CVE-2026-40988

creationtimestamp| type| source ---|---|--- 2026-06-10 05:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvwjukb4q2n...

CVE-2026-44168

creationtimestamp| type| source ---|---|--- 2026-06-10 04:57:15+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mnvwdsrfzk2z 2026-06-12 20:06:55+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo4k43sgrd2h 2026-06-14 01:01:01+00:00| seen|...

Revive Adserver: Reflected XSS in stats‑video.php via improperly encoded URL parameters

A reflected XSS vulnerability was discovered in the stats‑video.php script due to improper encoding of user input in the URL parameters...

CVE-2026-44757

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the...

CVE-2026-53675

creationtimestamp| type| source ---|---|--- 2026-06-10 01:32:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvkuvwacd2m...

EUVD-2026-35896

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

CVE-2026-47966

creationtimestamp| type| source ---|---|--- 2026-06-10 00:30:58+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mnvhhs2aku26...

CVE-2026-41706

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

CVE-2026-9742

creationtimestamp| type| source ---|---|--- 2026-06-10 00:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvfrbwiz42g 2026-06-11 12:45:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxhchwy25...

CVE-2026-9753

creationtimestamp| type| source ---|---|--- 2026-06-10 00:00:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvfqs4fsk2n 2026-06-11 12:45:09+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxhchwy25...

PT-2026-48495

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that...

Roxy-WI 授权问题漏洞

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions of Roxy-WI 8.2.6.4 and earlier have a vulnerability related to authorization. This vulnerability arises from using the API substring in the URL and unauthenticated /api/gpt endpoints,...

Fission 输入验证错误漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contained a input validation vulnerability. This vulnerability stemmed from the HTTPTriggerSpec.Validate method, which ignored the RelativeURL and Prefix fields during validation. As a...

KubeV2V Migration assessment 授权问题漏洞

Migration assessment is an open-source tool developed by KubeV2V for evaluating and providing migration recommendations for VMware environments. There is a security vulnerability in Migration assessment. This vulnerability stems from the /api/v1/sources/id/image-url endpoint, where improper acces...

PT-2026-48394

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gridpropertiesborderColor' and 'gridimagesNattachment url' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for...

EulerOS 2.0 SP13 : golang (EulerOS-SA-2026-2291)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 Actions which insert URLs into the...

PT-2026-48458

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://request.hostnext url and the JS client redirects via...

PT-2026-48411

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes...

PT-2026-48444

Name of the Vulnerable Software and Affected Versions migration-planner affected versions not specified Description An improper access control flaw exists in the '/api/v1/sources/id/image-url' endpoint. An authenticated attacker can bypass ownership checks to obtain presigned S3 URLs for Open...

PT-2026-48496

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cause data exfiltration through classic...