62170 matches found
CVE-2026-23925
The CVE-2026-23925 issue affects Zabbix where an authenticated User with template/host write perms can misuse configuration.import to create unauthorized objects, leading to confidentiality loss (e.g., unauthorized hosts). Public sources corroborate an authorization bypass in Zabbix frontend/API ...
CVE-2026-23925 Unauthorized host creation via configuration.import API by low-privilege user with write permissions
An authenticated Zabbix user User role with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even...
CVE-2026-29068
creationtimestamp| type| source ---|---|--- 2026-03-06 08:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgeu6smysm2o...
CVE-2026-28799
creationtimestamp| type| source ---|---|--- 2026-03-06 07:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgetcdbnqw2z 2026-05-06 14:30:36+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3ml6w2wjym52c...
CVE-2026-29062
creationtimestamp| type| source ---|---|--- 2026-03-06 07:49:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mget7n4uht2o 2026-05-20 14:10:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3hklk2m2e...
CVE-2026-28683
creationtimestamp| type| source ---|---|--- 2026-03-06 06:30:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgeosgmxfl2u 2026-03-06 08:06:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu6hj3tj26 2026-03-06 08:07:30+00:00| seen|...
CVE-2026-29041
creationtimestamp| type| source ---|---|--- 2026-03-06 06:15:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgenxlfh4v2y 2026-03-06 08:15:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeunqzp772c 2026-03-06 08:15:55+00:00| seen|...
CVE-2026-28679
creationtimestamp| type| source ---|---|--- 2026-03-06 06:11:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgenpvtoos27 2026-03-06 08:09:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeudrl2nt2h...
CVE-2026-2446 Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update
The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options such as defaultrole etc and create arbitrary admin users...
CVE-2026-2446 Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update
The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options such as defaultrole etc and create arbitrary admin users...
CVE-2026-27005
creationtimestamp| type| source ---|---|--- 2026-03-06 05:55:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgemuhyhii2k...
CVE-2026-28681
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation...
CVE-2026-3560
creationtimestamp| type| source ---|---|--- 2026-03-06 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-158/ 2026-05-31 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn5qfwy5hx2x...
CVE-2026-3616
creationtimestamp| type| source ---|---|--- 2026-03-06 04:53:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgejflwmdm2n...
CVE-2026-29084 Gokapi: CSRF in Login Endpoint
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a...
CVE-2026-27807
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities e.g., assignment settings. These YAML files are parsed with aliases enabled. This issue has been patch...
CVE-2026-3610
creationtimestamp| type| source ---|---|--- 2026-03-06 04:14:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgeh74epfk27...
CVE-2026-28724
creationtimestamp| type| source ---|---|--- 2026-03-06 04:09:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgegvqn3qz27...