CVE Monitor

Public

Can't Join? @CVEDetector

3.5k Members

Updated: May 19, 2026 at 7:04 AM

CVE Monitor

Join @CVEDetector for exclusive Cybersecurity content and discussions in 1

Ranking

Global Ranking

#456

Language Ranking

#45

Category Ranking

#23

-1

Participant Growth (Last 6 Days)

Total: 3.5K

24h growth: +0 0%

Latest Posts

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-2554 - WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - authenticated (vendor+) insecure direct object reference to arbitrary user deletion",
"Content": "CVE ID :CVE-2026-2554
Published : May 2, 2026, 1:26 p.m. | 16 minutes ago
Description :The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-7630 - innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication",
"Content": "CVE ID :CVE-2026-7630
Published : May 2, 2026, 1:15 p.m. | 27 minutes ago
Description :A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-0703 - NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - authenticated (contributor+) stored cross-site scripting via 'xlwcty_current_date' shortcode",
"Content": "CVE ID :CVE-2026-0703
Published : May 2, 2026, 1:26 p.m. | 16 minutes ago
Description :The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-3504 - Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - unauthenticated information disclosure in store reviews rest api endpoint",
"Content": "CVE ID :CVE-2026-3504
Published : May 2, 2026, 1:26 p.m. | 16 minutes ago
Description :The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'prepare_reviews_for_response' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-7611 - TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity",
"Content": "CVE ID :CVE-2026-7611
Published : May 2, 2026, 10:16 a.m. | 1 hour, 25 minutes ago
Description :A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01. This impacts the function platform_do_upgrade_cameo_dev of the file cameo_dev.sh of the component Firmware Update Handler. Performing a manipulation results in insufficient verification of data authenticity. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-5077 - Total <= 2.2.1 - authenticated (contributor+) stored cross-site scripting via post title in blog section image alt attribute",
"Content": "CVE ID :CVE-2026-5077
Published : May 2, 2026, 10:16 a.m. | 1 hour, 25 minutes ago
Description :The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute context in the home blog section template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the malicious post to be published and displayed with a featured image in the Home Page blog section.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-6449 - Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - unauthenticated authorization bypass via remote approval endpoint",
"Content": "CVE ID :CVE-2026-6449
Published : May 2, 2026, 8:16 a.m. | 1 hour, 24 minutes ago
Description :The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-7627 - 8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal",
"Content": "CVE ID :CVE-2026-7627
Published : May 2, 2026, 11:15 a.m. | 25 minutes ago
Description :A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component sync_ea_from_file. Such manipulation of the argument ea_name leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-7612 - itsourcecode Courier Management System edit_user.php sql injection",
"Content": "CVE ID :CVE-2026-7612
Published : May 2, 2026, 10:16 a.m. | 1 hour, 25 minutes ago
Description :A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Severity: 5.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

May 2, 2026, 08:40 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-2052 - Widget Options <= 4.2.2 - authenticated (contributor+) remote code execution via display logic",
"Content": "CVE ID :CVE-2026-2052
Published : May 2, 2026, 8:16 a.m. | 1 hour, 24 minutes ago
Description :The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "02 May 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42641 - WordPress Share This Image plugin <= 2.14 - server side request forgery (ssrf) vulnerability",
"Content": "CVE ID :CVE-2026-42641
Published : April 29, 2026, 12:16 p.m. | 44 minutes ago
Description :Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery. This issue affects Share This Image: from n/a through <=
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42648 - WordPress Spectra plugin <= 2.19.22 - broken access control vulnerability",
"Content": "CVE ID :CVE-2026-42648
Published : April 29, 2026, 12:16 p.m. | 44 minutes ago
Description :Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Spectra: from n/a through <=
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42249 - Remote Code Execution in Ollama via Update Mechanism",
"Content": "CVE ID :CVE-2026-42249
Published : April 29, 2026, 12:16 p.m. | 44 minutes ago
Description :Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath. Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory.
An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables.

Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness.

Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42517 - Cryptographic Failure Vulnerability in e-Sushrut HMIS",
"Content": "CVE ID :CVE-2026-42517
Published : April 29, 2026, 9:16 a.m. | 1 hour, 43 minutes ago
Description :This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive information on the targeted system.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42652 - WordPress User Registration plugin <= 5.1.5 - cross site scripting (xss) vulnerability",
"Content": "CVE ID :CVE-2026-42652
Published : April 29, 2026, 12:16 p.m. | 44 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS. This issue affects User Registration: from n/a through <=
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-4019 - Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - missing authorization to unauthenticated private post content disclosure via consent area rest endpoint",
"Content": "CVE ID :CVE-2026-4019
Published : April 29, 2026, 9:16 a.m. | 1 hour, 43 minutes ago
Description :The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated user to access it. The cmplz_rest_consented_content() function retrieves a post by ID via get_post() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers to read the consent area block content from private, draft, or unpublished posts.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-3325 - SQL injection in MegaCMS by CRM Sistemas de Fidelización",
"Content": "CVE ID :CVE-2026-3325
Published : April 29, 2026, 9:16 a.m. | 1 hour, 43 minutes ago
Description :SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42516 - Broken Access Control Vulnerability in e-Sushrut HMIS",
"Content": "CVE ID :CVE-2026-42516
Published : April 29, 2026, 9:16 a.m. | 1 hour, 43 minutes ago
Description :This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42412 - WordPress WP User Frontend plugin <= 4.3.1 - broken access control vulnerability",
"Content": "CVE ID :CVE-2026-42412
Published : April 29, 2026, 7:51 a.m. | 1 hour, 6 minutes ago
Description :Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects WP User Frontend: from n/a through 4.3.1.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 29, 2026, 07:14 PM

{
"Source": "CVE FEED",
"Title": "CVE-2026-42518 - Information Disclosure Vulnerability in e-Sushrut HMIS",
"Content": "CVE ID :CVE-2026-42518
Published : April 29, 2026, 9:16 a.m. | 1 hour, 43 minutes ago
Description :This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys.

Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "29 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-37344 - SourceCodester Vehicle Parking Area Management System SQL Injection",
"Content": "CVE ID :CVE-2026-37344
Published : April 16, 2026, 3:17 p.m. | 1 hour, 42 minutes ago
Description :SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-37345 - SourceCodester Vehicle Parking Area Management System SQL Injection",
"Content": "CVE ID :CVE-2026-37345
Published : April 16, 2026, 3:17 p.m. | 1 hour, 42 minutes ago
Description :SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-37342 - SourceCodester Vehicle Parking Area Management System SQL Injection",
"Content": "CVE ID :CVE-2026-37342
Published : April 16, 2026, 3:17 p.m. | 1 hour, 42 minutes ago
Description :SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-37343 - SourceCodester Vehicle Parking Area Management System SQL Injection Vulnerability",
"Content": "CVE ID :CVE-2026-37343
Published : April 16, 2026, 3:17 p.m. | 1 hour, 42 minutes ago
Description :SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_user.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2025-36579 - Dell Client Platform BIOS Authentication Bypass",
"Content": "CVE ID :CVE-2025-36579
Published : April 16, 2026, 4:05 p.m. | 54 minutes ago
Description :Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability, leading to unauthorized access.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-6409 - Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input",
"Content": "CVE ID :CVE-2026-6409
Published : April 16, 2026, 3:17 p.m. | 1 hour, 42 minutes ago
Description :A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-3324 - Authentication Bypass",
"Content": "CVE ID :CVE-2026-3324
Published : April 16, 2026, 3:17 p.m. | 1 hour, 42 minutes ago
Description :Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-5426 - KnowledgeDeliver deployments before February 24, 2026 use a static http://ASP.NET/IIS machineKey value",
"Content": "CVE ID :CVE-2026-5426
Published : April 16, 2026, 4:16 p.m. | 43 minutes ago
Description :Hard-coded http://ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-37100 - Yamaha SR-B30A BLE Authentication Bypass Vulnerability",
"Content": "CVE ID :CVE-2026-37100
Published : April 16, 2026, 4:16 p.m. | 43 minutes ago
Description :An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / version: 2.40) allows remote attackers within BLE radio range to connect without authentication via the Sound Bar Remote protocol
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

CVE Monitor

Apr 17, 2026, 12:27 AM

{
"Source": "CVE FEED",
"Title": "CVE-2026-41080 - Oracle libexpat Hash Flooding Vulnerability",
"Content": "CVE ID :CVE-2026-41080
Published : April 16, 2026, 4:52 p.m. | 8 minutes ago
Description :libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
Severity: 2.9 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "16 Apr 2026",
"Type": "Vulnerability"
}
🔹 🔹

Showing 30 of 40 posts

Loading posts...

Rating

User Reviews (0)

No reviews yet. Be the first to share your experience!

Loading reviews...

Related Telegram Channels

Learn with Norway : what we need to learn for a bad day happened in Norge to live with more security / rights / equality

890

UNDERCODE NEWS

4340

Loading recommended channels...

CVE Monitor

CVE Monitor

Ranking

Participant Growth (Last 6 Days)

Latest Posts

Rating

User Reviews (0)

Related Telegram Channels

CYBERUPDATE^^2025

UX, CX and the Other Xs

Remote InfoSec / Cybersecurity Jobs

Cyber Intelligence Community

GhostWareOS

The SCIF

Learn with Norway : what we need to learn for a bad day happened in Norge to live with more security / rights / equality

UNDERCODE NEWS

Related Telegram Channels

CYBERUPDATE^^2025

UX, CX and the Other Xs

Remote InfoSec / Cybersecurity Jobs

Cyber Intelligence Community

GhostWareOS

The SCIF

Learn with Norway : what we need to learn for a bad day happened in Norge to live with more security / rights / equality

UNDERCODE NEWS

User Reviews (0)

Latest Posts