27476 matches found
Gokapi has Data Leak in Upload Status Stream
Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...
GHSA-C36C-7PC2-F2PH Gokapi has Data Leak in Upload Status Stream
Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the upload status SSE implementation on /uploadStatus, which publishes global upload state to any authenticated listener and includes fileid values not scoped to the requesting user. A...
MINI-8P9C-8VJQ-7GHX
Bulletin has no description...
GHSA-5WP8-Q9MX-8JX8
creationtimestamp| type| source ---|---|--- 2026-03-05 06:40:05+00:00| seen| https://gist.github.com/alon710/facbfe8e82c0d1644078a81732ccf4e7...
GHSA-XHW7-JHMP-J62J
creationtimestamp| type| source ---|---|--- 2026-03-05 05:40:05+00:00| seen| https://gist.github.com/alon710/4c0607fcf43c2d97141d407ceb05ca52...
CVE-2026-25048
creationtimestamp| type| source ---|---|--- 2026-03-05 03:07:49+00:00| published-proof-of-concept| https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3 2026-03-05 17:57:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdepo6hei27...
SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:0785-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0785-1 advisory. This update for postgresql18 fixes the following issue: Update to version 18.3 bsc1258754. Regression fixes: - the substring function raises an error...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005643)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005643 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware result upon destroying QP/RQ Previously when destroying a QP/RQ, t...
PT-2026-23602
Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3 Description Gokapi is a self-hosted file sharing server that supports automatic expiration and encryption. The upload status Server-Sent Events SSE implementation on the /uploadStatus API endpoint publishes globa...
GHSA-5HWF-RC88-82XM
creationtimestamp| type| source ---|---|--- 2026-03-04 22:10:05+00:00| seen| https://gist.github.com/alon710/740d2628b364f80d93a95763c507d3f8 2026-03-13 21:10:06+00:00| seen| https://gist.github.com/alon710/25afc6b7c80d9d4a2082df7705bf284f...
CVE-2026-3539
creationtimestamp| type| source ---|---|--- 2026-03-04 19:50:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgb2kudapa24 2026-03-04 20:18:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgb44e74cf2n 2026-03-05 14:15:27+00:00| seen|...
CVE-2026-28696
creationtimestamp| type| source ---|---|--- 2026-03-04 18:08:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgauuz2k3r2u...
CVE-2025-70237
creationtimestamp| type| source ---|---|--- 2026-03-04 17:13:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgarsx3mlr2n 2026-03-04 17:14:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgartowgvs2s...
CVE-2026-23234
creationtimestamp| type| source ---|---|--- 2026-03-04 15:10:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116171539246167027 2026-03-04 16:12:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgaof534oe2n 2026-03-13 00:00:00+00:00| seen|...
EUVD-2026-9395
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the seraphaccelapi AJAX action with fn=GetData. This is due to the OnAdminApiGetData function not performing any capability checks. This makes it...
MINI-WM46-XW29-WMRH
Bulletin has no description...
MINI-C35J-9R2J-VVVM
Bulletin has no description...