72616 matches found
CVE-2026-46491
creationtimestamp| type| source ---|---|--- 2026-06-10 00:48:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvihvh6372u 2026-06-10 01:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvj6kzs4z2r...
EUVD-2026-35877
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the...
CVE-2026-53673
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the...
Slate Digital Connect 安全漏洞
Slate Digital Connect is an audio plugin management and licensing client developed by Slate Digital. Version 1.37.0 of Slate Digital Connect contains a security vulnerability. This vulnerability stems from a check-time and usage-time race condition in the PID-based client authentication process. ...
PT-2026-48472
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set...
EulerOS 2.0 SP13 : openjpeg2 (EulerOS-SA-2026-2304)
According to the versions of the openjpeg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library...
CVE-2026-53698
CVE-2026-53698 affects Silverpeas up to version 6.4.6, where the Personal space feature is mishandled when no componentId is set. The issue is described as a misbehavior in handling Personal space, with a CVSS v3.1 base score of 6.5 (Network attack vector, Low attack complexity, Privileges Requir...
CVE-2026-53698
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set...
CVE-2026-53673
CVE-2026-53673 affects BuddyPress 14.4.0. The issue is an insecure direct object reference in the messages REST API where a user_id parameter can be supplied to read, reply to, or delete private messages. Attackers can pass another user’s identifier to get_item_permissions_check (which validates ...
CVE-2026-53673 BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the...
GHSA-55HG-8QXV-QJ4P
creationtimestamp| type| source ---|---|--- 2026-06-09 23:41:37+00:00| seen| https://gist.github.com/alon710/8fd39736c139424c0b6f1dacb91f586a...
CVE-2026-34711
creationtimestamp| type| source ---|---|--- 2026-06-09 23:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvcflawlb2n 2026-06-10 02:03:22+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnvmmyg4nr2a...
CVE-2026-47938
creationtimestamp| type| source ---|---|--- 2026-06-09 22:17:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv7yh5zg627 2026-06-10 07:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnw5bdy7s42s 2026-07-05 01:00:01+00:00| seen|...
CVE-2026-47908
creationtimestamp| type| source ---|---|--- 2026-06-09 22:01:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv74zhxah2s...
CVE-2026-32856
creationtimestamp| type| source ---|---|--- 2026-06-09 21:51:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv6l4h2yn2v...
CVE-2026-47907
creationtimestamp| type| source ---|---|--- 2026-06-09 21:41:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv5z7dzfn2d 2026-06-12 03:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mo2r4tufxi2i...
CVE-2026-42861
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId,...
CVE-2026-11799 UXSS in Focus for iOS / Klar Webkit navigation
UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1...
MAL-2026-5471 Malicious code in getd-ui-library (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcdbf66757b102ed524f01c498adae819b02968aa455f57316f4e08af1fb9ea0 On npm install, postinstall.js runs unconditionally scripts.postinstall = 'node postinstall.js' and sends an HTTPS GET to a hardcoded webhook.site UR...