60098 matches found
CVE-2026-23486
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...
EUVD-2026-14545
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP Model Context Protocol server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4...
CVE-2026-23882 Blinko: Admin RCE - MCP Server Command Injection
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP Model Context Protocol server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4...
CVE-2026-23488 Blinko: multiple interfaces in the comment feature allow unauthorized access
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note including private notes without authorization, even if the note has not been publicly shared. The...
EUVD-2026-14544
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note including private notes without authorization, even if the note has not been publicly shared. The...
CVE-2026-23488
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note including private notes without authorization, even if the note has not been publicly shared. The...
CVE-2026-23488
Blinko is affected prior to version 1.8.4. The /api/v1/comment/create endpoint allows unauthorized posting of comments to any note (including private ones), and /api/v1/comment/list allows unauthorized viewing of comments on all notes. The issue is fixed in version 1.8.4. CVSS v4.0 base score 6.9...
CVE-2026-23488 Blinko: multiple interfaces in the comment feature allow unauthorized access
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note including private notes without authorization, even if the note has not been publicly shared. The...
EUVD-2026-14541
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...
CVE-2026-23486
The CVE-2026-23486 vulnerability affects Blinko prior to version 1.8.4, where a publicly accessible endpoint exposed all user information (usernames, roles, and account creation dates). The issue is caused by an exposed endpoint, with impacts limited to information disclosure (low confidentiality...
CVE-2026-23486 Blinko: Unauthorized User Information Leak
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...
CVE-2026-23486
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...
CVE-2026-23486 Blinko: Unauthorized User Information Leak
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...
CVE-2026-33517
creationtimestamp| type| source ---|---|--- 2026-03-23 19:16:27+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33517 2026-03-23 22:39:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr4ufbdb72g...
CVE-2026-33532
creationtimestamp| type| source ---|---|--- 2026-03-23 18:31:32+00:00| published-proof-of-concept| https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp 2026-03-26 19:16:15+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33532 2026-03-27...
WordPress Appmax plugin <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint vulnerability
Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint vulnerability discovered by WordFence in WordPress Plugin Appmax versions = 1.0.3...
CVE-2026-30498
creationtimestamp| type| source ---|---|--- 2026-03-23 18:00:04+00:00| seen| https://t.me/GithubRedTeam/76860 2026-09-24 23:00:15+00:00| seen| Telegram/aZCb1ZT5ToCPLdANwjtdC2c-OdVdjT8CFU5E1EmQZAX-4 2026-09-24 23:00:15+00:00| published-proof-of-concept|...
CVE-2025-71263
creationtimestamp| type| source ---|---|--- 2026-03-23 17:01:18+00:00| seen| https://bsky.app/profile/krutonium.social.treehouse.systems.ap.brid.gy/post/3mhqjxjbr7in2...
CVE-2026-33697
creationtimestamp| type| source ---|---|--- 2026-03-23 15:52:32+00:00| confirmed| https://github.com/ultravioletrs/cocos/security/advisories/GHSA-vfgg-mvxx-mgg7 2026-03-27 01:00:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyw4nni6v2s 2026-03-27 01:00:25+00:00| seen|...