Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.4 CVE-2026-11614

Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets_CVE-2026-11614

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' paramete...

xpro Xpro Addons — 140+ Widgets for Elementor CVE
MEDIUM 6.7 37C50661-A878-

kev-investigator_37C50661-A878-507B-9377-0F99874BB5CE

KEV Investigator An automated investigation draft generator for CISA's Known Exploited Vulnerabilities KEV catalog — built to remove the repetitive...

N/A N/A GITHUBEXPLOIT
CRITICAL 9.8 EECE9D9F-6DA3-

Exploit for Path Traversal in Apache Http_Server_EECE9D9F-6DA3-5669-A840-4B74F51D2FBB

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi bypass de parche Solo para uso en entornos controlados y propios. No usar contra sistemas sin...

N/A N/A GITHUBEXPLOIT
HIGH 8.9 CVE-2026-12681

CVE-2026-12681_CVE-2026-12681

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advan...

Google go-attestation CVE
HIGH 8.7 CVE-2026-7574

Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use_CVE-2026-7574

Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) val...

Anthropic Claude Desktop Cowork 1.1348.0 CVE
MEDIUM 5.1 CVE-2026-6458

AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty_CVE-2026-6458

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming...

Caliptra Core Runtime Firmware 2.0.0 CVE
HIGH 7.2 CVE-2026-5818

MCU Firmware Update Authentication Bypass on Caliptra Core_CVE-2026-5818

Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Cor...

Caliptra Core Runtime Firmware 2.0.0 CVE
HIGH 8.8 CVE-2026-54639

Style Dictionary – Prototype Pollution in convertTokenData utility function_CVE-2026-54639

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to...

style-dictionary style-dictionary >= 4.3.0, < 5.4.4 CVE
CRITICAL 9.8 D76E3BC5-2C10-

Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin_D76E3BC5-2C10-52DE-8FE2-24C1C9C72D09

this is my version i found a lot in internet but those are too bad USAGE python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4...

N/A N/A GITHUBEXPLOIT
HIGH 8.1 CVE-2026-39253

CVE-2026-39253_CVE-2026-39253

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Se...

n/a n/a n/a CVE