CVE-2026-7798

creationtimestamp| type| source ---|---|--- 2026-05-22 13:02:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgylmkdyf2e...

CVE-2026-4635

creationtimestamp| type| source ---|---|--- 2026-05-22 12:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgxrcld642r...

CVE-2026-5740

creationtimestamp| type| source ---|---|--- 2026-05-22 12:45:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgxnwxwvc2p...

Exploit for Code Injection in Iptime N104S-R1_Firmware

CVE-2025-55423 — ipTIME UPnP Command Injection: Analysis & Rep...

CVE-2026-4843

creationtimestamp| type| source ---|---|--- 2026-05-22 08:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmgjimchmx2a...

CVE-2026-7798 FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for...

CVE-2026-7798

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for...

EUVD-2026-31418

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for...

CVE-2026-7798 FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for...

CVE-2026-6960

creationtimestamp| type| source ---|---|--- 2026-05-22 07:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmgg5djriy2l 2026-05-23 07:00:10+00:00| seen| Telegram/Otu6Jbe8lDXdPSNoyBScRz6BIgHRvrsI4mTky3IQgsujWk 2026-06-22 02:31:34+00:00| seen|...

CVE-2026-9018

creationtimestamp| type| source ---|---|--- 2026-05-22 07:03:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgejkswvv2o 2026-05-23 07:00:10+00:00| seen| Telegram/Otu6Jbe8lDXdPSNoyBScRz6BIgHRvrsI4mTky3IQgsujWk...

CVE-2026-7509

creationtimestamp| type| source ---|---|--- 2026-05-22 06:58:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgeamfjm22k 2026-05-25 04:25:55+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnn56cp2o2s...

CVE-2026-4070

creationtimestamp| type| source ---|---|--- 2026-05-22 06:48:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgdopiv5b2r...

CVE-2026-44409

creationtimestamp| type| source ---|---|--- 2026-05-22 06:40:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgdab6v732o...

Malicious code in qaq-core-util-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cf368bbc06ee2a9e0d2a9b2030d7604a41af7ed5fed253d48a0d9ff41f92f6 lib/memcached.js exports getCacheRedis, getCacheDataRedis, and setCacheRedis. Each function's signature accepts a cachedUrl parameter, but the...

CVE-2026-3481

creationtimestamp| type| source ---|---|--- 2026-05-22 06:26:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgchfbybg2p 2026-05-25 07:25:58+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnx74p6iv2c...

Malicious code in @druids/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071ce35c0d6a17c606e5448f4c485228df973342935b0a11519304050877edf5 The package's package.json declares a dependency ltidisafe resolved not from the npm registry but as a direct tarball URL:...

CVE-2026-8327

creationtimestamp| type| source ---|---|--- 2026-05-22 02:53:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmfwkatib32o...

MAL-2026-4388 Malicious code in @exocore/exocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b1e32b74c68582be18feb35e92f095c753491a1c6b9e62b52eb0a1dbe300d69 The package ships a CLI binary dist/exocore that hardcodes process.env.ANTHROPICBASEURL to https://exocoreai-exocore-gateway.hf.space/v1 and...

EUVD-2026-31379

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a...