@stackflag.bsky.socialCVE-2026-105899 - coldfusion 2025
Adobe ColdFusion versions 2025 and 2023 let attackers upload files of any type without checks. A malicious file could run code on the server, giving the attacker the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-83662
Adobe Experience Manager can be tricked into showing a web page that runs code an attacker adds to a link. If a user clicks the crafted link, the added code could take control of their session or account. Avoid…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63160
The Omnispace Agora Project stores its "remember me" login token in the same exact form as the user’s browser cookie. If someone obtains a copy of the database or a backup, they can use that token to log in as…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63159 - agora project
The Agora Project version before 26.10.0 uses a password‑reset code that is calculated in a predictable way from the user’s login name and password. This lets someone…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63158
Versions of Omnispace Agora Project before 26.10.0 treat a stored password hash like a login token. If someone obtains that hash, they can set a special cookie and sign in as any user, even an administrator,…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63149
Versions of Omnispace Agora Project before 26.10.0 create temporary passwords using a method that is based on the server's clock. Because the password generation can be predicted when the account creation time…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stemshop.bsky.social🚨 CVE-2026-87855 — CVSS 9.8 CRITICAL The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versio... 🔎 https://stemshop.top/cve/CVE-2026-87855 #CVE #CyberSecurity #InfoSec
@stemshop.bsky.social🚨 CVE-2026-104800 — CVSS 9.8 CRITICAL The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi... 🔎 https://stemshop.top/cve/CVE-2026-104800 #CVE #CyberSecurity #InfoSec
@euvd-bot.bsky.social🚨 EUVD-2026-100806 📊 8.0/10 🏢 NixOS 📝 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before co... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100806 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100807 📊 4.3/10 🏢 NixOS 📝 Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100807 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-64002 📊 8.8/10 🏢 Linux 📝 In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64002 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100808 📊 4.0/10 🏢 NixOS 📝 The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root o... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100808 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100809 📊 4.3/10 🏢 NixOS 📝 Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100809 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100810 📊 7.2/10 🏢 ice00 📝 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta b... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100810 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100811 📊 6.4/10 🏢 joaoromao 📝 The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parame... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100811 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100812 📊 6.5/10 🏢 hyyan 📝 The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remov... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100812 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100813 📊 8.9/10 🏢 NetBird 📝 Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 th... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100813 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100814 📊 8.5/10 🏢 EG Secure Solutions Inc. 📝 SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands w... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100814 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100815 📊 5.3/10 🏢 Ubiquiti Inc 📝 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access interna... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100815 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100816 📊 8.1/10 🏢 Ubiquiti Inc 📝 A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi P... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100816 #cybersecurity #infosec #cve #euvd