CVE-2026-35173

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions Edit Post, Edit Draft, Edit Own Post, Edit Own Draft to modify posts they do not own and do not have...

CVE-2026-35047

creationtimestamp| type| source ---|---|--- 2026-04-06 18:08:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mituac6cnv25 2026-04-06 19:29:29+00:00| published-proof-of-concept| Telegram/0wjdVVOdHVRh-NR-AUdnOvXJcqqbi6lE8Vl80iGy2s6Zy0...

CVE-2026-35173

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions Edit Post, Edit Draft, Edit Own Post, Edit Own Draft to modify posts they do not own and do not have...

CVE-2026-35173 Chyrp Lite has an IDOR via Mass Assignment in Post Model

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions Edit Post, Edit Draft, Edit Own Post, Edit Own Draft to modify posts they do not own and do not have...

CVE-2026-35173

Summary of CVE-2026-35173 (Chyrp Lite): Before 2026.01, the Post model vulnerable to an IDOR/mass assignment flaw allows authenticated users with post-edit permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own. Attacker can inject internal class proper...

CVE-2026-35173 Chyrp Lite has an IDOR via Mass Assignment in Post Model

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions Edit Post, Edit Draft, Edit Own Post, Edit Own Draft to modify posts they do not own and do not have...

CVE-2026-35173 Chyrp Lite has an IDOR via Mass Assignment in Post Model

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions Edit Post, Edit Draft, Edit Own Post, Edit Own Draft to modify posts they do not own and do not have...

EUVD-2026-19420

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions Edit Post, Edit Draft, Edit Own Post, Edit Own Draft to modify posts they do not own and do not have...

CVE-2025-47400

creationtimestamp| type| source ---|---|--- 2026-04-06 17:31:48+00:00| seen| Telegram/RGEnmBafEPc7BPP7Kak77rIihdcDD1YNCnC4ac8698Y1cM 2026-04-09 07:00:18+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj2acursls2r 2026-06-01 18:00:00+00:00| seen|...

CVE-2026-34841

creationtimestamp| type| source ---|---|--- 2026-04-06 17:22:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitrpk7efk2r 2026-04-06 19:28:28+00:00| published-proof-of-concept| Telegram/nNz4AuVWmZsX2vjW9IzWDm0wIi6EKHH8QFJ1lll9JUSWJdI 2026-06-02 08:07:07+00:00| seen|...

CVE-2026-0740

creationtimestamp| type| source ---|---|--- 2026-04-06 17:19:46+00:00| seen| https://bsky.app/profile/wordfenceofficial.bsky.social/post/3mitrjp4tp22q 2026-04-07 05:17:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miuzmkuxzz2r 2026-04-07 05:30:31+00:00| seen|...

CVE-2026-21372

creationtimestamp| type| source ---|---|--- 2026-04-06 17:07:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqtv7vnq2h 2026-04-06 17:31:52+00:00| seen| Telegram/bFzdXG4EHDXBh96IdapV4pte0L7R5RfWgLMclfBuHu5yA-8 2026-04-09 03:00:14+00:00| seen|...

CVE-2026-21380

creationtimestamp| type| source ---|---|--- 2026-04-06 17:00:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqgyvqo62r 2026-04-06 17:32:22+00:00| seen| Telegram/dUAA8fHSwqV319P5GL0j-waKl2PkCqFvNZVlfF44zt3Z1lo 2026-04-06 17:32:33+00:00| seen|...

CVE-2026-29047

creationtimestamp| type| source ---|---|--- 2026-04-06 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0401/ 2026-04-06 17:30:35+00:00| published-proof-of-concept| Telegram/vDxpsGfJbQiyRhua845taBzP9STG0qUjRmnheADKQhDWFU 2026-04-08 13:00:15+00:00| seen|...

CVE-2025-47389

creationtimestamp| type| source ---|---|--- 2026-04-06 16:58:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116358821584609761 2026-04-06 17:16:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitrd4eri325 2026-04-06 17:30:51+00:00| seen|...

CVE-2026-21374

creationtimestamp| type| source ---|---|--- 2026-04-06 16:24:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitohadolg2r 2026-04-06 17:32:14+00:00| seen| Telegram/nEWPFpjCLkD7NyFP9hUQCVBBOcgamDzuZpgMFfkUJdzCqg 2026-04-09 01:20:09+00:00| seen|...

CVE-2026-21382

creationtimestamp| type| source ---|---|--- 2026-04-06 16:24:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitogzqoza2p 2026-04-06 17:32:33+00:00| seen| Telegram/mCOSTqPiKnBsCJ7wgUXnJ9sN78eybUSXsSSUkGvS3qtdJ4k...

CVE-2026-21381

creationtimestamp| type| source ---|---|--- 2026-04-06 16:24:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitogsu44t2h 2026-04-06 17:32:33+00:00| seen| Telegram/mCOSTqPiKnBsCJ7wgUXnJ9sN78eybUSXsSSUkGvS3qtdJ4k 2026-04-09 04:20:09+00:00| seen|...

CVE-2026-34402

creationtimestamp| type| source ---|---|--- 2026-04-06 16:21:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitoauvoed2h 2026-04-06 17:32:38+00:00| seen| Telegram/n5Nok-XlRHEre5O89LvYLplT02rw8wZYprnGR4USXlLgM...

CVE-2026-34981 whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3

The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.downloadfromurl in app/services/fileservice.py calls requests.geturl with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by...