VulnCheck KEV: CVE-2026-48907

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users...

CVE-2026-49973

creationtimestamp| type| source ---|---|--- 2026-06-11 22:42:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2cdqxxsm2g 2026-06-11 23:04:42+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mo2dledkjf23 2026-06-15 00:01:40+00:00| seen|...

CVE-2026-38581

creationtimestamp| type| source ---|---|--- 2026-06-11 17:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnzpc36i4v2g 2026-06-11 17:38:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnzrdagmfn2m...

CVE-2026-9694

creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 14:17:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnzg4ypw7e24 2026-06-11 18:00:00+00:00| seen|...

CVE-2026-40998

creationtimestamp| type| source ---|---|--- 2026-06-11 09:41:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnywpflqyn2r 2026-06-11 10:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnyxrpj3pv2i 2026-06-11 12:40:07+00:00| seen|...

CVE-2026-24187

creationtimestamp| type| source ---|---|--- 2026-06-11 04:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mnydz7e3co2o 2026-06-11 04:07:09+00:00| seen| https://bsky.app/profile/potato.software/post/3mnydzaulpn2f...

CVE-2026-35273

creationtimestamp| type| source ---|---|--- 2026-06-11 00:39:42+00:00| seen| https://www.acn.gov.it/portale/w/rilevata-vulnerabilita-in-oracle-1 2026-06-11 03:02:12+00:00| seen| https://bsky.app/profile/baldanders.info/post/3mnyaf4l2qg2y 2026-06-11 03:02:21+00:00| seen|...

CVE-2026-49956

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to...

CVE-2025-6254

creationtimestamp| type| source ---|---|--- 2026-06-10 11:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnwkntijit26 2026-06-10 11:11:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwlbd3rzn2c 2026-06-10 12:00:15+00:00| seen|...

CVE-2026-9185

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserInfo and...

CVE-2026-46518

creationtimestamp| type| source ---|---|--- 2026-06-10 01:00:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvj3po4ik2r 2026-06-10 02:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvmi3n2fb2n...

CVE-2026-48303

creationtimestamp| type| source ---|---|--- 2026-06-09 22:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnv73qzggu2v 2026-06-09 22:12:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv7picz7l2o 2026-06-10 04:30:30+00:00| seen|...

CVE-2026-49956

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to...

CVE-2026-45447

creationtimestamp| type| source ---|---|--- 2026-06-09 13:57:29+00:00| seen| https://bsky.app/profile/xeiaso.net/post/3mnue2z4hbv2v 2026-06-09 14:00:28+00:00| seen| https://bsky.app/profile/cadey.pony.social.ap.brid.gy/post/3mnue3epkwyc2 2026-06-09 14:48:37+00:00| seen|...

CVE-2026-9185 6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserInfo and...

WordPress plugin 6Storage Rentals 安全漏洞

WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the functionality of WordPress. There is a security vulnerability in WordPress Plugin...

PT-2026-47854

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to...

CVE-2026-46656

creationtimestamp| type| source ---|---|--- 2026-06-08 17:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mns5t6aszh2s 2026-06-08 17:02:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns5w7ytr72f...

CVE-2026-50131

creationtimestamp| type| source ---|---|--- 2026-06-08 14:57:55+00:00| seen| https://bsky.app/profile/fedify.hollo.social.ap.brid.gy/post/3mnrwxyyvdir2 2026-06-08 15:09:05+00:00| seen| https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mnrxlz2slhe2 2026-06-09 02:30:30+00:00| seen|...

6Storage Rentals < 2.27.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter

Description The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.26.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserIn...