EUVD-2026-1958

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet...

EUVD-2026-1932

D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming...

CVE-2026-0836

creationtimestamp| type| source ---|---|--- 2026-01-11 05:30:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mc4sbqel242a 2026-01-11 06:00:27+00:00| published-proof-of-concept| Telegram/EOXLjl3-lqyRD7VeboQo0HlutywmQZMzrrX-YWEiFEW7m88 2026-01-11 07:46:38+00:00| seen|...

CVE-2025-68696 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2025-15501

creationtimestamp| type| source ---|---|--- 2026-01-09 23:21:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbzn7dgheh2g 2026-01-09 23:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbzozusc542q 2026-01-10 00:04:56+00:00| published-proof-of-concept|...

CVE-2025-46298

creationtimestamp| type| source ---|---|--- 2026-01-09 21:59:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115867382141444693 2026-02-03 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-057/...

MAESTRO Toolkit Exploiting VMware VM Escape Vulnerabilities

Cybersecurity researchers from Huntress detail a major VM Escape attack where hackers took over host servers. Using a secret toolkit called MAESTRO, the attackers stayed hidden for over a year. Read the exclusive details on how this breach was stopped and how to protect your network...

CVE-2025-35051

creationtimestamp| type| source ---|---|--- 2026-01-09 19:04:43+00:00| seen| Telegram/O07TgmjcRwlDKdEqQK7l4behNusvvNt-L2WaEGxPMBowbdo...

CVE-2025-46645

creationtimestamp| type| source ---|---|--- 2026-01-09 18:06:42+00:00| published-proof-of-concept| Telegram/gIeROQChpfUKACGacrlMOrd91yuCBo48O9eluSl9WxyqbYI 2026-01-09 18:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbz5l7wmpv2g...

EUVD-2026-1703

GestSup versions up to and including 3.2.56 contain a pre-authentication stored cross-site scripting XSS vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value for example, to /api/v1/ticket.php, an unauthenticated attacker can cause...

EUVD-2026-1710

GestSup versions up to and including 3.2.56 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful...

EUVD-2026-1702

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 GA contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY...

EUVD-2026-1711

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Improper Neutralizatio...

EUVD-2026-1708

A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of the argument studentregno/Pincode/session/department/level/course/sem results in sql injection. The attack may be launched remotely. The...

CVE-2025-66050

creationtimestamp| type| source ---|---|--- 2026-01-09 13:05:43+00:00| published-proof-of-concept| Telegram/lQa5Bf1VzuIWjy0I3eIwnAwZ1-XZwzRDF1rwq6cLSRe8 2026-01-09 15:34:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbyt42o5hp2x...

CVE-2025-13701

creationtimestamp| type| source ---|---|--- 2026-01-09 13:04:47+00:00| seen| Telegram/Q6W0k1WKh9B3-4oN0DiaBhUByTzqYQ-BzTWUpEPQoF3Zxk 2026-01-09 13:28:55+00:00| seen| https://gist.github.com/Darkcrai86/f2b9e1f889c69876dcb4efe2362fbeeb...

CVE-2014-4530

flog plugin 0.1 for WordPress has XSS...

CVE-2005-1866

Cross-site scripting XSS vulnerability in calendar.php in Calendarix Advanced 1.5 allows remote attackers to inject arbitrary web script or HTML via the year parameter...

CVE-2023-25169

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...

EUVD-2026-1737

Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed,...