CVE-2026-8825: Exposure of Sensitive Information to an Unauthorized Actor

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, privat...

The vulnerability of the ColdFusion software platform, related to the lack of measures taken to protect the website structure, allows attackers to enhance their privileges.

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

RHEL 9 : webkit2gtk3 (RHSA-2026:42062)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42062 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to...

CVE-2026-12900: Improper Neutralization of Input During Web Page Generation

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

The vulnerability of the FactoryTalk DataMosaix Private Cloud data management platform, related to the lack of measures taken to protect the website structure, allows attackers to execute arbitrary code, gain unauthorized access to protected information, and redirect users to malicious websites.

The vulnerability of the FactoryTalk DataMosaix Private Cloud data management platform and its production process optimization capabilities is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to exploit their privileges.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities can allow attackers to enhance...

SUSE CVE-2026-43721

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data...

CVE-2026-62218

creationtimestamp| type| source ---|---|--- 2026-07-17 02:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqdez4ne2l 2026-07-22 09:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr7zkz3jvo26...

CVE-2026-15457: Improper Limitation of a Pathname to a Restricted Directory

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

The vulnerability affects the SSL-VPN component of the FortiPAM account management system, the FortiOS operating system, the local software management platform FortiSwitch Manager, and the FortiProxy proxy server for Internet attack protection. This allows a perpetrator to execute arbitrary code.

The vulnerability of the SSL-VPN component of the FortiPAM account management system, the FortiOS operating system, the local software development platform FortiSwitch Manager, and the FortiProxy proxy server for internet attack protection is related to the lack of security measures for the websi...

EUVD-2026-44985

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...

CVE-2026-43713

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

CVE-2026-12684

creationtimestamp| type| source ---|---|--- 2026-07-16 08:19:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqshgmjzo2h...

CVE-2017-18306

creationtimestamp| type| source ---|---|--- 2026-07-15 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqpjj457ba2f...

CVE-2026-58077

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

CVE-2026-58077

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

CVE-2026-58077 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

The vulnerability of the monitoring tools for VMware Aria, the virtualization platform VMware Cloud Foundation, and the telecommunications cloud platform VMware Telco Cloud Platform lies in the lack of security measures for the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the monitoring tools for VMware Aria, VMware Cloud Foundation, and VMware Telco Cloud Platform, a virtualization platform, is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site...

CVE-2026-58077: Improper Neutralization of Input During Web Page Generation

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...