CVE-2026-29519 Lucee CFML Server Reflected XSS via URL Path Parsing

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-29519

CVE-2026-29519 affects Lucee CFML Server across 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines. It describes a reflected cross-site scripting vulnerability in URL path parsing, where unauthenticated remote attackers can cause arbitrary JavaScript to execute in a victim’s browser by embedding payloa...

CVE-2026-57227

creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25...

EUVD-2026-42896

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhookurl parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a...

CVE-2026-49241

creationtimestamp| type| source ---|---|--- 2026-07-10 13:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc7phehxg25...

CVE-2026-15104

creationtimestamp| type| source ---|---|--- 2026-07-10 12:11:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4lgpdfj2x 2026-07-10 21:17:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd34b3skm22 2026-07-11 00:46:26+00:00| seen|...

CVE-2026-12108

creationtimestamp| type| source ---|---|--- 2026-07-10 12:02:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc43ygvab2e 2026-07-10 21:13:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2v5rp452s 2026-07-10 21:13:31+00:00| seen|...

CVE-2026-40009

creationtimestamp| type| source ---|---|--- 2026-07-10 11:18:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbznn7c7g26 2026-07-10 12:15:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40009 2026-07-10 13:25:26+00:00| seen|...

CVE-2026-40006

creationtimestamp| type| source ---|---|--- 2026-07-10 10:57:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyhjhsfl2f 2026-07-10 12:15:37+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40006 2026-07-10 13:18:20+00:00| seen|...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-59721

creationtimestamp| type| source ---|---|--- 2026-07-10 09:14:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqbspbvraw27...

CVE-2026-21057

creationtimestamp| type| source ---|---|--- 2026-07-10 08:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbr6mzc2h2x 2026-07-10 09:56:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbv2z7uij2a 2026-07-10 09:56:43+00:00| seen|...

CVE-2026-21045

creationtimestamp| type| source ---|---|--- 2026-07-10 08:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbpamuqba27 2026-07-10 09:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbux2ewhl2e 2026-07-10 12:46:38+00:00| seen|...

CVE-2026-59226

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgr7qezc26...

CVE-2026-59225

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgqlpmwx2e 2026-07-24 22:35:49+00:00| seen| https://gist.github.com/alon710/dc8fbe1b073218955707634edeb9a32e...

CVE-2026-12123

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locatio...

CVE-2026-59221

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6yf7g42s...

CVE-2026-59227

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6ejpes22 2026-07-24 18:35:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g...

CVE-2026-15331

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function addurl/addpackage of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated...

CVE-2026-15282

creationtimestamp| type| source ---|---|--- 2026-07-10 05:16:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbffamohv2z 2026-07-11 00:00:32+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqde7qogx42j 2026-07-13 01:01:18+00:00| seen|...