CVE-2026-4984

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs 'MediaUrlN' parameters using HTTP requests that include the integration's Twilio credentials in the 'Authorization'...

BIT-DISCOURSE-2026-33428 Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership

Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0,...

BIT-DISCOURSE-2026-33355 Discourse filters whisper posts from private-posts feed

Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, the /private-posts endpoint did not apply post-type visibility filtering, allowing regular PM participants to see whisper posts in PM topics they had access to. Versions 2026.3.0, 2026.2.1, and...

CVE-2026-33701

creationtimestamp| type| source ---|---|--- 2026-03-27 02:50:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhz4bjog5422 2026-03-27 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116298903055981699 2026-03-27 03:00:32+00:00| seen|...

CVE-2026-33898

creationtimestamp| type| source ---|---|--- 2026-03-27 00:01:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhysuuob4v2n 2026-03-27 01:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyw4vmu3g2w 2026-03-27 01:00:34+00:00| seen|...

CVE-2026-33945

creationtimestamp| type| source ---|---|--- 2026-03-26 23:59:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhysrbvxdo2i 2026-03-27 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116298196062602424 2026-03-27 00:00:44+00:00| seen|...

CVE-2026-34226

creationtimestamp| type| source ---|---|--- 2026-03-26 23:44:55+00:00| published-proof-of-concept| https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g 2026-03-27 22:17:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35jhqkbc2s 2026-03-27...

CVE-2025-12805

creationtimestamp| type| source ---|---|--- 2026-03-26 22:21:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhynbhwrsw2j 2026-03-26 22:22:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyncg4j2v2s 2026-03-26 22:48:16+00:00| seen|...

CVE-2026-28377

creationtimestamp| type| source ---|---|--- 2026-03-26 22:21:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhynbb2tnv2s 2026-03-26 22:22:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhync67ola27 2026-03-26 23:20:03+00:00| seen|...

CVE-2026-33673

creationtimestamp| type| source ---|---|--- 2026-03-26 22:19:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyn5pdppa2x 2026-03-26 22:19:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyn6funvc2t 2026-03-26 22:20:11+00:00| seen|...

CVE-2026-33671

creationtimestamp| type| source ---|---|--- 2026-03-26 22:19:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyn5i3kzq2d 2026-03-26 22:19:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyn67qijr2c 2026-03-26 23:20:15+00:00| seen|...

CVE-2026-33687

creationtimestamp| type| source ---|---|--- 2026-03-26 22:18:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyn477icy2r 2026-03-26 23:01:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhypiftt2w2n 2026-03-26 23:20:15+00:00| seen|...

CVE-2026-33686

creationtimestamp| type| source ---|---|--- 2026-03-26 22:18:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyn3ypzwa2x 2026-03-26 22:18:36+00:00| seen| https://bsky.app/profile/potato.software/post/3mhyn3zn4td2z 2026-03-26 22:56:19+00:00| seen|...

CVE-2026-33940

creationtimestamp| type| source ---|---|--- 2026-03-26 20:59:50+00:00| published-proof-of-concept| https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6 2026-03-27 22:24:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35w4bscs2s...

CVE-2026-33506

creationtimestamp| type| source ---|---|--- 2026-03-26 20:54:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyifeaw6m27 2026-03-26 21:20:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyjugwtbq2r 2026-03-26 21:36:49+00:00| seen|...

CVE-2026-33491

creationtimestamp| type| source ---|---|--- 2026-03-26 20:44:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyhthdl3k2n 2026-03-26 21:20:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyjuo5la327 2026-03-26 21:36:40+00:00| seen|...

CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

CVE-2026-32329

Missing Authorization vulnerability in Ays Pro Advanced Related Posts advanced-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Related Posts: from n/a through = 1.9.1...