59230 matches found
CVE-2026-27282
creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 01:56:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjis4gfiax2a 2026-04-15 12:08:47+00:00| seen|...
CVE-2026-27306
creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 13:19:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjycyzdkv2y 2026-04-15 13:55:19+00:00| seen|...
GHSA-789Q-PW85-J2Q2
creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:40+00:00| published-proof-of-concept| Telegram/vFalP9cCg-kFoPrSdHM4ZH4qnLHRdngXJCuq8FbW2RkF4k...
CVE-2026-27287
creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:40+00:00| published-proof-of-concept| Telegram/vFalP9cCg-kFoPrSdHM4ZH4qnLHRdngXJCuq8FbW2RkF4k 2026-04-15 14:09:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjk34fxk7n2u 2026-04-16 00:37:07+00:00| seen|...
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip the...
EUVD-2026-22770
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...
GHSA-JRQ5-HG6X-J6G3 goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Summary goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or...
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Summary goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or...
CVE-2026-27303
creationtimestamp| type| source ---|---|--- 2026-04-14 20:07:55+00:00| seen| Telegram/b-0H5pCtilxNZxS-gRRPsAWUA3zqxMoGzwWTkVBCMIvH7s 2026-04-15 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116407194668187884 2026-04-15 06:00:31+00:00| seen|...
GHSA-FMQP-4WFC-W3V7 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach
Summary Kyverno's APICall feature contains a Server-Side Request Forgery SSRF vulnerability that allows users with Policy creation permissions to access arbitrary internal resources through Kyverno's high-privilege ServiceAccount. In multi-tenant Kubernetes environments, this constitutes a classi...
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach
Summary Kyverno's APICall feature contains a Server-Side Request Forgery SSRF vulnerability that allows users with Policy creation permissions to access arbitrary internal resources through Kyverno's high-privilege ServiceAccount. In multi-tenant Kubernetes environments, this constitutes a classi...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the APICall feature. An attacker can access sensitive internal resources and exfiltrate confidential data by supplying arbitrary URLs to the APICall feature, which are executed with elevated privilege...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the APICall feature. An attacker can access sensitive internal resources and exfiltrate confidential data by supplying arbitrary URLs to the APICall feature, which are executed with elevated privilege...
CVE-2026-30480
creationtimestamp| type| source ---|---|--- 2026-04-14 20:00:04+00:00| seen| https://t.me/GithubRedTeam/80312 2026-04-15 14:37:07+00:00| published-proof-of-concept| https://t.me/bdufstecru/3082...
CVE-2026-26291
creationtimestamp| type| source ---|---|--- 2026-04-14 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN62079296 2026-04-15 08:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjikmbqs623...
CVE-2026-4369
creationtimestamp| type| source ---|---|--- 2026-04-14 17:28:08+00:00| seen| Telegram/Vdpd7lT308fxiW1s76LVsqR9F6P793RnQqd0qJzf2KghFE 2026-04-14 17:50:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhwxagd6l2o...
CVE-2026-4345
creationtimestamp| type| source ---|---|--- 2026-04-14 17:28:08+00:00| seen| Telegram/Vdpd7lT308fxiW1s76LVsqR9F6P793RnQqd0qJzf2KghFE 2026-04-14 18:32:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhzcoitrz2z...
CVE-2026-39475
creationtimestamp| type| source ---|---|--- 2026-04-14 17:27:59+00:00| seen| Telegram/ylyKsnGn7IUGtPSjSQJxYkLCLx52u0woajEqQVy7zzhnhE...