PYSEC-2026-737 SSRF attacks via tracebacks in Plone

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

PYSEC-2026-765 Moderate severity vulnerability that affects Zope2

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

CVE-2026-20216

creationtimestamp| type| source ---|---|--- 2026-07-02 13:50:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6fqhjmd2f 2026-07-02 13:55:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6nxwhpz2q 2026-08-01 01:14:40+00:00| seen|...

CVE-2026-20215

creationtimestamp| type| source ---|---|--- 2026-07-02 13:50:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6fqhjmd2f 2026-07-02 13:55:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6nxwhpz2q 2026-08-01 01:14:40+00:00| seen|...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the Authorizer function. An attacker can determine valid usernames by measuring the response time difference between valid and invalid usernames during authentication attempts. Remediation There is no fixed...

WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Brook versions = 2.9.0...

WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Aqua versions = 5.1.2...

CVE-2026-5524

creationtimestamp| type| source ---|---|--- 2026-07-02 13:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116850624546842014 2026-07-02 13:30:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpo5c24aet2x 2026-07-02 20:00:44+00:00| seen|...

ROOT-APP-GOBINARY-CVE-2026-53492 CVE-2026-53492 in rootio-github.com/containerd/containerd/v2 - Patched by Root

Root has patched CVE-2026-53492 in the rootio-github.com/containerd/containerd/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-53489 CVE-2026-53489 in rootio-github.com/containerd/containerd/v2 - Patched by Root

Root has patched CVE-2026-53489 in the rootio-github.com/containerd/containerd/v2 package for Root:Go. Multiple fixed versions available...

CVE-2026-57764

Contributor Cross Site Scripting XSS in Surbma | Yoast SEO Breadcrumb Shortcode = 1.2 versions...

CVE-2026-57690

Unauthenticated Cross Site Request Forgery CSRF in Werkstatt = 4.7.2 versions...

CVE-2026-57689

Subscriber Broken Access Control in Werkstatt = 4.7.2 versions...

CVE-2026-57671

Unauthenticated Cross Site Scripting XSS in perfmatters = 2.6.4 versions...

CVE-2026-57357

Unauthenticated Cross Site Scripting XSS in Search Atlas SEO = 2.6.6 versions...

CVE-2026-57355

Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...

CVE-2026-57353

Subscriber Broken Access Control in Link Whisper Premium = 2.9.0 versions...

CVE-2025-69094

Subscriber SQL Injection in Unicamp = 2.2.2 versions...

USN-8398-4: nginx vulnerability

USN-8398-3 fixed a vulnerability in nginx. This update provides the corresponding fix for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A...

CVE-2026-57683

creationtimestamp| type| source ---|---|--- 2026-07-02 12:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpnyb2qfwu2w 2026-07-02 12:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116850270547831923 2026-07-02 21:48:04+00:00| seen|...