CVE-2026-29084

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a...

CVE-2026-2446

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options such as defaultrole etc and create arbitrary admin users...

CVE-2026-1825

creationtimestamp| type| source ---|---|--- 2026-03-07 07:16:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1825 2026-03-07 10:13:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghlqjmp562d...

CVE-2026-1820

creationtimestamp| type| source ---|---|--- 2026-03-07 07:16:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1820 2026-03-07 09:39:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghjsyfvin2d...

CVE-2026-30822

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13...

CVE-2026-1981

creationtimestamp| type| source ---|---|--- 2026-03-07 03:57:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggwpnlpxe2u...

CVE-2026-2494

creationtimestamp| type| source ---|---|--- 2026-03-07 03:47:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggw5qqdqf2d...

CVE-2026-1902

creationtimestamp| type| source ---|---|--- 2026-03-07 03:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgguj34uut2v...

CVE-2026-3233

creationtimestamp| type| source ---|---|--- 2026-03-07 03:04:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggtqrk7wd2z...

CVE-2025-14353

creationtimestamp| type| source ---|---|--- 2026-03-07 03:02:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggtnmaqmu2x 2026-03-07 04:20:41+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mggxz3abjs2n 2026-03-07 08:16:04+00:00| seen|...

CVE-2026-30822: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13...

CVE-2025-8899: Improper Privilege Management

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisperregisterform function not restricting user roles that can be set during registration. This makes it possible...

CVE-2026-30228

creationtimestamp| type| source ---|---|--- 2026-03-06 23:38:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggiayky772o...

Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

CVE-2026-30843

creationtimestamp| type| source ---|---|--- 2026-03-06 21:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg7vhzc662u...

GHSA-79WJ-8RQV-JVP5

creationtimestamp| type| source ---|---|--- 2026-03-06 20:40:06+00:00| seen| https://gist.github.com/alon710/c6f9f46bb80364d9d8a079167039fc0b...

CVE-2026-30229

creationtimestamp| type| source ---|---|--- 2026-03-06 20:40:06+00:00| seen| https://gist.github.com/alon710/c6f9f46bb80364d9d8a079167039fc0b 2026-03-06 23:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgggqhqr5r27...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789

Summary: Vito (self-hosted web app) suffers a cross-project privilege escalation due to a missing authorization check in workflow site-creation actions. Affected versions: prior to 3.20.3. Impact: an authenticated user with workflow write access in one project can create/manage sites on servers b...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...