CVE-2026-36232

A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'classId' parameter from $GET'classId' is directly concatenated into the SQL query without any sanitization or validation...

CVE-2026-27283

creationtimestamp| type| source ---|---|--- 2026-04-14 17:58:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhxgns26s2e 2026-04-14 20:03:31+00:00| seen| Telegram/BoOqWaO3KXSkNoeZKG9-5DucbPr6wdRjfTcRW39IR2MuNQ 2026-04-16 18:37:08+00:00| seen|...

CVE-2026-39538

creationtimestamp| type| source ---|---|--- 2026-04-14 17:27:59+00:00| seen| Telegram/ylyKsnGn7IUGtPSjSQJxYkLCLx52u0woajEqQVy7zzhnhE...

CVE-2026-39815

creationtimestamp| type| source ---|---|--- 2026-04-14 16:34:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhspovl5m2k 2026-04-14 17:27:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhvps2k352o 2026-04-14 17:28:30+00:00| seen|...

CVE-2026-32090

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:12:09+00:00| seen| Telegram/oEQn8vGzt9amdZwPj0LpHOqAegFTLvvnHRc5FBkCf3mZpAs 2026-04-14 20:12:17+00:00| seen|...

CVE-2026-32074

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:10:49+00:00| seen| Telegram/Ms21XGSiFH8l9m-UBaczlbYymgDr8KZJGW6Umjgd2osc 2026-04-15 06:53:38+00:00| seen|...

CVE-2026-27907

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:07:55+00:00| seen| Telegram/b-0H5pCtilxNZxS-gRRPsAWUA3zqxMoGzwWTkVBCMIvH7s 2026-04-15 06:53:38+00:00| seen|...

GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes

CVE-2026-32631 is regarding a vulnerability where it is possible to obtain a user's NTLM hash by tricking them into cloning a malicious repository, or checking out a malicious branch that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction...

Revive Adserver: Session ID reuse allowing XML‑RPC API authentication bypass

Vulnerability description not provided...

CVE-2026-2449

creationtimestamp| type| source ---|---|--- 2026-04-14 12:48:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhg3rxp4d2m 2026-04-14 13:15:45+00:00| published-proof-of-concept| Telegram/cLVBfu0wN-KDy7vSZP2Uw7mBDsIGZ8mzZODmv4ph0BNeQs...

GHSA-VC46-VW85-3WVM

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:42+00:00| seen| Telegram/EXit4BCARRaTXD4SBLqO-yd3UPNB5jBijYowsPR2aTE5HY...

GHSA-R2PG-R6H7-CRF3

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:21+00:00| seen| Telegram/VN5qpdZvC1XQa0kocwrxs34zDP5KgO9HhvqtOghSHVfgqA...

CVE-2026-25654

creationtimestamp| type| source ---|---|--- 2026-04-14 03:04:52+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-prodotti-siemens-20 2026-04-14 09:51:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjh46vwdxg2s 2026-04-14 10:16:11+00:00| seen|...

CVE-2026-5810

A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, grafana-pyroscope, keda-fips, splunk-otel-collector-fips, commercial-grafana, trillian, opentelemetry-collector-k8s-fips, minio-operator-fips, tempo-fips, certificate-transparency, nrdot-collector-fips, datadog-agent, trillian-fips...

CVE-2026-39979

creationtimestamp| type| source ---|---|--- 2026-04-14 01:10:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjg73rsmom2m 2026-07-02 06:57:02+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260702 2026-07-10 15:54:18+00:00| seen...

Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

Impact Authenticated users can delete emails imported into the system assigned to another user; where the Email Dropbox is in use. Patches Fixed in v0.26.0 Workarounds Disable use of email dropbox...

Authorization Bypass Through User-Controlled Key

Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the destroy action in app/controllers/emailscontroller.rb. An attacker can delete another user’s email record by sending...

CVE-2025-65132

alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting XSS in /public/admin/editroom.php which allows an attacker to inject and execute arbitrary JavaScript via the roomid GET parameter...

PT-2026-32656

alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting XSS in /public/admin/edit room.php which allows an attacker to inject and execute arbitrary JavaScript via the room id GET parameter...