVE-2024-6366 info: name: User Profile Builder 3.11.8 - File Upload author: s4e-io severity: high...
CVE-2026-58662
creationtimestamp| type| source ---|---|--- 2026-07-25 00:08:51+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgl7nigny2g 2026-07-26 05:02:38+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mrjm3uyai72n...
CVE-2026-55971
creationtimestamp| type| source ---|---|--- 2026-07-24 23:53:48+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgkeq7s3y2x...