CVE-2026-51785

creationtimestamp| type| source ---|---|--- 2026-08-03 18:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms766fxfxh2m...

EUVD-2026-52414

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

EUVD-2026-52401

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

EUVD-2026-52394

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-18243

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting XSS, which may allow unauthenticated HTTP requests to view print job previews...

CVE-2026-18610

CVE-2026-18610 affects NewType WebEIP up to v3.0, impacting an unknown part of the file /EIP_Com_FileList.aspx. The issue enables improper authentication and can be exploited remotely; the exploit is public. Vendor did not respond to disclosure. No remediation details are provided in the availabl...

CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

guardx

🛡️ Guard Toolkit — Full Tutorial Security toolkit: Secret S...

EUVD-2026-52329

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-64827

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in setenv.php where the redirectToLoginAdminIRequestHaveAccessToken function derives the current page name from PHPSELF and skips authentication when the value...

CVE-2026-64827

CVE-2026-64827 affects Telenia Software TVox 26.5.3 and earlier in 26.x and 24.x lines. The root cause is an authentication bypass in set_env.php: redirectToLoginAdminIRequestHaveAccessToken() derives the current page name from PHP_SELF and skips authentication when it equals 'login_admin.php'. T...

CVE-2026-69095 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

CVE-2026-69095

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

CVE-2026-69088 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the DOM: Bindings WebIDL component...

CVE-2026-16563

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...