WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...

Docassemble - Local File Inclusion

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the mast...

CVE-2026-61892

creationtimestamp| type| source ---|---|--- 2026-07-25 00:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrgkqha7la22...

CVE-2026-48144

creationtimestamp| type| source ---|---|--- 2026-07-24 23:22:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgin3c4se24...

CVE-2026-64212

creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116977339433684369...

CVE-2026-66138

creationtimestamp| type| source ---|---|--- 2026-07-24 22:33:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgfv6yufv25...

CVE-2021-22439

creationtimestamp| type| source ---|---|--- 2026-07-24 21:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrgcqctujh2c...

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-52439

creationtimestamp| type| source ---|---|--- 2026-07-24 20:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg63tlg4j2y...

CVE-2026-48021

creationtimestamp| type| source ---|---|--- 2026-07-24 19:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg3jmp2rf2y 2026-07-24 20:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5dtc5uh2a 2026-07-25 03:00:27+00:00| seen|...

CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-8789

creationtimestamp| type| source ---|---|--- 2026-07-24 17:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrftciba3h2q...

SUSE CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

GHSA-38HQ-7X33-PHP4 @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...

CVE-2026-53402

creationtimestamp| type| source ---|---|--- 2026-07-24 13:25:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhb3ikw42o...

CVE-2026-63317

creationtimestamp| type| source ---|---|--- 2026-07-24 12:53:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrffhds5hm2d...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...