CVE-2026-22730

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0305/ 2026-03-17 13:25:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhb3464rsu2n 2026-03-17 14:13:42+00:00| seen|...

CVE-2026-32249

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0307/ 2026-03-17 11:41:11+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhavbv6a422b 2026-03-17 13:25:07+00:00| seen|...

CVE-2026-4265

creationtimestamp| type| source ---|---|--- 2026-03-17 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0300/ 2026-03-17 13:30:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhb3f35wpk2q 2026-04-16 11:35:11+00:00| seen|...

USN-8095-2: Linux kernel (FIPS) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module LSM. An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information kernel memory, local...

CVE-2026-32763

creationtimestamp| type| source ---|---|--- 2026-03-16 22:20:50+00:00| published-proof-of-concept| https://github.com/kysely-org/kysely/security/advisories/GHSA-wmrf-hv6w-mr66 2026-03-19 23:16:17+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-32763...

EUVD-2025-208763

An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...

CVE-2026-33060

creationtimestamp| type| source ---|---|--- 2026-03-16 21:29:08+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v 2026-03-20 07:16:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33060...

GHSA-H8GR-QWR6-M9GX Admidio is Missing CSRF Protection on Role Membership Date Changes

Summary The savemembership action in modules/profile/profilefunction.php saves changes to a member's role membership start and end dates but does not validate the CSRF token. The handler checks stopmembership and removeformermembership against the CSRF token but omits savemembership from that...

CVE-2025-69727

An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...

CVE-2026-33039

creationtimestamp| type| source ---|---|--- 2026-03-16 15:30:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw 2026-03-20 23:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjmoerimy26 2026-03-20 23:01:48+00:0...

EUVD-2026-12253

A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...

EUVD-2026-12379

Insecure Direct Object Reference IDOR vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/ID/username/thumbAAxAA.jpg' translated as 80x90 and 40x45. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the profile photos of...

EUVD-2025-208709

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...

CVE-2025-54920

creationtimestamp| type| source ---|---|--- 2026-03-16 15:30:41+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jwp6-cvj8-fw65 2026-03-30 12:12:15+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mibn3fornk2w...

CVE-2026-4191

A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...

CVE-2026-3111

Insecure Direct Object Reference IDOR vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/ID/username/thumbAAxAA.jpg' translated as 80x90 and 40x45. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the profile photos of...

CVE-2025-69241

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...

USN-8094-1: Linux kernel vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module LSM. An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information kernel memory, local...

CVE-2026-33036

creationtimestamp| type| source ---|---|--- 2026-03-16 13:02:26+00:00| published-proof-of-concept| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r 2026-03-20 23:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjmolnk4j2s...

CVE-2025-69241 Stored XSS in Raytha CMS

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...