CVE-2026-27836: Missing Authorization

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited us...

CVE-2019-25458

creationtimestamp| type| source ---|---|--- 2026-02-26 23:20:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfsdibxcxg23...

GHSA-8G8J-R87H-P36X

creationtimestamp| type| source ---|---|--- 2026-02-26 23:10:18+00:00| seen| https://gist.github.com/alon710/698e47d7e7b029f09315d51259967445...

CVE-2026-27151

creationtimestamp| type| source ---|---|--- 2026-02-26 22:57:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsca2spa22n...

n8n has an SSO Enforcement Bypass in its Self-Service Settings API

Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...

GHSA-VJF3-2GPJ-233V n8n has an SSO Enforcement Bypass in its Self-Service Settings API

Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...

CVE-2026-28194

In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow...

CVE-2026-27153

creationtimestamp| type| source ---|---|--- 2026-02-26 22:33:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsauxzcoq2n...

CVE-2026-28227

creationtimestamp| type| source ---|---|--- 2026-02-26 22:23:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsacdlvk32y...

GHSA-WPPC-7CQ7-CGFV

creationtimestamp| type| source ---|---|--- 2026-02-26 22:10:19+00:00| seen| https://gist.github.com/alon710/3876c0d5d37ba696379319dc0ea4cb02...

CVE-2026-27457

creationtimestamp| type| source ---|---|--- 2026-02-26 22:10:19+00:00| seen| https://gist.github.com/alon710/3876c0d5d37ba696379319dc0ea4cb02 2026-02-26 23:17:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsddumm252e...

CVE-2026-28227 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the publishtocategory topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known...

CVE-2026-28227 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the publishtocategory topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known...

EUVD-2026-8889

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing validatebeforecreate authorization in Data Explorer's QueryGroupBookmarkable allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata...

CVE-2025-63945

creationtimestamp| type| source ---|---|--- 2026-02-26 19:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfrw35w4ix23...

CVE-2026-26932

creationtimestamp| type| source ---|---|--- 2026-02-26 19:16:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfrvuuvvyf2u 2026-02-27 14:10:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mftva4kls32b...

GHSA-MJF5-7G4M-GX5W

creationtimestamp| type| source ---|---|--- 2026-02-26 19:10:19+00:00| seen| https://gist.github.com/alon710/09463d4ff783b0368066b3726e657169...

GHSA-MPF7-P9X7-96R3

creationtimestamp| type| source ---|---|--- 2026-02-26 18:10:19+00:00| seen| https://gist.github.com/alon710/e74bfaa6d377221316be43675ce67d75...

CVE-2026-27808

creationtimestamp| type| source ---|---|--- 2026-02-26 18:10:19+00:00| seen| https://gist.github.com/alon710/e74bfaa6d377221316be43675ce67d75 2026-07-10 23:00:59+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqdavfppxo2r...

CLSA-2026-1772125283 nodejs: Fix of 4 CVEs

CVE-2025-23167: fix improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. - CVE-2025-59466: fix uncatchable stack overflow exceptions when asynchooks are enabled, preventing denial-of-service crashes in applications using AsyncLocalStorage or...