24561 matches found
GHSA-G3HP-VVQF-8VW6
creationtimestamp| type| source ---|---|--- 2026-03-12 09:40:06+00:00| seen| https://gist.github.com/alon710/49f2db569bc474aab9f493dc84839f32...
CVE-2026-28791
creationtimestamp| type| source ---|---|--- 2026-03-12 05:09:56+00:00| published-proof-of-concept| https://github.com/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c 2026-03-12 19:40:05+00:00| seen| https://gist.github.com/alon710/d73d499cf1d6e8d3c3762966f6b93ea2...
CVE-2026-31888
creationtimestamp| type| source ---|---|--- 2026-03-12 04:10:06+00:00| seen| https://gist.github.com/alon710/e3dc62168c67266174e7a28a55951177...
PT-2026-25030
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is – incidentally or maliciously – already full, the gadget will silently drop events. Th...
Netartmedia Event Portal SQL注入漏洞
Netartmedia Event Portal is an event registration management system operated by the Bulgarian company Netartmedia. Version 2.0 of Netartmedia Event Portal has a SQL injection vulnerability. This vulnerability stems from SQL injection in email parameters, which could allow unverified attackers to...
CVE-2026-31976
creationtimestamp| type| source ---|---|--- 2026-03-11 23:10:05+00:00| seen| https://gist.github.com/alon710/74a8a12bf6cb699bbfaf1a99d2e4e0d0 2026-03-12 04:30:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/116214322775110049...
CVE-2026-3962
creationtimestamp| type| source ---|---|--- 2026-03-11 22:16:00+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3962...
CVE-2026-32102
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can...
CVE-2026-32102 OliveTin Unauthorized Action Output Disclosure via EventStream
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can...
CVE-2026-32102
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can...
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Description An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration /.+/ in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within...
CVE-2026-24017
creationtimestamp| type| source ---|---|--- 2026-03-11 10:50:56+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-fortinet-8 2026-03-11 14:43:25+00:00| seen| https://ccb.belgium.be/advisories/warning-fortinet-patched-22-vulnerabilities-multiple-products-patch-immediately...
CVE-2026-30927
Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. The condition uses || OR, meaning if...
CVE-2026-27220
creationtimestamp| type| source ---|---|--- 2026-03-11 03:00:18+00:00| seen| https://helpx.adobe.com/security/products/acrobat/apsb26-26.html 2026-03-17 13:34:39+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mhb3msqqvs22...
Sylius has a DQL Injection via API Order Filters
Impact Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy without validation. An attacker can inject arbitrary DQL: GET /api/v2/shop/products?orderprice=ASC,%20variant.code%20DESC Patches The...
kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF
A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability allows data loss or buffer Use-After-Free UAF due to a race condition during isochronous Ring Underrun/Overrun event handling...
VulnCheck KEV: CVE-2019-19492
FreeSWITCH 1.6.10 through 1.10.1 has a default password in eventsocket.conf.xml...
EUVD-2026-10895
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header...
WordPress Court Reservation plugin < 1.10.9 - Event Deletion via CSRF vulnerability
Event Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Court Reservation versions 1.10.9...
CVE-2026-31833 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration /.+/ in the UFM DOMPurify instance, event handler...