PT-2026-37048

Name of the Vulnerable Software and Affected Versions D-Link DI-8100 version 16.07.26A1 Description A buffer overflow can be triggered remotely via the POST Parameter Handler component. The issue exists within the url rule asp function of the '/url rule.asp' endpoint. Recommendations At the momen...

kodcloud KodExplorer 安全漏洞

KodCloud KodExplorer is a web file manager provided by the Chinese company KodCloud. Versions of KodCloud KodExplorer 4.52 and earlier contained security vulnerabilities. These vulnerabilities stemmed from improper handling of the parameter fileUrl in files/app/controller/share.class.php, which...

Exploit for Incorrect Resource Transfer Between Spheres in Openclaw

CVE-2026-25253: One-Click RCE in OpenClaw via Auth Token Theft...

Exploit for Improper Input Validation in Python

CVE-2023-24329 — Parser Differential Lab Educational use...

CVE-2026-6435

creationtimestamp| type| source ---|---|--- 2026-04-18 08:57:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116424876111966074...

BIT-COMPOSER-2026-40261 Composer has Command Injection via Malicious Perforce Reference

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...

CVE-2026-6048

The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget's button URL customattributes field in all versions up to, and including, 2.1.1 due to insufficient validation of custom attribute names. Specifically, the plugin uses eschtml ...

GHSA-8M29-FPQ5-89JJ

creationtimestamp| type| source ---|---|--- 2026-04-18 03:45:47+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjqjn7dvefi2...

CVE-2026-6048

The Flipbox Addon for Elementor (WordPress) contains a Stored Cross-Site Scripting (XSS) vulnerability in the Flipbox widget button URL parameter custom_attributes. In versions up to 2.1.1, it validates attribute names with esc_html(), which does not block event handler attributes (e.g., onmouseo...

CVE-2023-0341

creationtimestamp| type| source ---|---|--- 2026-04-18 03:03:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqhbpuspf26 2026-04-18 03:16:49+00:00| seen| Telegram/pg0pMMwJv5FTHbXxc3MO00N2B5ehQq9biiv2KNNNK0Va5Yk...

CVE-2026-40489

creationtimestamp| type| source ---|---|--- 2026-04-18 03:03:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqhbpuspf26 2026-04-18 03:16:49+00:00| seen| Telegram/pg0pMMwJv5FTHbXxc3MO00N2B5ehQq9biiv2KNNNK0Va5Yk...

CVE-2026-40337

creationtimestamp| type| source ---|---|--- 2026-04-18 01:45:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqcwu3bju2r...

CVE-2026-40349

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:19+00:00| published-proof-of-concept| Telegram/lPGIWgtQcs4RDQrNkGM74AEu7FEWLIcUMs54pp3qHTSOJE 2026-04-18 01:34:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqcdgwknf22 2026-05-31 16:07:09+00:00| seen|...

CVE-2026-40348

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through POST /settings/jellyfin/server-url-verify. The endpoint accepts a user-controlled URL, appends...

CVE-2026-39314

creationtimestamp| type| source ---|---|--- 2026-04-18 00:01:24+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjq5442fbv2n...

CVE-2026-34978

creationtimestamp| type| source ---|---|--- 2026-04-18 00:01:24+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjq5442fbv2n...

CVE-2026-27447

creationtimestamp| type| source ---|---|--- 2026-04-18 00:01:23+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjq542v5rm2c...

CVE-2026-40348 Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through POST /settings/jellyfin/server-url-verify. The endpoint accepts a user-controlled URL, appends...

EUVD-2026-23617

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through POST /settings/jellyfin/server-url-verify. The endpoint accepts a user-controlled URL, appends...

PT-2026-33589

The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget's button URL custom attributes field in all versions up to, and including, 2.1.1 due to insufficient validation of custom attribute names. Specifically, the plugin uses esc htm...