CVE-2026-10181

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSysCmd of the file /goform/formSysCmd. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made...

CVE-2026-9726

creationtimestamp| type| source ---|---|--- 2026-06-02 15:58:23+00:00| seen| https://bsky.app/profile/thedroptimes.bsky.social/post/3mncxkppixd2h 2026-07-11 02:34:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdmtyexzp2y...

CVE-2026-39555

creationtimestamp| type| source ---|---|--- 2026-06-02 15:44:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncwrhvdox2z 2026-06-03 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mne4l4jj2r2h...

CVE-2019-25719

creationtimestamp| type| source ---|---|--- 2026-06-02 15:36:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncwcpqgwu2t 2026-06-02 18:41:52+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mndap2xd352i...

CVE-2025-58707

creationtimestamp| type| source ---|---|--- 2026-06-02 15:33:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncw6lecr727 2026-06-02 18:42:44+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mndaqn3xab2w...

EUVD-2026-33925

NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting XSS vulnerability was discovered in version 2.2.4 in the id parameter of the endpoint /index.php?route=/queries/user/. The application reflects user-supplied input from the id parameter into the HTML response...

CVE-2025-58705

creationtimestamp| type| source ---|---|--- 2026-06-02 13:16:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncoillocc2j 2026-06-04 08:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnh5tqcloi2p...

CVE-2025-53440

creationtimestamp| type| source ---|---|--- 2026-06-02 13:10:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnco77fw722s 2026-06-03 07:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnejxj2l6m22 2026-06-03 11:39:39+00:00| seen|...

CVE-2026-8993

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

CVE-2026-8993 Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...

CVE-2026-8993

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-8993 Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...

EUVD-2026-33913

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...

CVE-2026-3514

creationtimestamp| type| source ---|---|--- 2026-06-02 09:33:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncc22cyky27 2026-06-04 09:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnhb6gfwns2p...

CVE-2026-9723

The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing or incorrect nonce validation on the googlePlusOneAdmin function. This makes it possible for unauthenticated attackers to modify the...

CVE-2026-8422

creationtimestamp| type| source ---|---|--- 2026-06-02 09:03:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncaerqbej2j...

CVE-2026-34907

CVE-2026-34907 describes a Reflected Cross‑Site Scripting (XSS) vulnerability in Wirtualna Uczelnia caused by insecure handling of the locale parameter across multiple endpoints. An attacker can craft a URL with JavaScript in the locale parameter; when a victim opens the link, the injected script...

CERTFR-2026-ACT-024

creationtimestamp| type| source ---|---|--- 2026-06-02 08:18:23+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mnc5u7bels2o 2026-06-08 13:44:39+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mnrsv5au222s...

CVE-2026-9730

The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.0 due to missing/incorrect nonce validation on gmz_comment_settings_save, allowing unauthenticated attackers to modify the plugin’s comment-display setting via a forged reque...