Web Security Insights By Maloy Roy Orko

Showing posts from May, 2026

IFTTT

CVE-2026-34253 - Vorbis-tools Ogg123 Buffer Underflow Vulnerability

byMaloy Roy Orko -May 15, 2026

CVE ID : CVE-2026-34253 Published : May 15, 2026, 3:16 p.m. | 1 hour, 51 minutes ago …

IFTTT

CVE-2025-14972 - Insufficient DPA countermeasure reseeding

byMaloy Roy Orko -May 15, 2026

CVE ID : CVE-2025-14972 Published : May 15, 2026, 3:16 p.m. | 1 hour, 51 minutes ago …

IFTTT

CVE-2026-42159 - Flowsint: Stored XSS in description of node

byMaloy Roy Orko -May 14, 2026

CVE ID : CVE-2026-42159 Published : May 14, 2026, 4:16 p.m. | 51 minutes ago Descr…

IFTTT

CVE-2026-44002 - vm2: Host File Path Disclosure via Stack Trace Information Leak

byMaloy Roy Orko -May 13, 2026

CVE ID : CVE-2026-44002 Published : May 13, 2026, 6:16 p.m. | 50 minutes ago Descr…

IFTTT

CVE-2026-42156 - Flowsint: Cypher query injection in node type on node creation

byMaloy Roy Orko -May 12, 2026

CVE ID : CVE-2026-42156 Published : May 12, 2026, 11:16 p.m. | 1 hour, 50 minutes ago …

IFTTT

CVE-2026-42608 - Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

byMaloy Roy Orko -May 11, 2026

CVE ID : CVE-2026-42608 Published : May 11, 2026, 4:17 p.m. | 48 minutes ago Descr…

IFTTT

CVE-2026-45180 - Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids

byMaloy Roy Orko -May 10, 2026

CVE ID : CVE-2026-45180 Published : May 10, 2026, 8:03 p.m. | 1 hour, 1 minute ago …

IFTTT

CVE-2026-8191 - Wavlink NU516U1 adm.cgi wifi_region os command injection

byMaloy Roy Orko -May 09, 2026

CVE ID : CVE-2026-8191 Published : May 9, 2026, 6:15 p.m. | 49 minutes ago Descrip…

IFTTT

CVE-2026-8189 - Wavlink NU516U1 adm.cgi wzdrepeater os command injection

byMaloy Roy Orko -May 09, 2026

CVE ID : CVE-2026-8189 Published : May 9, 2026, 4:15 p.m. | 49 minutes ago Descrip…

IFTTT

CVE-2026-41495 - n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

byMaloy Roy Orko -May 08, 2026

CVE ID : CVE-2026-41495 Published : May 8, 2026, 8:16 p.m. | 47 minutes ago Descri…

IFTTT

CVE-2026-41903 - FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472)

byMaloy Roy Orko -May 07, 2026

CVE ID : CVE-2026-41903 Published : May 7, 2026, 6:02 p.m. | 1 hour, 1 minute ago …

IFTTT

CVE-2026-40195 - Incus nil-pointer dereference in storage bucket import allows denial of service

byMaloy Roy Orko -May 06, 2026

CVE ID : CVE-2026-40195 Published : May 6, 2026, 9:16 p.m. | 1 hour, 39 minutes ago …

IFTTT

CVE-2025-71251 - Apache IMS Remote Denial of Service Vulnerability

byMaloy Roy Orko -May 05, 2026

CVE ID : CVE-2025-71251 Published : May 6, 2026, 1:42 a.m. | 45 minutes ago Descri…

IFTTT

CVE-2026-44405 - Paramiko RSA Key SHA-1 Vulnerability

byMaloy Roy Orko -May 05, 2026

CVE ID : CVE-2026-44405 Published : May 5, 2026, 11:50 p.m. | 37 minutes ago Descr…

IFTTT

CVE-2025-67796 - IKUS Rdiffweb Improper Authorization Vulnerability

byMaloy Roy Orko -May 04, 2026

CVE ID : CVE-2025-67796 Published : May 4, 2026, 8:16 p.m. | 1 hour, 54 minutes ago …

IFTTT

CVE-2026-7710 - YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication

byMaloy Roy Orko -May 03, 2026

CVE ID : CVE-2026-7710 Published : May 3, 2026, 11:15 p.m. | 53 minutes ago Descri…

IFTTT

CVE-2026-7702 - toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization

byMaloy Roy Orko -May 03, 2026

CVE ID : CVE-2026-7702 Published : May 3, 2026, 4:15 p.m. | 1 hour, 53 minutes ago …

IFTTT

CVE-2026-7669 - sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer deserialization

byMaloy Roy Orko -May 02, 2026

CVE ID : CVE-2026-7669 Published : May 2, 2026, 10:16 p.m. | 1 hour, 52 minutes ago …

IFTTT

CVE-2026-7668 - MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds

byMaloy Roy Orko -May 02, 2026

CVE ID : CVE-2026-7668 Published : May 2, 2026, 9:16 p.m. | 52 minutes ago Descrip…

Latest Vulnerabilities

CVE-2026-41940 ~ Critical Zero Day in Cpanel & WHM

byMaloy Roy Orko -May 02, 2026

A critical, actively exploited zero-day vulnerability ( CVE-2026-41940 ) in cPanel & WHM all…

Latest Vulnerabilities

CVE-2026-6378 - Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API

byMaloy Roy Orko -May 01, 2026

CVE ID : CVE-2026-6378 Published : May 2, 2026, 4:16 a.m. | 1 hour, 50 minutes ago …

Latest Vulnerabilities

CVE-2026-7601 - Open5GS AMF gmm-handler.c denial of service

byMaloy Roy Orko -May 01, 2026

CVE ID : CVE-2026-7601 Published : May 2, 2026, 3:15 a.m. | 51 minutes ago Descrip…

IFTTT

CVE-2026-7600 - ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection

byMaloy Roy Orko -May 01, 2026

CVE ID : CVE-2026-7600 Published : May 2, 2026, 1:16 a.m. | 51 minutes ago Descrip…

Web Security Insights By Maloy Roy Orko

CVE-2026-34253 - Vorbis-tools Ogg123 Buffer Underflow Vulnerability

CVE-2025-14972 - Insufficient DPA countermeasure reseeding

CVE-2026-42159 - Flowsint: Stored XSS in description of node

CVE-2026-44002 - vm2: Host File Path Disclosure via Stack Trace Information Leak

CVE-2026-42156 - Flowsint: Cypher query injection in node type on node creation

CVE-2026-42608 - Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

CVE-2026-45180 - Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids

CVE-2026-8191 - Wavlink NU516U1 adm.cgi wifi_region os command injection

CVE-2026-8189 - Wavlink NU516U1 adm.cgi wzdrepeater os command injection

CVE-2026-41495 - n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

CVE-2026-41903 - FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472)

CVE-2026-40195 - Incus nil-pointer dereference in storage bucket import allows denial of service

CVE-2025-71251 - Apache IMS Remote Denial of Service Vulnerability

CVE-2026-44405 - Paramiko RSA Key SHA-1 Vulnerability

CVE-2025-67796 - IKUS Rdiffweb Improper Authorization Vulnerability

CVE-2026-7710 - YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication

CVE-2026-7702 - toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization

CVE-2026-7669 - sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer deserialization

CVE-2026-7668 - MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds

CVE-2026-41940 ~ Critical Zero Day in Cpanel & WHM

CVE-2026-6378 - Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API

CVE-2026-7601 - Open5GS AMF gmm-handler.c denial of service

CVE-2026-7600 - ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection

(CVE-2024-13205,CVE-2024-13204)-SQL-Injection-To-XSS-In-Ecommerce-PHP-kurniaramadhan-1.0

Categories

Main Tags

Contact Form

Latest Posts

Popular Posts

(CVE-2024-13205,CVE-2024-13204)-SQL-Injection-To-XSS-In-Ecommerce-PHP-kurniaramadhan-1.0

CVE-2025-0842 | Library-Card-System | SQL Injection Admin Login Bypass In admin.php | Found By Maloy Roy Orko

Library-Card-System V 1.0 | Add Picture/Signature - signup.php | Unrestricted File Upload | Found By Maloy Roy Orko