CVE-2026-42458

CVE-2026-42458 (Magento LTS/OpenMage Magento-LTS) : A reflected XSS in the admin-import/export Dataflow - Profiles feature allows injection via the filename parameter in the Dataflow Import path. Affected: OpenMage/magento-lts (unofficial Magento LTS) prior to version 20.18.0. Evidence across sou...

CVE-2026-42458 Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel - System - Import/Export -...

Malicious code in cheerio-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d51a2885f4eaff732d1ef7ab065b04d21c59263b1212d5b92b92c87914ef879 cheerio-tool typosquats the popular cheerio HTML parser README claims 'Cheerio Tool utility helpers', keywords are 'lodash','utilities', and index.js...

dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...

GHSA-XPWW-F6PM-CFHQ dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...

CVE-2026-8328

creationtimestamp| type| source ---|---|--- 2026-05-14 00:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrjejlkhq2i 2026-05-14 01:19:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlrnl5s34g22 2026-05-17 15:04:58+00:00| seen|...

CVE-2026-40629

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-42920

CVE-2026-42920 affects BIG-IP DTLS: when a Client SSL profile has Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS as TMM restarts. The F5 advisory notes this is a data-plane issue with rem...

CVE-2026-40629

CVE-2026-40629 affects BIG-IP SSL/TLS when SSL profiles are configured on a virtual server. The issue can cause the virtual server to stop processing new client connections, effectively a DoS for new connections. The F5 advisory confirms this is a data plane issue; no control plane exposure. Miti...

WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin ProfileGrid versions = 5.9.8.4...

CVE-2026-42288

creationtimestamp| type| source ---|---|--- 2026-05-13 01:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlp5qjkhja2g 2026-05-13 01:30:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/116564677807182613 2026-05-13 01:31:22+00:00| seen|...

PT-2026-40651

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 17.1.3.1 F5 BIG-IP versions prior to 17.5.1.4 BIG-IP Next SPK affected versions not specified BIG-IP Next CNF affected versions not specified BIG-IP Next for Kubernetes affected versions not specified Description Wh...

CVE-2026-42864

creationtimestamp| type| source ---|---|--- 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:35:42+00:00| seen|...

CVE-2026-45223

creationtimestamp| type| source ---|---|--- 2026-05-11 20:02:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wduquj2k 2026-05-11 20:30:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlm4jgz6l62e...

EUVD-2026-29116

HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/ and /interview/ endpoints. The route handlers retrieve records by the user-supplied ID without verifying that the requesting user is the owner or has an authoriz...

CVE-2026-45000 OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

CVE-2026-45000

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

CVE-2026-45000

OpenClaw before 2026.4.20 is affected by a server-side request forgery in the browser CDP profile creation flow. The vulnerability allows creation of stored profiles that can point to private-network or metadata endpoints and bypass strict-mode SSRF policy checks, with the sensitive endpoints pot...

CVE-2026-25244

creationtimestamp| type| source ---|---|--- 2026-05-11 14:43:50+00:00| published-proof-of-concept| https://github.com/webdriverio/webdriverio/security/advisories/GHSA-5c46-x3qw-q7j7 2026-05-19 22:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmafn7z22w2u 2026-05-20 14:50:44+00:0...

CVE-2025-10470

creationtimestamp| type| source ---|---|--- 2026-05-11 12:28:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllbkwuvla2e 2026-05-11 12:30:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllboi27ef2i 2026-05-12 11:39:41+00:00| seen|...