40277 matches found
CVE-2026-4053 post edit time limit is not enforced on some post update operations
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints...
CVE-2026-4053
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints...
CVE-2026-4053
CVE-2026-4053 affects Mattermost 11.5.x (11.5.0–11.5.1) and 10.11.x (10.11.0–10.11.13). The issue is that the system fails to enforce the PostEditTimeLimit on non‑message post fields, allowing an authenticated user to modify post file attachments, props, and pin status after the edit window has e...
CVE-2026-45616 Vvveb: Stored XSS in Posts allows privilege escalation via post editor
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, This vulnerability is fixed in 1.0.8.3...
CVE-2026-45616 Vvveb: Stored XSS in Posts allows privilege escalation via post editor
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, This vulnerability is fixed in 1.0.8.3...
CVE-2026-45616
Vvveb CMS contains a stored XSS in Posts that can lead to privilege escalation via the post editor. Affected before 1.0.8.3; fixed in 1.0.8.3. CVE-2026-45616. Exploitation details are not provided in the documents; CIRCL notes a published PoC on Telegram.
CVE-2026-45616 Vvveb: Stored XSS in Posts allows privilege escalation via post editor
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, This vulnerability is fixed in 1.0.8.3...
CVE-2021-47967
CVE-2021-47967 affects PHP Timeclock 1.04 with multiple cross-site scripting (XSS) vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can target login.php, timeclock.php, audit.php, and timerpt.php endpoints...
CVE-2021-47967 PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters
PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...
EUVD-2021-34822
PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...
GHSA-RC6V-5RMX-W5MV arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS
Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and KMS TLS client. All require specific preconditions to exploit and do not allow direct code execution or immediate key extraction. A self-contained PoC is attached. Details 1 ACK...
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS
Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and KMS TLS client. All require specific preconditions to exploit and do not allow direct code execution or immediate key extraction. A self-contained PoC is attached. Details 1 ACK...
CVE-2026-37541
creationtimestamp| type| source ---|---|--- 2026-05-15 13:03:31+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mlvfespgwk2k 2026-05-20 16:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmcbyhnwol2r...
CVE-2026-8398
creationtimestamp| type| source ---|---|--- 2026-05-15 10:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv35uqdzj2k 2026-05-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/11739434-0930-4569-82cd-80d659d1039f...
BIT-JUPYTERLAB-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager allowedextensionsuris is not correctly enforced by JupyterLab. The Py...
CVE-2026-7525
creationtimestamp| type| source ---|---|--- 2026-05-15 06:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlupjlfta42h...
CVE-2026-41553
creationtimestamp| type| source ---|---|--- 2026-05-15 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-7182 2026-05-15 14:31:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvkczupkk2c...
CVE-2026-7182
creationtimestamp| type| source ---|---|--- 2026-05-15 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-7182...
CVE-2026-41552
creationtimestamp| type| source ---|---|--- 2026-05-15 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-7182 2026-05-15 14:51:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvlgu5qpm2o...
CVE-2026-44051
creationtimestamp| type| source ---|---|--- 2026-05-15 04:08:09+00:00| seen| https://bsky.app/profile/slackers.it/post/3mluh44cimk2b 2026-05-21 13:44:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmekhwn57y2r 2026-05-22 09:00:34+00:00| seen|...