CVE-2026-12270 Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints

The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or...

CVE-2026-22927

creationtimestamp| type| source ---|---|--- 2026-07-09 05:50:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116888450705839903 2026-08-05 08:27:26+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3msd47cgijk2y...

GHSA-QCJ2-99CG-MPPF

creationtimestamp| type| source ---|---|--- 2026-07-09 03:00:06+00:00| seen| https://t.me/brutsecurity/2141 2026-07-10 00:00:14+00:00| seen| https://t.me/brutsecurity/2141 2026-07-11 12:00:04+00:00| published-proof-of-concept| https://t.me/brutsecurity/2141 2026-07-12 00:00:50+00:00|...

CVE-2026-15126

creationtimestamp| type| source ---|---|--- 2026-07-09 00:07:16+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116887102125782254 2026-07-09 04:45:52+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260709...

CVE-2026-15129

creationtimestamp| type| source ---|---|--- 2026-07-09 00:00:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/116887076049207813 2026-07-09 00:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq6dcbdhns2x 2026-07-09 00:20:37+00:00| seen|...

PT-2026-57039

Impact An authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid state STATE NEW, does no...

PT-2026-57037

Name of the Vulnerable Software and Affected Versions nebula-mesh versions 0.3.6 and earlier Description Two authorization gaps in nebula-mgmt allow untrusted hosts to obtain valid certificates. First, the system fails to enforce the blocklist during certificate issuance or re-enrollment. Because...

SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:2804-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2804-1 advisory. - CVE-2026-9804: Symlink escape in the VMExport dir handler let an attacker controlling an exported PVC read sensitive files TLS...

CVE-2026-15117

creationtimestamp| type| source ---|---|--- 2026-07-08 23:40:14+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116886995883476905 2026-07-09 04:45:28+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260709...

CVE-2026-6896

creationtimestamp| type| source ---|---|--- 2026-07-08 22:01:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mq64mdoxis2a 2026-07-09 02:15:33+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mq6kthtf7u2i 2026-07-09 14:35:07+00:00| seen|...

GHSA-Q95X-7G78-RCCV

creationtimestamp| type| source ---|---|--- 2026-07-08 20:42:49+00:00| seen| https://gist.github.com/alon710/e724b6feec120f49892cbfa2764ae8ba...

CVE-2026-59883

creationtimestamp| type| source ---|---|--- 2026-07-08 19:23:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tsoicmx2x 2026-07-13 17:48:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkatpltbc2e 2026-07-16 08:03:53+00:00| seen|...

Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration

A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENTCERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable...

CVE-2026-49946

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-0288

creationtimestamp| type| source ---|---|--- 2026-07-08 16:15:21+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116885246523577101 2026-07-08 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soxii4n22 2026-07-08 20:15:02+00:00| seen|...

CVE-2024-30326

creationtimestamp| type| source ---|---|--- 2026-07-08 15:42:47+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/116885118437929306...

CVE-2026-24698

creationtimestamp| type| source ---|---|--- 2026-07-08 15:20:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116885031205203938 2026-07-08 18:07:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pkgwrsc26...

CVE-2026-24697

creationtimestamp| type| source ---|---|--- 2026-07-08 15:07:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116884978509623557...

CVE-2026-57243

During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the application to crash...

CVE-2026-57243

During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the application to crash...