Web Security Insights By Maloy Roy Orko

IFTTT

CVE-2026-14848 - Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

byMaloy Roy Orko -August 04, 2026

CVE ID : CVE-2026-14848 Published : Aug. 4, 2026, 7:16 a.m. | 1 hour, 13 minutes ago …

IFTTT

CVE-2026-18582 - mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap

byMaloy Roy Orko -August 02, 2026

CVE ID : CVE-2026-18582 Published : Aug. 3, 2026, 1:15 a.m. | 1 hour, 14 minutes ago …

IFTTT

CVE-2026-18577 - Incomplete patch leads to administrative account takeover

byMaloy Roy Orko -August 02, 2026

CVE ID : CVE-2026-18577 Published : Aug. 2, 2026, 11:16 p.m. | 1 hour, 12 minutes ago …

IFTTT

CVE-2026-10848 - Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

byMaloy Roy Orko -August 02, 2026

CVE ID : CVE-2026-10848 Published : Aug. 2, 2026, 5:16 p.m. | 1 hour, 12 minutes ago …

IFTTT

CVE-2026-54894 - Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

byMaloy Roy Orko -August 01, 2026

CVE ID : CVE-2026-54894 Published : Aug. 1, 2026, 7:16 p.m. | 1 hour, 12 minutes ago …

IFTTT

CVE-2026-56567 - HCL iControl is affected by multiple security vulnerabilities.

byMaloy Roy Orko -July 31, 2026

CVE ID : CVE-2026-56567 Published : July 31, 2026, 4:17 p.m. | 2 hours, 11 minutes ago …

IFTTT

CVE-2026-66416 - Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

byMaloy Roy Orko -July 30, 2026

CVE ID : CVE-2026-66416 Published : July 30, 2026, 5 p.m. | 1 hour, 27 minutes ago …

IFTTT

CVE-2026-51992 - ClickHouse Server SQL Injection Vulnerability

byMaloy Roy Orko -July 29, 2026

CVE ID : CVE-2026-51992 Published : July 29, 2026, 5:16 p.m. | 1 hour, 10 minutes ago …

IFTTT

CVE-2026-20316 - Cisco Secure Firewall Management Center Software Static Credential Vulnerability

byMaloy Roy Orko -July 29, 2026

CVE ID : CVE-2026-20316 Published : July 29, 2026, 5:16 p.m. | 1 hour, 10 minutes ago …

IFTTT

CVE-2026-15735 - Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta

byMaloy Roy Orko -July 28, 2026

CVE ID : CVE-2026-15735 Published : July 29, 2026, 1:29 a.m. | 57 minutes ago Desc…

IFTTT

CVE-2026-64646 - Next.js: Unbounded Server Action payload in Edge runtime

byMaloy Roy Orko -July 27, 2026

CVE ID : CVE-2026-64646 Published : July 27, 2026, 7:17 p.m. | 1 hour, 8 minutes ago …

IFTTT

CVE-2026-17500 - ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference

byMaloy Roy Orko -July 26, 2026

CVE ID : CVE-2026-17500 Published : July 27, 2026, 1:16 a.m. | 1 hour, 9 minutes ago …

IFTTT

CVE-2026-57978 - Microsoft Edge (Chromium-based) Spoofing Vulnerability

byMaloy Roy Orko -July 26, 2026

CVE ID : CVE-2026-57978 Published : July 26, 2026, 5:17 p.m. | 1 hour, 8 minutes ago …

IFTTT

CVE-2026-17434 - nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

byMaloy Roy Orko -July 25, 2026

CVE ID : CVE-2026-17434 Published : July 26, 2026, 3 a.m. | 1 hour, 25 minutes ago …

IFTTT

CVE-2026-17432 - NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

byMaloy Roy Orko -July 25, 2026

CVE ID : CVE-2026-17432 Published : July 26, 2026, 1:16 a.m. | 1 hour, 8 minutes ago …

IFTTT

CVE-2026-65623 - Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

byMaloy Roy Orko -July 24, 2026

CVE ID : CVE-2026-65623 Published : July 24, 2026, 5:17 p.m. | 1 hour, 6 minutes ago …

IFTTT

CVE-2026-65763 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9

byMaloy Roy Orko -July 23, 2026

CVE ID : CVE-2026-65763 Published : July 23, 2026, 4:57 p.m. | 1 hour, 26 minutes ago …

IFTTT

CVE-2026-16628 - oclif JIT Plugin Entry child_process.exec os command injection

byMaloy Roy Orko -July 22, 2026

CVE ID : CVE-2026-16628 Published : July 22, 2026, 9 p.m. | 1 hour, 23 minutes ago …

IFTTT

CVE-2026-47398 - PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

byMaloy Roy Orko -July 21, 2026

CVE ID : CVE-2026-47398 Published : July 21, 2026, 5:17 p.m. | 1 hour, 5 minutes ago …

IFTTT

CVE-2026-16336 - trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

byMaloy Roy Orko -July 20, 2026

CVE ID : CVE-2026-16336 Published : July 21, 2026, 2:30 a.m. | 1 hour, 52 minutes ago …

Web Security Insights By Maloy Roy Orko

CVE-2026-14848 - Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

CVE-2026-18582 - mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap

CVE-2026-18577 - Incomplete patch leads to administrative account takeover

CVE-2026-10848 - Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

CVE-2026-54894 - Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

CVE-2026-56567 - HCL iControl is affected by multiple security vulnerabilities.

CVE-2026-66416 - Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

CVE-2026-51992 - ClickHouse Server SQL Injection Vulnerability

CVE-2026-20316 - Cisco Secure Firewall Management Center Software Static Credential Vulnerability

CVE-2026-15735 - Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta

CVE-2026-64646 - Next.js: Unbounded Server Action payload in Edge runtime

CVE-2026-17500 - ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference

CVE-2026-57978 - Microsoft Edge (Chromium-based) Spoofing Vulnerability

CVE-2026-17434 - nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

CVE-2026-17432 - NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

CVE-2026-65623 - Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

CVE-2026-65763 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9

CVE-2026-16628 - oclif JIT Plugin Entry child_process.exec os command injection

CVE-2026-47398 - PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

CVE-2026-16336 - trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

Simple-User-Management-System V 1.0 | Name, Username - register.php | Stored Cross Site Scripting(XSS) | Found By Maloy Roy Orko

Categories

Main Tags

Contact Form

Latest Posts

Popular Posts

Simple-User-Management-System V 1.0 | Name, Username - register.php | Stored Cross Site Scripting(XSS) | Found By Maloy Roy Orko

CVE-2025-0842 | Library-Card-System | SQL Injection Admin Login Bypass In admin.php | Found By Maloy Roy Orko

Script and Tools | eCommerce 3.0 | login.php - No Limit To Authentication Attempts To User Login