EUVD-2026-67266

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-80208: Missing Authentication for Critical Function

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

CVE-2026-37064: Observable Discrepancy

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-30073

An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2026-82604

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the encryption status of embedded post-quantum cryptography PQC private keys within file metadata. This allows attackers to create files containing unencrypted...

CVE-2026-30073

An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2026-75960

creationtimestamp| type| source ---|---|--- 2026-08-26 23:01:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtzgtq67as27 2026-08-28 09:13:12+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mu4zic6ge32e 2026-08-28 11:09:31+00:00| seen|...

CVE-2026-77317

creationtimestamp| type| source ---|---|--- 2026-08-26 23:00:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtzgrdrgwo2r 2026-08-27 00:08:02+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtzkkkep2t23...

CVE-2026-17436

creationtimestamp| type| source ---|---|--- 2026-08-26 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtzagzy75k2m...

CVE-2026-74770

creationtimestamp| type| source ---|---|--- 2026-08-26 21:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtza4tg2fu2r 2026-08-29 02:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6tsxdmsp24...

CVE-2026-47844

creationtimestamp| type| source ---|---|--- 2026-08-26 20:33:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7aivwkjl6ma3u...

CVE-2026-81027

creationtimestamp| type| source ---|---|--- 2026-08-26 20:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtz4qtslaz2z...

CVE-2026-32258

creationtimestamp| type| source ---|---|--- 2026-08-26 18:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtyvztgyzb2z...

WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Settings Change vulnerability discovered by mad4cyber in WordPress Plugin Post SMTP versions 4.0.0-beta.1...

CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CVE-2026-77658

creationtimestamp| type| source ---|---|--- 2026-08-26 16:30:44+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtyqyudnpz2v...

CVE-2026-81029

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-75020

creationtimestamp| type| source ---|---|--- 2026-08-26 15:45:11+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3gfikm2aol7g5 2026-08-27 10:27:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bi5somkarqkpz...

EUVD-2026-66605

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...