CVE-2026-7105

CVE-2026-7105 affects the WordPress plugin Xpro Addons up to version 1.5.1. The root cause is a missing capability check in the get_menu_content_editor() function, allowing authenticated users with Subscriber+ privileges to create arbitrary published posts of the xpro_content CPT. The created pos...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-16942 WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

EUVD-2026-53105

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

CVE-2020-9687

creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:08+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:56+00:00| seen| https://t.me/timcorehacking/946...

CVE-2026-67555

The CVE-2026-67555 entry concerns Apache Qpid Proton-Dotnet up to version 1.0.0, where the maximum number of transfer frames per incoming delivery could not be governed. This could allow an authenticated attacker to cause excessive resource usage and potential denial of service (availability impa...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

CVE-2020-1216

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:05+00:00| seen| https://t.me/timcorehacking/907 2026-08-06 00:00:54+00:00| seen| https://t.me/timcorehacking/907...

CVE-2020-6469

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:05+00:00| seen| https://t.me/timcorehacking/890 2026-08-06 00:00:53+00:00| seen| https://t.me/timcorehacking/890...

CVE-2026-70592

creationtimestamp| type| source ---|---|--- 2026-08-05 03:31:03+00:00| seen| https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14...

GHSA-MC57-H6J3-3HMV vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, bento, splunk-otel-collector, dapr...

GHSA-W8J3-PQ8G-8M7W vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, bento, splunk-otel-collector, dapr...

EUVD-2026-53022

A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit i...

SUSE CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

Photon OS 5.0: Openssl PHSA-2024-5.0-91-0313

An update of the openssl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0313. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Glibc PHSA-2024-5.0-91-0250

An update of the glibc package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0250. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : fence-agents (RHSA-2026:50655)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50655 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

Photon OS 5.0: Libtiff PHSA-2025-5.0-90-0579

An update of the libtiff package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-90-0579. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-59817

creationtimestamp| type| source ---|---|--- 2026-08-04 22:31:36+00:00| seen| https://gist.github.com/alon710/206e14659b338e0afd8d846fac0809f6 2026-08-05 00:00:39+00:00| seen| https://gist.github.com/alon710/206e14659b338e0afd8d846fac0809f6...

CVE-2026-18817 Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...