CVE-2026-6956

creationtimestamp| type| source ---|---|--- 2026-05-11 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-6909 2026-05-11 10:53:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mll4byg77c2q...

CVE-2026-6909

creationtimestamp| type| source ---|---|--- 2026-05-11 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-6909 2026-05-11 11:00:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mll4ndh2hm2q...

CVE-2026-8257

creationtimestamp| type| source ---|---|--- 2026-05-11 03:35:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkdsfvhe52h...

CVE-2026-8254

creationtimestamp| type| source ---|---|--- 2026-05-11 03:25:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkdaix5u72t...

CVE-2026-8252

creationtimestamp| type| source ---|---|--- 2026-05-11 03:15:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkcom2pg62p...

CVE-2026-8249

creationtimestamp| type| source ---|---|--- 2026-05-11 03:10:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkcfnm5d72k...

CVE-2026-8251

creationtimestamp| type| source ---|---|--- 2026-05-11 03:02:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkbxb5btz2r...

CVE-2026-8256

creationtimestamp| type| source ---|---|--- 2026-05-11 02:51:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkbckdob52v...

CVE-2026-8262

creationtimestamp| type| source ---|---|--- 2026-05-11 02:44:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkaxsghob2p...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

PT-2026-39657

HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidate detail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...

CVE-2026-38569

HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidatedetail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...

CVE-2026-38569

HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidatedetail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...

VulnCheck KEV: CVE-2019-13396

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

Grav 输入验证错误漏洞

Grav is a scalable content management system CMS developed by the Grav open-source community, suitable for use in personal blogs, small content publishing platforms, and single-page product displays. Prior to Grav 2.0.0-beta.2, there was a vulnerability related to input validation errors. This...

HireFlow 安全漏洞

HireFlow is an online interview management platform developed by StratonWebDesigners as a personal developer project. Version 1.2 of HireFlow contains a security vulnerability. This vulnerability stems from the fact that all POST endpoints for state changes do not implement CSRF token verificatio...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

PT-2026-39876

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description An authorization bypass exists in the private issue monitoring feature. A user with project-level access can send a crafted POST request to the 'bug monitor add.php' endpoint to...

PT-2026-39654

Name of the Vulnerable Software and Affected Versions HireFlow version 1.2 Description The software fails to implement Cross-Site Request Forgery CSRF token validation on state-changing POST endpoints. This allows an attacker to trick an authenticated user into visiting a malicious page to perfor...