GHSA-CRMX-4P49-46M2 MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue. Impact Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure. Patches - 71df1f67e05b2050cd4bd87839e6cc13747cf03f Workarounds None Credits...

MINI-4VCH-3W9X-4WF9

Bulletin has no description...

MINI-2R6P-FHQP-9PRQ

Bulletin has no description...

MINI-3Q73-WXPX-QV79

Bulletin has no description...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

Обзор Copy Fail CVE-2026-31431 — это логическая уязвим...

MINI-XC7P-R9MM-JH45

Bulletin has no description...

MINI-CHHR-C47P-PWM8

Bulletin has no description...

MINI-8FM8-PQRQ-52FR

Bulletin has no description...

CVE-2026-5172

creationtimestamp| type| source ---|---|--- 2026-05-11 18:58:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllxds6f4v2c 2026-05-11 18:58:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllxds6f4v2c 2026-05-13 12:31:36+00:00| seen|...

MINI-CJH3-P5C3-MWX3

Bulletin has no description...

MINI-293W-XRQJ-2Q5W

Bulletin has no description...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

GHSA-68W5-W573-Q2R8 MantisBT Has Authorization Bypass in Global Profile Creation

MantisBT allows a low-privileged authenticated user having addprofilethreshold to create a global profile despite not having manageglobalprofilethreshold, by tampering with the userid parameter in a valid profile creation request. Impact Authentication bypass Patches -...

MantisBT Has Authorization Bypass in Global Profile Creation

MantisBT allows a low-privileged authenticated user having addprofilethreshold to create a global profile despite not having manageglobalprofilethreshold, by tampering with the userid parameter in a valid profile creation request. Impact Authentication bypass Patches -...

CVE-2026-42608

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

CVE-2026-42608

Grav CVE-2026-42608 describes an unauthenticated path traversal in the FormFlash component that lets an attacker manipulate the session_id (__form-flash-id) in POST requests to traverse the filesystem and write an index.yaml, enabling arbitrary directory creation and data manipulation. Affected: ...

CVE-2026-8289

creationtimestamp| type| source ---|---|--- 2026-05-11 14:55:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlljryfwx42e...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the updatemessagebyid process. An attacker can modify messages authored by other users by sending a request to the message update endpoint with only read permissions in a standard...