CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

CVE-2026-64581

creationtimestamp| type| source ---|---|--- 2026-08-05 12:15:26+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-64581 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...

CVE-2026-4431

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-55998

The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...

EUVD-2026-53285

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-4431

The CVE-2026-4431 entry concerns the Easy Post Submission WordPress plugin (up to version 2.3.0). A missing capability check on create_post() enables an unauthenticated actor to invoke the rbsm_submit_post AJAX action (registered via wp_ajax_nopriv_rbsm_submit_post) without authorization when a p...

OpenSSL Security Advisory 20260805

OpenSSL Security Advisory 20260805 - A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries...

OpenSSL 3.6.0 < 3.6.4 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.6.4 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and n...

GHSA-3CG5-48J3-V4GV

creationtimestamp| type| source ---|---|--- 2026-08-04 21:31:22+00:00| seen| https://gist.github.com/alon710/e57220ec033758e1c7ba8d20ade18b9d...

CVE-2026-0163

creationtimestamp| type| source ---|---|--- 2026-08-04 19:21:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117038861597097181 2026-08-04 21:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwhpxgff2u 2026-08-05 10:34:59+00:00| seen|...

CVE-2026-6837

creationtimestamp| type| source ---|---|--- 2026-08-04 14:06:53+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msb6peubta2r 2026-08-04 14:06:56+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117037623751892634 2026-08-17 18:00:04+00:00| seen|...

CVE-2026-18612

creationtimestamp| type| source ---|---|--- 2026-08-04 12:16:18+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msayjnlhrc2j 2026-08-04 12:16:19+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117037188953476018 2026-08-04 16:00:44+00:00| seen|...

GHSA-22JQ-VG5J-6VGG

creationtimestamp| type| source ---|---|--- 2026-08-04 10:32:20+00:00| seen| https://gist.github.com/alon710/539d26ece962aef59230f2218cc50bae...

CVE-2026-58061

creationtimestamp| type| source ---|---|--- 2026-08-04 09:28:17+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/117036528234088485...

GHSA-3F7W-8RR8-F37F

creationtimestamp| type| source ---|---|--- 2026-08-04 08:31:39+00:00| seen| https://gist.github.com/alon710/e29226c330282c9416a9859028fe2877 2026-08-17 15:00:04+00:00| seen| https://t.me/bdufstecru/3388 2026-08-18 00:00:28+00:00| published-proof-of-concept| https://t.me/bdufstecru/3388...

CVE-2026-15958

creationtimestamp| type| source ---|---|--- 2026-08-04 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117036064825025921 2026-08-04 19:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpnktkd32f...

CVE-2026-12698

CVE-2026-12698 affects the wpForo Forum WordPress plugin pre-3.1.3. The vulnerability arises because the plugin does not restrict which profile fields a member may set when editing their own account, enabling a subscriber-level user to write administrator-controlled fields (including account-stat...

CVE-2026-18723

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

CVE-2026-18723 diaowen DWSurvey Survey Status up-survey-status.do improper authorization

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

EUVD-2026-52572

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...