CVE-2026-40009

creationtimestamp| type| source ---|---|--- 2026-07-10 11:18:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbznn7c7g26 2026-07-10 12:15:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40009 2026-07-10 13:25:26+00:00| seen|...

CVE-2026-40006

creationtimestamp| type| source ---|---|--- 2026-07-10 10:57:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyhjhsfl2f 2026-07-10 12:15:37+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40006 2026-07-10 13:18:20+00:00| seen|...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-59721

creationtimestamp| type| source ---|---|--- 2026-07-10 09:14:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqbspbvraw27...

CVE-2026-21057

creationtimestamp| type| source ---|---|--- 2026-07-10 08:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbr6mzc2h2x 2026-07-10 09:56:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbv2z7uij2a 2026-07-10 09:56:43+00:00| seen|...

CVE-2026-21045

creationtimestamp| type| source ---|---|--- 2026-07-10 08:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbpamuqba27 2026-07-10 09:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbux2ewhl2e 2026-07-10 12:46:38+00:00| seen|...

CVE-2026-59226

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgr7qezc26...

CVE-2026-59225

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgqlpmwx2e 2026-07-24 22:35:49+00:00| seen| https://gist.github.com/alon710/dc8fbe1b073218955707634edeb9a32e...

CVE-2026-12123

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locatio...

CVE-2026-59221

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6yf7g42s...

CVE-2026-59227

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6ejpes22 2026-07-24 18:35:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g...

CVE-2026-15331

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function addurl/addpackage of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated...

CVE-2026-15282

creationtimestamp| type| source ---|---|--- 2026-07-10 05:16:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbffamohv2z 2026-07-11 00:00:32+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqde7qogx42j 2026-07-13 01:01:18+00:00| seen|...

CVE-2026-15284

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formpageid' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the addtosubmissions function, which applies sanitizetextfield which preserves...

CVE-2026-55616

creationtimestamp| type| source ---|---|--- 2026-07-10 04:07:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbbkbvc622t...

SUSE CVE-2026-8926

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no...

SUSE CVE-2026-12064

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

SUSE CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59858

creationtimestamp| type| source ---|---|--- 2026-07-10 00:40:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqavxyae4f2l 2026-07-10 19:54:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwikfmx22a 2026-07-11 01:45:18+00:00| seen|...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution when the gh codespace jupyter process opens a JupyterLab URL supplied by a process inside a Codespace without validating that it is a loopback HTTP or HTTPS address. An attacker can execute arbitrary command...