CVE-2026-58409 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-57814

creationtimestamp| type| source ---|---|--- 2026-07-13 19:49:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhlro7g72a 2026-07-14 02:37:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql6g5oes52y 2026-07-16 08:09:25+00:00| seen|...

CVE-2026-14906

creationtimestamp| type| source ---|---|--- 2026-07-13 19:43:18+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqkhap3uhf2c 2026-07-15 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqovtojixm2h...

GHSA-7XW9-549R-8JRC

creationtimestamp| type| source ---|---|--- 2026-07-13 19:42:25+00:00| seen| https://gist.github.com/alon710/e0411f3e1cdf3980cab9ce593ae8692e...

CVE-2026-57803

creationtimestamp| type| source ---|---|--- 2026-07-13 19:29:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkgiadrvj2e 2026-07-14 02:26:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql5seep2a22 2026-07-16 08:08:03+00:00| seen|...

CVE-2026-57782

creationtimestamp| type| source ---|---|--- 2026-07-13 19:28:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkgfn4yte2x...

CVE-2026-22100

creationtimestamp| type| source ---|---|--- 2026-07-13 18:50:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkecsvgau2c 2026-07-14 03:05:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql7xs3giy2i 2026-07-16 08:06:24+00:00| seen|...

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

CVE-2026-49969

Vulnerability overview: Laravel-Mediable

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228

Summary: CVE-2026-58228 affects phoenix_live_view (Phoenix.LiveView.Utils) and enables XSS via due to scheme validation bypass. The root cause is the internal uri_scheme/1 helper in Phoenix.LiveView.Utils that only detects schemes when the first byte is an ASCII letter; inputs starting with ASCI...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-57795

creationtimestamp| type| source ---|---|--- 2026-07-13 18:02:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkbm5fcyv22 2026-07-16 08:04:27+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrlsl2lh2g...

CVE-2026-13240

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka5a775724...

CVE-2026-13237

creationtimestamp| type| source ---|---|--- 2026-07-13 17:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7zm334g2v...

CVE-2026-13236

creationtimestamp| type| source ---|---|--- 2026-07-13 17:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7w2sdkl2b 2026-07-21 04:45:08+00:00| seen| https://jvn.jp/en/jp/JVN20592637...