Vulnerabilities
Craft CMS Twig Filter Flaw Allows Remote Code Execution
Authenticated users can exploit a missing guard in Craft CMS to write webshells, affecting versions prior to 4.18.8 and 5.11.0.
NVD
Everything Vuln Post has reported about NVD: 10 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
WordPress Green Popups 7.6.3 Fixes Critical Blind SQL Injection CVE-2026-94388
WordPress sites using halfdata Green Popups must update to version 7.6.3 to fix a critical blind SQL injection flaw.
Vulnerabilities
ILIAS PHP Object Injection Flaw Lets Authenticated Users Run Code
A high-severity vulnerability in ILIAS allows attackers with test permissions to execute arbitrary code via crafted archives.
Vulnerabilities
GitPython Argument Injection in Head.checkout() Allows Arbitrary File Read Before 3.2.0
Versions of the GitPython library prior to 3.2.0 contain a high-severity argument injection flaw that lets attackers read local files via malicious branch names.
Vulnerabilities
MoviePilot Command Injection Flaw Allows Remote Code Execution
A high-severity flaw in MoviePilot through 3.1.5 lets attackers run system commands via crafted content, with no patch confirmed yet.
Vulnerabilities
Eclipse Vert.x PostgreSQL Client Has High-Severity Memory Exhaustion Flaw
A missing validation check in the PostgreSQL message decoder allows malicious servers to crash clients before authentication completes.
Vulnerabilities
Adobe ColdFusion Authorization Bypass CVE-2026-75994 Triggers Urgent Patch for 2023/2025 Versions
A critical authorization flaw in Adobe ColdFusion lets attackers run code without user interaction. Teams must patch versions 2025.0.13 and 2023.0.25 immediately.
Vulnerabilities
AEM OS Command Injection Flaw Allows Low-Privilege Code Execution
A critical OS command injection in Adobe Experience Manager lets low-privileged users run code without interaction. No patch is confirmed yet.
Vulnerabilities
Argo CD: Critical Auth Bypass in PostDelete Hooks Lets Git Users Create Unauthorized Kubernetes Resources
A critical flaw allows attackers to bypass authorization checks when deleting Argo CD applications, enabling unauthorized resource creation in Kubernetes clusters.
Vulnerabilities
WordPress Convex Plugin Deserialization Vulnerability Requires Immediate Patching for Critical Fix
Security teams must patch WordPress installations running ThemeREX Convex versions through 1.16.0 to close a critical deserialization flaw rated 9.8 by the NVD.