23303 matches found
CVE-2026-33743
creationtimestamp| type| source ---|---|--- 2026-03-26 22:08:22+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3 2026-03-27 00:11:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhytg7w7d32z...
CVE-2026-35632
creationtimestamp| type| source ---|---|--- 2026-03-26 21:49:25+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-7xr2-q9vf-x4r5 2026-04-09 23:30:23+00:00| published-proof-of-concept| Telegram/n2dd6XRjJv9G8jt1S2EaZawu98TdZ3-sGq35ZGwXZFcMAwI 2026-04-16 09:37:10+00:00| seen|...
CVE-2026-31921
creationtimestamp| type| source ---|---|--- 2026-03-26 21:35:15+00:00| seen| Telegram/zW9IZrd6TGtn6tlC-J0V1NpAAnhFTvKo2N1YPzc1YC33cco 2026-03-26 21:35:36+00:00| seen| Telegram/jNlDBTackbRa-OzLBD4eltRa4dE7lS0-uVg4cHfoz-Hg 2026-04-08 01:30:07+00:00| seen|...
CVE-2026-25377
creationtimestamp| type| source ---|---|--- 2026-03-26 21:34:39+00:00| seen| Telegram/-QvDDLq1XmiKkWzrEeLXRlLt5ytYeUCyAFDlagxirK1YIk 2026-04-07 11:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mivohj6wjz2h...
CVE-2026-23977
creationtimestamp| type| source ---|---|--- 2026-03-26 21:33:43+00:00| published-proof-of-concept| Telegram/fY4No4paH3d0dcxL7eHJzi9nTjzGU82ddBovSTYQV2kvbQ 2026-04-10 01:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mj46dfqtn32u...
CVE-2026-33638
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. ...
GHSA-CPGW-WGF3-XC6V
creationtimestamp| type| source ---|---|--- 2026-03-26 21:03:16+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mhyivdkgzk2t...
CVE-2026-33638 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. ...
CVE-2026-33638 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. ...
CVE-2026-33148
creationtimestamp| type| source ---|---|--- 2026-03-26 20:49:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyi4fsfsn2o...
CVE-2026-33623 PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.4 contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell -Command string using a...
CVE-2026-33623
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.4 contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell -Command string using a...
CVE-2026-33623
CVE-2026-33623 affects PinchTab (v0.8.4 affected; v0.8.5 patched). Description: Windows-only command injection in the orphaned Chrome cleanup path. When stopping an instance, the cleanup builds a PowerShell -Command string from a needle derived from the profile path. In v0.8.4, backslashes are es...
CVE-2026-33623 PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.4 contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell -Command string using a...
CVE-2026-33623 PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.4 contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell -Command string using a...
CVE-2026-33491
creationtimestamp| type| source ---|---|--- 2026-03-26 20:44:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyhthdl3k2n 2026-03-26 21:20:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyjuo5la327 2026-03-26 21:36:40+00:00| seen|...
CVE-2026-33153
creationtimestamp| type| source ---|---|--- 2026-03-26 20:39:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyhkiv4tf23 2026-03-26 21:36:40+00:00| seen| Telegram/gdbQBvnuOgX0zlyJL9kfjxoCoTp9WBTGn5-zeTA4spKkwcA...
GO-2026-4823 PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pinchtab
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pinchtab...
CVE-2026-33505
creationtimestamp| type| source ---|---|--- 2026-03-26 20:14:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyg6ucvzd2z 2026-03-26 21:36:40+00:00| seen| Telegram/gdbQBvnuOgX0zlyJL9kfjxoCoTp9WBTGn5-zeTA4spKkwcA 2026-04-18 09:37:07+00:00| seen|...