CVE-2026-1981

creationtimestamp| type| source ---|---|--- 2026-03-07 03:57:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggwpnlpxe2u...

CVE-2026-2494

creationtimestamp| type| source ---|---|--- 2026-03-07 03:47:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggw5qqdqf2d...

CVE-2026-1902

creationtimestamp| type| source ---|---|--- 2026-03-07 03:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgguj34uut2v...

CVE-2026-3233

creationtimestamp| type| source ---|---|--- 2026-03-07 03:04:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggtqrk7wd2z...

CVE-2025-14353

creationtimestamp| type| source ---|---|--- 2026-03-07 03:02:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggtnmaqmu2x 2026-03-07 04:20:41+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mggxz3abjs2n 2026-03-07 08:16:04+00:00| seen|...

CVE-2026-30822: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13...

CVE-2025-8899: Improper Privilege Management

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisperregisterform function not restricting user roles that can be set during registration. This makes it possible...

CVE-2026-30228

creationtimestamp| type| source ---|---|--- 2026-03-06 23:38:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggiayky772o...

Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

CVE-2026-30843

creationtimestamp| type| source ---|---|--- 2026-03-06 21:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg7vhzc662u...

GHSA-79WJ-8RQV-JVP5

creationtimestamp| type| source ---|---|--- 2026-03-06 20:40:06+00:00| seen| https://gist.github.com/alon710/c6f9f46bb80364d9d8a079167039fc0b...

CVE-2026-30229

creationtimestamp| type| source ---|---|--- 2026-03-06 20:40:06+00:00| seen| https://gist.github.com/alon710/c6f9f46bb80364d9d8a079167039fc0b 2026-03-06 23:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgggqhqr5r27...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789

Summary: Vito (self-hosted web app) suffers a cross-project privilege escalation due to a missing authorization check in workflow site-creation actions. Affected versions: prior to 3.20.3. Impact: an authenticated user with workflow write access in one project can create/manage sites on servers b...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

EUVD-2026-10068

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-30228 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API POST /files/:filename, DELETE /files/:filename. This bypasses the...

CVE-2026-30228 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API POST /files/:filename, DELETE /files/:filename. This bypasses the...

CVE-2026-29087

creationtimestamp| type| source ---|---|--- 2026-03-06 19:57:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg3uyapxa2o 2026-03-07 09:30:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghjdj5siw2v 2026-04-15 07:07:08+00:00| seen|...

CVE-2025-69645

creationtimestamp| type| source ---|---|--- 2026-03-06 19:08:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfz54gk7a24 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...