CVE-2026-34260

creationtimestamp| type| source ---|---|--- 2026-05-12 04:56:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmyrdie2u2r 2026-05-12 14:20:28+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:06+00:00| seen|...

PT-2026-40046

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150.0.3 Firefox ESR versions prior to 115.36 Firefox ESR versions prior to 140.11 Description A sandbox escape exists in the Profile Backup component. A sandbox is a security mechanism for separating running programs,...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Versions of Mozilla Firefox prior to 150.0.3 contained a security vulnerability, which was caused by a sandbox escape in the Profile Backup component...

PT-2026-45608

Name of the Vulnerable Software and Affected Versions UTT HiPER 1200GW versions prior to 2.5.3-170306 Description A stack-based buffer overflow occurs in the strcpy function within the /goform/formFireWall file. This issue is triggered by the manipulation of the Profile argument, allowing for...

Security Vulnerabilities fixed in Firefox 150.0.3 — Mozilla

CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component Reporter ggwhyp Impact high References Bug 2036978 CVE-2026-8389: JIT miscompilation in the JavaScript Engine: JIT component Reporter ggwhyp Impact high References Bug 2036983 CVE-2026-8390: Use-after-free in the...

Mozilla Firefox < 150.0.3

The version of Firefox installed on the remote Windows host is prior to 150.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-45 advisory. - Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3. CVE-2026-8401 -...

CVE-2026-43877

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo.png. Its only access control is User::isLogged. It does not...

CVE-2026-45298

creationtimestamp| type| source ---|---|--- 2026-05-11 21:52:40+00:00| published-proof-of-concept| https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54 2026-05-26 23:01:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mms3xjqx762w 2026-05-27...

CVE-2026-42874

creationtimestamp| type| source ---|---|--- 2026-05-11 21:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmagih4q72e...

CVE-2026-42870

creationtimestamp| type| source ---|---|--- 2026-05-11 21:32:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlm7xkmyet2c...

CVE-2026-42884

creationtimestamp| type| source ---|---|--- 2026-05-11 21:28:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlm7rfjkcy2r...

CVE-2026-43877

CVE-2026-43877 (WWBN/AVideo) : CSRF in objects/userSavePhoto.php allows a logged‑in user’s profile photo to be overwritten with arbitrary bytes via a crafted cross‑origin POST, due to missing CSRF protection (the endpoint does not use the .json.php suffix and is excluded from autoCSRFGuard), no t...

CVE-2026-43877 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo.png. Its only access control is User::isLogged. It does not...

CVE-2026-43877 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo.png. Its only access control is User::isLogged. It does not...

CVE-2026-42870

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42864

creationtimestamp| type| source ---|---|--- 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:35:42+00:00| seen|...

CVE-2026-6146

creationtimestamp| type| source ---|---|--- 2026-05-11 19:47:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlm23hs5hc2s 2026-05-11 19:47:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlm23hs5hc2s 2026-05-11 21:34:10+00:00| seen|...

CVE-2026-45671

creationtimestamp| type| source ---|---|--- 2026-05-11 19:46:11+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-26g9-27vm-x3q8 2026-05-16 10:00:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxlm7v57a2n...

CVE-2026-8305

creationtimestamp| type| source ---|---|--- 2026-05-11 19:25:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllyue5x4y2q 2026-05-11 19:25:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllyue5x4y2q 2026-05-12 19:58:22+00:00| seen|...

CVE-2026-45005

creationtimestamp| type| source ---|---|--- 2026-05-11 19:15:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllychagb52q 2026-05-11 19:15:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllychagb52q...