GHSA-WVPP-8HX9-P66J

creationtimestamp| type| source ---|---|--- 2026-08-07 16:40:33+00:00| seen| https://gist.github.com/alon710/7b081fe119ed64f00c308eff03c67cc3...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

EUVD-2026-54518

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-17599

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

CVE-2026-17596 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-65667

creationtimestamp| type| source ---|---|--- 2026-08-07 14:14:20+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117054639846574727 2026-08-11 19:00:48+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 22:01:15+00:00| seen|...

GHSA-MJ63-M3RC-8PPR

creationtimestamp| type| source ---|---|--- 2026-08-07 12:34:21+00:00| seen| https://gist.github.com/alon710/b81b5b8f072a27c4fa74e05558afb769...

CVE-2026-54212

creationtimestamp| type| source ---|---|--- 2026-08-07 12:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117054113463561947 2026-08-07 12:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msij23ny7t2v...

CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

GHSA-J4R3-HG7J-8CHG

creationtimestamp| type| source ---|---|--- 2026-08-07 05:35:28+00:00| seen| https://gist.github.com/alon710/0c61a6195ede2fd8a0ca10d8b63bbf6e...

GHSA-7HXC-F267-H5Q7

creationtimestamp| type| source ---|---|--- 2026-08-07 02:36:06+00:00| seen| https://gist.github.com/alon710/1974365b37727353ce889eba0d08c78c...

CVE-2026-70332

creationtimestamp| type| source ---|---|--- 2026-08-07 00:39:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4lj3nhvrrea35 2026-08-07 01:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mshehxaaht2a 2026-08-07 01:30:27+00:00| seen|...

EUVD-2026-54188

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

CVE-2026-15805

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2026-68867

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.0 Description The MStore API WordPress plugin fails to verify payment status with the payment gateway before marking an order as paid on several payment-completion endpoints. This allows an unauthenticated...

PT-2026-69058

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 versions prior to 3.95.0 Description Stored cross-site scripting XSS occurs when a user with nexus:blobstores:create or nexus:blobstores:update permissions sets a blob store name containing malicious script content. This...

RHEL 10 : postfix (RHSA-2026:51436)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:51436 advisory. The postfix packages provide a Mail Transport Agent MTA, which supports protocols like LDAP, SMTP AUTH SASL, and TLS. Security Fixes: postfix: buff...

Linux Distros Unpatched Vulnerability : CVE-2026-64652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain...