CVE-2026-25100

creationtimestamp| type| source ---|---|--- 2026-03-27 10:55:00+00:00| seen| https://cert.pl/en/posts/2026/03/CVE-2026-25099/ 2026-03-27 16:11:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2j2byy2o2q...

CVE-2026-29955

creationtimestamp| type| source ---|---|--- 2026-03-27 09:00:13+00:00| published-proof-of-concept| Telegram/8LISbnUQFWA86ak3ubyaCZMxs8RQbiaZ8ONexaBDd7tfzQU 2026-04-13 20:23:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjfp2mok6g2g...

CVE-2026-27860

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...

BIT-DISCOURSE-2026-31805 Discourse has a poll authorization bypass via post_id array parameter

Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing postid as an...

BIT-DISCOURSE-2026-30888 Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint

Discourse is an open-source discussion platform. Versions prior to 2026.3.0, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents ToS, guidelines, privacy policy that they are explicitly prohibited from modifying. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. No kno...

CVE-2026-4836

A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /myaccount/delete.php. Performing a manipulation of the argument cosid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public a...

CVE-2026-4838

A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be us...

GHSA-4C29-8RGM-JVJJ

creationtimestamp| type| source ---|---|--- 2026-03-27 03:18:12+00:00| seen| Telegram/wovzpCQvp7hlTQxwTsDEYFJDESQHFA6mVe176dFHuk85of0...

CVE-2026-33280

creationtimestamp| type| source ---|---|--- 2026-03-27 03:00:00+00:00| seen| https://jvn.jp/en/jp/JVN83788689/ 2026-03-27 07:18:51+00:00| seen| Telegram/P-c6qw41ZnFxRT6ZQxEHaCculf4buxnen-CyMrcI5qxOnbs 2026-03-27 08:27:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhzp4c3p6p23...

GHSA-VFGG-MVXX-MGG7

creationtimestamp| type| source ---|---|--- 2026-03-27 01:18:53+00:00| seen| Telegram/67MCm8uvWkL1PFFVLqu-Ae9nhYuAfQmsKMFjCSOu4hiA4mc...

GHSA-83XR-5XXR-MH92

creationtimestamp| type| source ---|---|--- 2026-03-27 01:18:44+00:00| published-proof-of-concept| Telegram/iwwl46KpLYwipkJFr9bJW43ngNWdoc7X8GY9RAN-oHOG28...

CVE-2026-33730

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference IDOR vulnerability allows an authenticated low-privileged user to access the password change functionality of...

CVE-2026-33730

Open Source Point of Sale (opensourcepos) is a PHP web app using CodeIgniter. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) allows an authenticated low-privilege user to access the password change functionality of other users (including administrators) by manipulating the emp...

CVE-2026-33730

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference IDOR vulnerability allows an authenticated low-privileged user to access the password change functionality of...

CVE-2026-33730 Open Source Point of Sale has an IDOR in Password Change (Home)

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference IDOR vulnerability allows an authenticated low-privileged user to access the password change functionality of...

PT-2026-28710

Name of the Vulnerable Software and Affected Versions wandb OpenUI versions up to 1.0 Description A flaw exists in wandb OpenUI, specifically within the HTMLAnnotator component. The issue resides in the create share/get share function located in the backend/openui/server.py file. Manipulation of...

SourceCodester Online Food Ordering System 安全漏洞

The SourceCodester Online Food Ordering System is an open-source online meal ordering system developed by SourceCodester. Version 1.0 of the SourceCodester Online Food Ordering System contains a security vulnerability. This vulnerability arises from the improper cleaning of the id parameter in th...

PT-2026-28692

Name of the Vulnerable Software and Affected Versions itsourcecode Free Hotel Reservation System version 1.0 Description A flaw exists in itsourcecode Free Hotel Reservation System version 1.0 that may allow for SQL injection. The issue is located in the file /admin/mod room/index.php?view=edit...

CVE-2026-30532

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/viewproduct.php file via the "id" parameter...

PT-2026-28516

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale opensourcepos versions prior to 3.4.2 Description The application is a web-based point of sale system written in PHP using the CodeIgniter framework. A security issue exists where an authenticated user with limited...