GHSA-945P-3JHM-6RCP

creationtimestamp| type| source ---|---|--- 2026-02-28 03:40:10+00:00| seen| https://gist.github.com/alon710/43a4ce973e7deb9cb22c759bda6c4252...

CVE-2026-22722

creationtimestamp| type| source ---|---|--- 2026-02-28 03:31:16+00:00| seen| https://bsky.app/profile/cyber-news-fi.bsky.social/post/3mfvbybg7ae2c...

GHSA-5C6J-R48X-RMVQ

creationtimestamp| type| source ---|---|--- 2026-02-28 03:10:11+00:00| seen| https://gist.github.com/alon710/d1eb861b7784463c434753842ee96c85 2026-04-03 15:44:39+00:00| seen| https://gist.github.com/kbellioum/2aaedb76430c4e5fc2f81d1185d752b6 2026-04-21 11:56:50+00:00| seen|...

GHSA-6MQ3-XMGP-PJM5

creationtimestamp| type| source ---|---|--- 2026-02-28 01:10:11+00:00| seen| https://gist.github.com/alon710/26ad557fbd4646a04459f43b9aa9e194...

GHSA-RW9X-PXQX-Q789

creationtimestamp| type| source ---|---|--- 2026-02-28 00:10:11+00:00| seen| https://gist.github.com/alon710/ec22814fdc2305d798b5b3216cff5a34...

CVE-2026-28402

creationtimestamp| type| source ---|---|--- 2026-02-27 23:36:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuuu6sb7a2v...

CVE-2026-28355

creationtimestamp| type| source ---|---|--- 2026-02-27 23:33:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuuo7pufx2y...

GHSA-282G-FHMX-XF54

creationtimestamp| type| source ---|---|--- 2026-02-27 21:40:11+00:00| seen| https://gist.github.com/alon710/b80b546288fad3926bdbc67b49b19ff1...

CVE-2026-27755

creationtimestamp| type| source ---|---|--- 2026-02-27 21:14:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfumxbcsly2n 2026-02-28 06:03:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvkilemo52s 2026-02-28 07:30:28+00:00| seen|...

CVE-2026-27542

creationtimestamp| type| source ---|---|--- 2026-02-27 21:03:02+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mfumc2bm7g2h 2026-03-19 06:36:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhff73qiox2s 2026-03-19 08:14:14+00:00| seen|...

phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

Summary The WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, CAPTCHA, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Details File:...

GHSA-W22Q-M2FM-X9F4 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

Summary The WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, CAPTCHA, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Details File:...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the WebAuthnController::prepare endpoint in the Frontend WebAuthn API component. An unauthenticated attacker can create...

CVE-2026-26862

creationtimestamp| type| source ---|---|--- 2026-02-27 20:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfulwya7kf2v 2026-02-28 07:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvno5g7kt2v...

CVE-2025-69437

creationtimestamp| type| source ---|---|--- 2026-02-27 20:53:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfulqhccde2x 2026-02-28 07:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvnom5l4m2d...

CVE-2026-27836

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited us...

GHSA-PRJF-86W9-MFQV

creationtimestamp| type| source ---|---|--- 2026-02-27 20:10:11+00:00| seen| https://gist.github.com/alon710/b3ea10b84b3ec49955d7221d8d85c2f7...

CVE-2026-27836

phpMyFAQ prior to v4.0.18 is vulnerable due to the WebAuthn prepare endpoint (/api/webauthn/prepare), which creates new active user accounts without authentication, CSRF protection, captcha, or config checks. This allows unauthenticated attackers to create unlimited user accounts even when regist...

CVE-2026-27836

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited us...

CVE-2026-27793 Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the GET /api/v1/user/:id endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of...