AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

Summary The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and...

GHSA-M99F-MMVG-3XMX AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

Summary The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and...

EUVD-2026-14498

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint...

Cross-site Request Forgery (CSRF)

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the UpdateAccessControlPolicyActiveStatus endpoint. An attacker can change the active status of access control...

EUVD-2026-15806

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

Mattermost doesn't properly validate CSRF tokens

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-27659

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

CVE-2026-27659

Mattermost CSRF in UpdateAccessControlPolicyActiveStatus: versions 11.2.x ≤ 11.2.2, 10.11.x ≤ 10.11.10, 11.4.x ≤ 11.4.0, 11.3.x ≤ 11.3.1 fail to validate CSRF tokens on /api/v4/access_control_policies/{policy_id}/activate, enabling an attacker to trick an admin into changing an access control pol...

CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-33992

creationtimestamp| type| source ---|---|--- 2026-03-25 13:09:33+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-m74m-f7cr-432x 2026-03-28 01:18:50+00:00| seen| Telegram/DQ8Phmkx05Q1rHpnB8sJ1vhC9dSxcFzzTf0RtJAOAn3w7JQ 2026-03-28 02:13:28+00:00| seen|...

CVE-2026-28859

creationtimestamp| type| source ---|---|--- 2026-03-25 07:28:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116288631079391237 2026-03-27 04:46:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116299318674903445...

CVE-2026-28858

creationtimestamp| type| source ---|---|--- 2026-03-25 06:20:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116288365225347899 2026-03-29 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/ 2026-04-06 18:00:04+00:00| seen| https://t.me/GithubRedTeam/79...

CVE-2026-4696

creationtimestamp| type| source ---|---|--- 2026-03-25 04:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhu7cz6h4i22 2026-03-26 11:43:17+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhxjlxpqna2k 2026-03-29 17:00:00+00:00| seen|...

CVE-2026-4721

creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260325 2026-03-25 04:01:28+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhu7d6hbhv2w 2026-03-29 17:00:00+00:00| seen|...

SUSE CVE-2026-28682

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...

SUSE CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the fcloopt2hxmtlsrsp function not checking the status of the remoteport port. This could lead to...

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing th...