CVE-2026-34568 CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts. An attacker can inject a...

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

Summary Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes. Affected Code python opensslencryptserver/modules/keyserver/routes.py:214-215 opensslencryptserver/modules/telemetry/routes.py:90-91 async def refreshtoken request: Request, refreshtoken: str...

GHSA-4RH7-JWG9-M28M openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

Summary Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes. Affected Code python opensslencryptserver/modules/keyserver/routes.py:214-215 opensslencryptserver/modules/telemetry/routes.py:90-91 async def refreshtoken request: Request, refreshtoken: str...

CVE-2026-34456

creationtimestamp| type| source ---|---|--- 2026-04-01 21:10:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihm36pb7h24 2026-04-01 23:27:18+00:00| seen| Telegram/bl6LC3S0UxxO5vDfC3lE4LaBC6ObKrhuhRcx8XqwmK5Cxg 2026-04-02 04:02:26+00:00| seen|...

CVE-2026-34159

creationtimestamp| type| source ---|---|--- 2026-04-01 21:05:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihlsaa2ul2j 2026-04-02 06:01:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miijs2r4m327 2026-04-03 17:26:14+00:00| published-proof-of-concept|...

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

Summary The AVideo onpublishdone.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to mark streams as finished in the database, but performs no authentication or authorization checks before doing so. An...

CVE-2026-34455

creationtimestamp| type| source ---|---|--- 2026-04-01 20:50:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihkynlnrb2n 2026-04-01 23:26:58+00:00| seen| Telegram/lZIbbZM6hBayBvqPlVKcR-m9kDIyKTvGCXDWINXAPChKhQ...

GHSA-C4XJ-X7P8-3X7Q AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

Summary The AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin...

CVE-2026-34747

creationtimestamp| type| source ---|---|--- 2026-04-01 20:40:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihkgl3e3d2o 2026-04-01 23:27:18+00:00| seen| Telegram/bl6LC3S0UxxO5vDfC3lE4LaBC6ObKrhuhRcx8XqwmK5Cxg 2026-04-02 05:25:38+00:00| seen|...

CVE-2026-34990

creationtimestamp| type| source ---|---|--- 2026-04-01 18:47:29+00:00| published-proof-of-concept| https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp 2026-04-06 21:20:35+00:00| published-proof-of-concept| Telegram/MEpsfFR7A3mQ2dGKH0pRdtzvADr6R8o0dal6eRmpMO8wsk 2026-04-07...

CVE-2026-5310

creationtimestamp| type| source ---|---|--- 2026-04-01 18:45:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihdxzloro2d...

CVE-2026-34751

creationtimestamp| type| source ---|---|--- 2026-04-01 18:29:32+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mihd3wxy7w2m 2026-04-01 21:20:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihmn3nyzl2g 2026-04-02 05:26:16+00:00| seen|...

CVE-2026-30643

creationtimestamp| type| source ---|---|--- 2026-04-01 18:27:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihcxq4gmp2q 2026-04-02 07:15:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miinw2jjdo25 2026-04-06 16:00:15+00:00| seen|...

CVE-2026-20174

creationtimestamp| type| source ---|---|--- 2026-04-01 18:09:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihbxcp63j2i...

CVE-2026-20151

creationtimestamp| type| source ---|---|--- 2026-04-01 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0388/ 2026-04-01 18:15:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihccxxlev2g 2026-04-02 10:08:50+00:00| seen|...

EUVD-2026-17895

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific penalty rates for overdue payments. While the frontend interface prevents users from entering...

CVE-2026-29014

creationtimestamp| type| source ---|---|--- 2026-04-01 15:26:09+00:00| seen| Telegram/LPiyqtmOsuMBSJ4TiscGzigzJ0idlnzzivv75bN9d93RTXE 2026-04-01 15:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migyydiyl327 2026-04-01 16:29:53+00:00| seen|...

CVE-2026-29782

creationtimestamp| type| source ---|---|--- 2026-04-01 15:10:11+00:00| published-proof-of-concept| https://github.com/devcode-it/openstamanager/security/advisories/GHSA-whv5-4q2f-q68g 2026-04-01 15:10:11+00:00| published-proof-of-concept|...

CVE-2026-0932

creationtimestamp| type| source ---|---|--- 2026-04-01 11:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migmbub6z625 2026-04-02 19:26:18+00:00| seen| Telegram/zX6Kqs44rDek2r3jgp5vCS4jdZwe09icUbxsylGXOdI3O8...

CVE-2026-23408

creationtimestamp| type| source ---|---|--- 2026-04-01 11:36:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miglzaietw27 2026-04-02 17:36:56+00:00| seen| Telegram/Mrl-2X1DMgxtaU5XSUN4IbsWrdS8894u2WS0LqzSL2HMbhg 2026-04-07 18:00:00+00:00| seen|...