PT-2026-45758

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions prior to 4.1.0 Description A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version later than 4.1.0...

CVE-2026-8206: Improper Privilege Management

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. Thi...

CVE-2026-49782: Missing Authorization

Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0...

WordPress plugin Elementor Website Builder 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. There is a...

Malicious Package

Overview ratelimitsucks9 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate...

webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack

A flaw was found in WebKitGTK. A maliciously crafted web page can cause a logic issue due to improper checks and result in a cross-site scripting attack...

The vulnerability of the SiYuan personal knowledge management system, related to the lack of measures taken to protect the website structure, allows attackers to execute arbitrary code.

The vulnerability of the SiYuan personal knowledge management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the HTTP GET Request Handler component of the LibreChat artificial intelligence-based platform allows a attacker to perform XSS attacks.

The vulnerability of the HTTP GET Request Handler component of the LibreChat artificial intelligence-based platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Exploit for OS Command Injection in Dolibarr Dolibarr_Erp\/Crm

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Remote Code Execution...

PT-2026-44840

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0-rc1 Description A stack buffer overflow exists in the piv process history function within src/libopensc/card-piv.c. This issue allows a physically present attacker to cause memory corruption by using a specially...

CVE-2026-9022

creationtimestamp| type| source ---|---|--- 2026-05-27 05:48:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmssoqcydb2t 2026-05-27 09:10:17+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmt5xirscr2l 2026-06-04 07:45:55+00:00| seen|...

The vulnerability of the Drupal CMS system’s kernel allows a hacker to execute arbitrary code.

The vulnerability of the Drupal CMS system’s kernel is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-44833

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1...

CVE-2026-9421 KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload

A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of the component File Handler. This manipulation causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and m...

The vulnerability of the activesupport component of the Ruby on Rails software framework allows a hacker to execute arbitrary code.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

MAL-2026-4632 Malicious code in orca-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c52f7fe46d56cb45880942f5266494a2654d9d330914a6c3c99f02045eacd1dc On require/import, index.js collects host identifiers os.hostname, os.userInfo.username, os.platform, os.arch, process.cwd, process.pid, timestamp an...

EUVD-2026-31401

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element...

CVE-2026-9018: Improper Privilege Management

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the easyelhandleregister function. This is due to the wpajaxnopriveelregister AJAX handler iterating the attacker-controlled...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack

A flaw was found in WebKitGTK. A maliciously crafted web page can cause a logic issue due to improper checks and result in a cross-site scripting attack...