Bentley Systems iTwin Platform exposed access token

RISK EVALUATION Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. 2. RECOMMENDED PRACTICES As of 2026-03-27, the token is no longer present in the web pages and...

CVE-2026-33951

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT...

CVE-2026-33951

Signal K Server (boat hub) exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that directly assigns user input to the server configuration, enabling attackers to modify navigation data source priorities. The issue is triggered by missing authentication/authorization and...

CVE-2026-33951 signalk-server: Unauthenticated Source Priorities Manipulation

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT...

CVE-2026-5245

creationtimestamp| type| source ---|---|--- 2026-04-02 10:01:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miix6a7d6i2o 2026-04-02 11:51:33+00:00| seen| https://gist.github.com/N3mes1s/5af547237daf3a1f075c27cafd0544d3...

CVE-2026-33614

creationtimestamp| type| source ---|---|--- 2026-04-02 09:04:05+00:00| seen| https://infosec.exchange/users/certvde/statuses/116334306568810530 2026-04-02 09:04:13+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3miitxsrop2j2 2026-04-02 11:20:58+00:00| seen|...

CVE-2026-33616

creationtimestamp| type| source ---|---|--- 2026-04-02 09:04:05+00:00| seen| https://infosec.exchange/users/certvde/statuses/116334306568810530 2026-04-02 09:04:13+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3miitxsrop2j2 2026-04-02 10:04:29+00:00| seen|...

CVE-2026-4347

creationtimestamp| type| source ---|---|--- 2026-04-02 06:11:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miikcm5tfo2j 2026-04-02 06:20:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miiku3peog2j 2026-04-02 07:15:36+00:00| seen|...

PT-2026-29797

Summary The SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns...

Grafana 9.3.0 < 11.6.14 / 12.0.0 < 12.1.10 / 12.2.0 < 12.2.8 / 12.3.0 < 12.3.6 / 12.4.0 < 12.4.2 Information Disclosure (CVE-2026-27877)

The version of Grafana installed on the remote host is 9.3.x through 11.6.x prior to 11.6.14, 12.0.x through 12.1.x prior to 12.1.10, 12.2.x prior to 12.2.8, 12.3.x prior to 12.3.6, or 12.4.x prior to 12.4.2. It is, therefore, affected by an information disclosure vulnerability: - When using publ...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the stbttbufget8 function. An attacker can cause a denial of service by supplying a specially crafted TrueType Font file that triggers an out-of-bounds read during processing. Workaround This vulnerability can be...

BIT-GRAFANA-2026-27877 Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve...

CVE-2026-4370

creationtimestamp| type| source ---|---|--- 2026-04-01 08:33:22+00:00| published-proof-of-concept| https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p 2026-04-01 09:00:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116328630451101827 2026-04-01 09:00:36+00:00| see...

CVE-2026-30282

creationtimestamp| type| source ---|---|--- 2026-03-31 18:34:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miesvzalqn2t 2026-03-31 18:58:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mieubjuhm622 2026-04-07 23:00:14+00:00| seen|...

CVE-2026-32725

creationtimestamp| type| source ---|---|--- 2026-03-31 18:31:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miesptmlej2s 2026-03-31 18:55:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mieu45uy4c2g 2026-03-31 19:20:34+00:00| published-proof-of-concept|...

CVE-2026-21631

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0384/ 2026-04-01 12:18:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migoed6tnw2q 2026-04-01 12:20:17+00:00| seen|...

CVE-2026-5286

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/ 2026-04-01 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116327922216539438 2026-04-01 06:00:29+00:00| seen|...

CVE-2026-23898

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0384/ 2026-04-01 10:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116328983974110242 2026-04-01 10:30:32+00:00| seen|...

CVE-2026-34503

creationtimestamp| type| source ---|---|--- 2026-03-31 14:52:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miegiu7wq72i 2026-03-31 15:32:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mieiq3tu6t2c 2026-03-31 15:33:11+00:00| seen|...

CVE-2026-32920

creationtimestamp| type| source ---|---|--- 2026-03-31 12:51:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mie7pzf3zw2h 2026-03-31 13:19:01+00:00| seen| Telegram/jSTFa01DEWFRhQKHtf4fP3tqxxyDE1Jfuh4yALHVDvczs38 2026-03-31 13:51:47+00:00| seen|...