CVE-2026-0038

creationtimestamp| type| source ---|---|--- 2026-03-02 19:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3zscqoxr2o 2026-03-02 22:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg4aw6zhzw26 2026-03-02 22:15:08+00:00| seen|...

Directory Traversal

mcp-server-git is vulnerable to Directory Traversal. The vulnerability is due to the gitinit tool accepting arbitrary filesystem paths and creating Git repositories without validating the target location, where an attacker can exploit this to create repositories at arbitrary locations, and...

GHSA-5PMP-JPCF-PWX6

creationtimestamp| type| source ---|---|--- 2026-03-02 18:40:09+00:00| seen| https://gist.github.com/alon710/c8ef02a720c5ab2caad0ee631080ee0f 2026-03-02 18:55:03+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mg3wjx7soq2t...

CVE-2025-50198

creationtimestamp| type| source ---|---|--- 2026-03-02 18:25:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3uv6lsz22k...

CVE-2025-47375

creationtimestamp| type| source ---|---|--- 2026-03-02 18:09:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3tynljdb25 2026-03-04 19:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mgaxr3hubk2m...

CVE-2025-50192

creationtimestamp| type| source ---|---|--- 2026-03-02 17:45:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3soarld62u 2026-03-03 19:55:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg6kff3yfk2h...

CVE-2025-63909

creationtimestamp| type| source ---|---|--- 2026-03-02 17:29:31+00:00| seen| https://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef 2026-03-02 17:29:34+00:00| seen| https://gist.github.com/GregDurys/8b7a3022c04b6cee8c1e1af04f5671b2 2026-03-03 20:06:25+00:00| seen|...

CVE-2025-67840

creationtimestamp| type| source ---|---|--- 2026-03-02 17:29:30+00:00| seen| https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270 2026-03-03 20:38:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6mrxvflt2n 2026-03-05 01:00:16+00:00| seen|...

CVE-2025-50196

creationtimestamp| type| source ---|---|--- 2026-03-02 16:47:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3pfy67g427...

CVE-2026-28286

ZimaOS 1.5.2-beta3 is affected: the UI blocks file/folder creation in internal paths, but the API bypasses this validation, allowing arbitrary file/directory creation in sensitive dirs (e.g., /etc, /usr) via crafted requests. Root cause is improper API path validation, enabling path traversal-lik...

CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...

CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...

CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...

CVE-2026-26695

creationtimestamp| type| source ---|---|--- 2026-03-02 16:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3nogbqu62k...

CVE-2025-52998

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...

CVE-2026-24115

creationtimestamp| type| source ---|---|--- 2026-03-02 16:08:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3n7zpghz2d...

CVE-2026-0995

creationtimestamp| type| source ---|---|--- 2026-03-02 15:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3mlcirgx2x...

CVE-2025-52998 Chamilo: PHAR deserialization bypass

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...

CVE-2025-52998 Chamilo: PHAR deserialization bypass

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...

CVE-2026-20430

creationtimestamp| type| source ---|---|--- 2026-03-02 14:41:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3idougdi2d 2026-03-02 18:20:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3uma3wcb24 2026-03-03 09:08:54+00:00| seen|...