CVE-2026-1731

creationtimestamp| type| source ---|---|--- 2026-02-07 11:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mebbcbu3zb26 2026-02-07 11:00:58+00:00| seen| https://infosec.exchange/users/offseq/statuses/116028999623507500 2026-02-08 15:01:24+00:00| seen|...

CVE-2026-25763

creationtimestamp| type| source ---|---|--- 2026-02-07 09:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116028645772242625 2026-02-07 09:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3meb4bemilo2h 2026-08-15 11:00:04+00:00| published-proof-of-concept|...

GHSA-VHVQ-FV9F-WH4Q

creationtimestamp| type| source ---|---|--- 2026-02-07 02:40:06+00:00| seen| https://gist.github.com/alon710/8323d7b3849b55718473864a8e9cc2a6...

CVE-2020-37106

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2026-25563: Authorization Bypass Through User-Controlled Key

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers...

CVE-2020-37106: Cross-Site Request Forgery (CSRF)

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2026-25567: Authorization Bypass Through User-Controlled Key

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier...

PT-2026-6931

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19 Description An authorization issue exists in WeKan where the allowPrivateOnly instance configuration setting is not fully enforced during board creation. When allowPrivateOnly is enabled, users are still able to...

PT-2026-6926

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19 Description The software contains an insecure direct object reference IDOR in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied...

CVE-2026-25644

creationtimestamp| type| source ---|---|--- 2026-02-06 23:22:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mea2bd4wba2g...

CVE-2026-2070

creationtimestamp| type| source ---|---|--- 2026-02-06 23:21:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mea2b4jy522v...

CVE-2026-25803

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials admin/admin upon the first initialization. Attackers with network access to the application's login interface can gain full...

CVE-2020-37160 SprintWork 2.3.1 - Local Privilege Escalation

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain...

CVE-2020-37160

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain...

CVE-2020-37106 Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2020-37106

The CVE-2020-37106 issue affects Business Live Chat Software 1.0 and is described as a cross-site request forgery (CSRF) vulnerability. A remote attacker can craft a malicious HTML form that sends a POST to the user creation endpoint with administrative access parameters to change user account ro...

CVE-2020-37106

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2026-25544

creationtimestamp| type| source ---|---|--- 2026-02-06 22:16:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7wmw6fh723 2026-02-07 14:00:20+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mebldrpbyd24 2026-02-07 14:00:25+00:00| seen|...

CVE-2026-2067

creationtimestamp| type| source ---|---|--- 2026-02-06 21:18:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tdxkruj23 2026-02-06 21:18:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tezhskz23...

CVE-2026-25749

creationtimestamp| type| source ---|---|--- 2026-02-06 19:21:38+00:00| seen| https://gist.github.com/EbonJaeger/d35ee8e23d9e45964fc3a86bc738c87d 2026-03-18 05:03:24+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mhcpjgbgmce2 2026-03-19 00:00:00+00:00| seen|...