CVE-2026-33009

creationtimestamp| type| source ---|---|--- 2026-03-26 18:44:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyb5mpmwy2d 2026-03-26 22:22:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyndnlegi2d...

EUVD-2026-16275

Firecrawl version 2.8.0 and prior contain a server-side request forgery SSRF protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect destinations. Attackers can supply an...

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

GHSA-3439-VQGJ-2GCF Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

CVE-2026-26008

creationtimestamp| type| source ---|---|--- 2026-03-26 17:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy5fsn5in25 2026-03-26 23:01:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhypickeh22s 2026-03-31 15:40:09+00:00| seen|...

CVE-2026-26071

creationtimestamp| type| source ---|---|--- 2026-03-26 17:32:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy54u7dy727...

CVE-2026-32857

Firecrawl versions 2.8.0 and earlier contain a server-side request forgery (SSRF) protection bypass in the Playwright scraping service. The issue arises because network policy validation is applied only to the initial user-supplied URL and not to subsequent redirected destinations, enabling an ex...

CVE-2026-29934

creationtimestamp| type| source ---|---|--- 2026-03-26 17:24:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4ohoqaj2d...

CVE-2026-22790

creationtimestamp| type| source ---|---|--- 2026-03-26 17:18:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4d4jkjt22 2026-03-26 23:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhypijukn62h 2026-03-31 15:00:14+00:00| seen|...

CVE-2026-25001

Improper Control of Generation of Code 'Code Injection' vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through = 4.0.12...

CVE-2026-32537

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through =...

CVE-2026-24362

Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through = 4.0.21...

CVE-2026-3108

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

CVE-2018-25217

creationtimestamp| type| source ---|---|--- 2026-03-26 15:21:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxvsmvsw32q 2026-03-27 19:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mi2sib6gjt2r...

CVE-2025-15473

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type...

CVE-2026-32421

Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Timeline: from n/a through = 2.4.1...

CVE-2026-32449

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through = 1.3.4...

CVE-2026-33408

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators were able to see the first 40 characters of post edits in PMs and private categories. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds a...

CVE-2026-33394

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report /admin/reports/postedits leaked the first 40 characters of raw post content from private messages and secure categories to moderators who shouldn't have access...

CVE-2026-31916

Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through = 14.2.1...