CVE-2026-14482

creationtimestamp| type| source ---|---|--- 2026-07-08 07:27:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4lrjxew42l 2026-07-09 00:00:40+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq6dcbzxg52n...

CVE-2026-14500

The CVE-2026-14500 entry concerns the Bulk Order Update for WooCommerce plugin for WordPress (

EUVD-2026-42175

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied...

CVE-2026-14500 Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied...

CVE-2026-12041

creationtimestamp| type| source ---|---|--- 2026-07-08 05:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq4ehfuu5k2r 2026-07-08 08:01:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4npvpahf2e...

GHSA-9G8F-H8F3-HJCM

creationtimestamp| type| source ---|---|--- 2026-07-08 05:00:05+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq4dkpqdgy2h...

CVE-2026-14244 Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter

The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2026-59997

creationtimestamp| type| source ---|---|--- 2026-07-08 04:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4blvjx2p24 2026-07-08 22:47:27+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y 2026-07-10 12:03:35+00:00| seen|...

CVE-2026-59995

creationtimestamp| type| source ---|---|--- 2026-07-08 03:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq47zpcevu24 2026-07-08 22:47:27+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y 2026-07-10 04:02:17+00:00| seen|...

CVE-2026-55428

creationtimestamp| type| source ---|---|--- 2026-07-08 03:31:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq46mypl2d2k 2026-07-19 21:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqzqfomopm2v 2026-07-19 21:37:06+00:00| seen|...

CVE-2026-55077

creationtimestamp| type| source ---|---|--- 2026-07-08 00:59:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3w4fg6mc2x...

CVE-2026-55078

creationtimestamp| type| source ---|---|--- 2026-07-08 00:45:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3vcs3yad2x...

EUVD-2026-42106

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollamabaseurl parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attack...

CVE-2026-55436

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy aibridgeproxyd created a goproxy server whose default transport set InsecureSkipVerify: true and only assigned a...

CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...

CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...

CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...

EUVD-2026-42140

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...

CVE-2026-12277

creationtimestamp| type| source ---|---|--- 2026-07-08 00:00:21+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq3ssrwtoa2e 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-15 00:00:31+00:00|...

TP-Link Archer AX20 has a vulnerability related to input validation errors

The TP-Link Archer AX20 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer AX20 has a vulnerability related to input validation. This vulnerability stems from improper validation of URLs provided by users via the web interface. Attackers can exploit this...