CVE-2026-6672

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the...

CVE-2026-7572

creationtimestamp| type| source ---|---|--- 2026-05-06 05:18:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5x7pog4m2p...

USN-8230-1 docker.io-app vulnerabilities

It was discovered that BuildKit, contained within Docker, incorrectly handled file path validation when processing frontend API messages. An attacker could possibly use this issue to write files outside of the intended state directory. CVE-2026-33747 It was discovered that BuildKit, contained...

CVE-2025-71256

creationtimestamp| type| source ---|---|--- 2026-05-06 02:54:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml5p5ipdlj2k 2026-05-06 05:33:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5y2ok74h2t 2026-06-01 18:00:00+00:00| seen|...

CVE-2026-35579

creationtimestamp| type| source ---|---|--- 2026-05-06 02:01:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5m7sjb5n2e...

CVE-2026-39849

creationtimestamp| type| source ---|---|--- 2026-05-06 01:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5lwszndj2k...

CVE-2026-39383

creationtimestamp| type| source ---|---|--- 2026-05-06 01:46:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5leuajap2k...

CVE-2026-4060

creationtimestamp| type| source ---|---|--- 2026-05-06 01:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml5kmmtzgy2s 2026-05-14 07:00:14+00:00| seen| Telegram/1SOBBgvcIqPC2HdBO73HfJmtzy7hfeZMdIE0nBIzwgN91l0 2026-09-12 10:00:20+00:00| seen|...

CVE-2026-40110

creationtimestamp| type| source ---|---|--- 2026-05-06 01:30:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5khgwkuj2e...

PT-2026-38265

Name of the Vulnerable Software and Affected Versions New API versions 0.11.9-alpha.1 and earlier Description New API, a large language model LLM gateway and artificial intelligence AI asset management system, contains a Server-Side Request Forgery SSRF flaw. This issue occurs due to insufficient...

PT-2026-38255

Name of the Vulnerable Software and Affected Versions Slider Revolution versions 7.0.0 through 7.0.10 Description Insufficient file type validation in the get media url and check file path functions allows authenticated attackers with subscriber-level access or higher to perform an Arbitrary File...

WordPress plugin LatePoint 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-37351

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking form page url' parameter in all versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it...

AlmaLinux 10 : image-builder (ALSA-2026:3840)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:3840 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 golang: net/url: Memory exhaustion in...

PT-2026-38305

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.32 Description A logical flaw in the URL checking logic allows attackers to bypass security filters, leading to Server-Side Request Forgery SSRF. The system uses the validate url function to perform security...

CVE-2026-4061

creationtimestamp| type| source ---|---|--- 2026-05-05 23:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml5dw2bfnu2a 2026-09-12 10:00:20+00:00| seen| https://t.me/shimiscyberworld/1114 2026-09-13 00:00:05+00:00| seen| https://t.me/shimiscyberworld/1114...

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

Summary Two endpoints in AVideo call isSSRFSafeURL to validate user-supplied URLs, then fetch them using bare filegetcontents without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an...

CVE-2026-7857

creationtimestamp| type| source ---|---|--- 2026-05-05 22:01:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml56snv3fo2h...

Server-side Request Forgery (SSRF)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the afterDonation process due to insufficient validation of user-supplied webhook URLs and improper handling of HTTP redirects...

GHSA-WP38-WHX3-XFFH AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses. When any other user including a second account owned by the same attacker...