Articles

CyberPanel 2.1 Flaw Lets Authenticated Attackers Execute Remote Code

CVE-2021-47949 (CVSS 8.8) in CyberPanel 2.1 lets authenticated attackers read arbitrary files and execute code via symlink attacks through the filemanager controller endpoint.

CVE-2021-47949

Emlog CSRF Flaw CVE-2026-42286 Lets Attackers Hijack Admin Actions

Emlog CSRF Flaw CVE-2026-42286 Lets Attackers Hijack Admin Actions

CVE-2026-42286: Missing CSRF protection in Emlog prior to 2.6.11 lets attackers trick authenticated admins into unauthorized plugin management and config changes.

Google Ads, Claude Chats Push MacSync Infostealer to macOS Users

Attackers abuse Google Ads linking to real claude.ai and shared Claude chats to deliver MacSync infostealer, harvesting browser credentials and Keychain data.

4 min read

Opencart TMD Vendor System 3.x SQLi Lets Attackers Dump User

Opencart TMD Vendor System 3.x SQLi Lets Attackers Dump User

CVE-2021-47928 (CVSS 8.2): Unauthenticated blind SQL injection in Opencart TMD Vendor System 3.x lets attackers extract usernames, emails, and password reset codes from the...

CVE-2021-47928

Three WordPress Plugins Carry Stored XSS Flaws (CVE-2021-47926-929)

CVE-2021-47929CVE-2021-47927CVE-2021-47926

Three WordPress Plugins Carry Stored XSS Flaws (CVE-2021-47926-929)

CVE-2021-47926, CVE-2021-47927, and CVE-2021-47929 each carry a CVSS 6.4 stored XSS in Filterable Portfolio Gallery, WP Symposium Pro, and Contact Form to Email — authenticated...

4 min read

uBidAuction 2.0.1 Reflected XSS Flaw Lets Attackers Inject Scripts

uBidAuction 2.0.1 Reflected XSS Flaw Lets Attackers Inject Scripts

CVE-2022-50966 (CVSS 6.1): uBidAuction 2.0.1 reflected XSS in the news/manage module allows remote attackers to inject scripts via unsanitized GET parameters date_created,...

CVE-2022-50966

WordPress 3dady Stats Plugin Stored XSS Lets Attackers Hijack Sessions

WordPress 3dady Stats Plugin Stored XSS Lets Attackers Hijack Sessions

CVE-2022-50945 (CVSS 6.4): Stored XSS in WordPress 3dady real-time web stats plugin 1.0 lets authenticated attackers inject JavaScript via unsanitized input fields, enabling...

CVE-2022-50945

WordPress Curtain Plugin CSRF Lets Attackers Toggle Maintenance Mode

WordPress Curtain Plugin CSRF Lets Attackers Toggle Maintenance Mode

CVE-2022-50955: WordPress Curtain 1.0.2 CSRF flaw lets attackers trick admins into toggling site maintenance mode via forged requests without nonce validation.

CVE-2022-50955

WordPress GetPaid Plugin HTML Injection Flaw CVE-2021-47948

WordPress GetPaid Plugin HTML Injection Flaw CVE-2021-47948

CVE-2021-47948 (CVSS 5.4): Authenticated attackers can inject arbitrary HTML via the Help Text field in GetPaid 2.4.6, enabling stored XSS attacks on payment forms.

CVE-2021-47948

Acer PredatorSense LPE Lets Local Users Gain SYSTEM Privileges

VulnerabilitiesMay 9, 2026

Acer PredatorSense LPE Lets Local Users Gain SYSTEM Privileges

CVE-2026-8069: Acer PredatorSense versions 3.00.3136 to 3.00.3196 expose a misconfigured named pipe, letting any authenticated local user execute code as SYSTEM and delete...

CVE-2026-8069

VulnerabilitiesMay 9, 2026

Argo CD Flaw CVE-2026-42880 Leaks Kubernetes Secrets via Dry-Run

CRITICAL

Argo CD Flaw CVE-2026-42880 Leaks Kubernetes Secrets via Dry-Run

CVE-2026-42880 (CVSS 9.6) in Argo CD lets read-only attackers extract plaintext Kubernetes Secrets via ServerSideDiff endpoint using Server-Side Apply dry-run.

CVE-2026-42880

Bouncy Castle BC-FJA Flaw CVE-2026-8149 Leaks GCM Keys