MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

GHSA-G6PG-52VF-843H MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2026-33206

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4...

GHSA-H3P4-M74F-43G6

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4...

CVE-2026-25396

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE...

CVE-2026-25334

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE 2026-04-07 04:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miuwyhv7db2w...

CVE-2026-33770

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-5036

creationtimestamp| type| source ---|---|--- 2026-03-27 16:25:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116302066909306765 2026-03-28 16:16:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116307694173463292 2026-03-29 09:00:30+00:00| seen|...

CVE-2026-33770

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-33770 AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-33770

Summary: CVE-2026-33770 affects WWBN/AVideo up to version 26.0, where fixCleanTitle() in objects/category.php interpolates user-controlled data directly into a SQL query, enabling SQL injection when creating or renaming categories. The vulnerability stems from building the query with $clean_title...

CVE-2026-27877

creationtimestamp| type| source ---|---|--- 2026-03-27 16:03:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2ilk6erq2s...

CVE-2026-1496

creationtimestamp| type| source ---|---|--- 2026-03-27 15:56:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2i7xzklv2s 2026-03-27 17:22:21+00:00| seen| Telegram/YkFovyOp1l89l2HrsHhU-e8kv9HXA0gCdui6VpSIt8SuiME...

CVE-2026-33044

creationtimestamp| type| source ---|---|--- 2026-03-27 15:48:13+00:00| published-proof-of-concept| https://github.com/home-assistant/core/security/advisories/GHSA-r584-6283-p7xc 2026-03-27 21:22:55+00:00| seen| Telegram/Gog278dWyh4lEZUplneDunVggYKWxHPgBiv3mkrQtX1ZGY 2026-03-28 19:35:35+00:00| see...

Allocation of Resources Without Limits or Throttling

Overview miraheze/ts-portal is a Portal for handling and managing the investigation lifecycle for Trust and Safety at the WikiTide Foundation Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DPAAlreadyLive validation process. An...

GHSA-6FQ7-PGJ3-6CFP

creationtimestamp| type| source ---|---|--- 2026-03-27 15:17:36+00:00| seen| Telegram/LBnoZEkIgYZcAalPkuHtbpp5d2DNhQfVZICyQCgDXFXXQ...

CVE-2026-4620

creationtimestamp| type| source ---|---|--- 2026-03-27 15:17:14+00:00| seen| Telegram/svRbUAS3r6GAYzDJQh3Todl-Lk2he1i8bWMEx2GJpog2k 2026-03-27 16:05:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2ipzkusr2s 2026-04-02 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN89339669/...

CVE-2026-5024

creationtimestamp| type| source ---|---|--- 2026-03-27 15:04:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116301748482237182 2026-03-28 12:13:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116306738692445946 2026-03-29 03:55:28+00:00| seen|...

CVE-2026-27860

creationtimestamp| type| source ---|---|--- 2026-03-27 12:32:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi24tiyi3523 2026-03-30 22:50:34+00:00| seen| https://gist.github.com/elchinsir/a50bb1cfa4daf45f28b65ae3f0eeb05a...

SUSE CVE-2019-25544

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat,...