CVE-2026-33541 TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 34, a flaw in TSPortal allowed attackers to create arbitrary user records in the database by abusing validation logic. Whil...

CVE-2026-33529 Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the revision controllers. An attacker can access entry revisions and view sensitive field values and blueprint data by bypassing authorization checks with authenticated Control Panel access. Users may also creat...

CVE-2026-26074

creationtimestamp| type| source ---|---|--- 2026-03-26 18:58:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhybwb2tdh2e 2026-03-31 05:20:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3midgjihdb62c...

CVE-2026-4923

creationtimestamp| type| source ---|---|--- 2026-03-26 18:56:15+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhybs4t2sk27 2026-03-26 20:17:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhygeac6dl2i...

CVE-2026-4926

creationtimestamp| type| source ---|---|--- 2026-03-26 18:55:29+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhybqr5nz227 2026-03-26 20:03:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyfjwhnel27 2026-03-26 21:01:16+00:00| seen|...

CVE-2026-33009

creationtimestamp| type| source ---|---|--- 2026-03-26 18:44:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyb5mpmwy2d 2026-03-26 22:22:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyndnlegi2d...

SQL Injection

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to SQL Injection via the fixCleanTitle function. An attacker can access sensitive database information by injecting crafted input into the cleantitle or id parameters...

CVE-2026-4877

creationtimestamp| type| source ---|---|--- 2026-03-26 17:52:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy6anxugc22...

CVE-2026-26071

creationtimestamp| type| source ---|---|--- 2026-03-26 17:32:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy54u7dy727...

CVE-2026-29934

creationtimestamp| type| source ---|---|--- 2026-03-26 17:24:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4ohoqaj2d...

CVE-2026-28298

creationtimestamp| type| source ---|---|--- 2026-03-26 17:21:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4iik56q2z 2026-03-27 03:00:06+00:00| seen| https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28297...

CVE-2026-26072

creationtimestamp| type| source ---|---|--- 2026-03-26 17:06:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy3o4ci4y2t...

CVE-2026-29933

creationtimestamp| type| source ---|---|--- 2026-03-26 17:01:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy3elljsx23...

CVE-2025-55043

MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality csettings.cfc createBundle method that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerabili...

CVE-2019-25650

creationtimestamp| type| source ---|---|--- 2026-03-26 15:16:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxvjohirv2n...

CVE-2026-28282

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a security flaw in the discourse-policy plugin which allowed a user with policy creation permission to gain membership access to any private/restricted groups. Once membership to a...

CVE-2025-69237

Raytha CMS is vulnerable to Stored XSS via FieldValues0.Value parameter in page creation functionality. Authenticated attacker with permissions to create content can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in versi...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-23488

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note including private notes without authorization, even if the note has not been publicly shared. The...