PT-2026-26954

BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the DNS Address field that allows local attackers to crash the application by supplying an excessively long string. Attackers can enable the DNS Address option in the Firewall settings and paste a buffer of 700 bytes...

PT-2026-26983

jetAudio 8.1.7.20702 Basic contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string through the URL input handler. Attackers can trigger the crash by pasting a buffer of 5000 characters into the Open URL dialog, causin...

PT-2026-26952

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers can paste a buffer of 5000 characters into the 'From URL' field during torrent addition to trigger an application crash...

CVE-2026-1800

creationtimestamp| type| source ---|---|--- 2026-03-21 20:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhlt3xhcei26...

EUVD-2019-19890

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a...

MAL-2026-2014 Malicious code in address-autocompletetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b797224d264945b820a632a44fdf26c3baa54e8f1b5f6fe3db4a1739ee726f58 The package address-autocompletetest was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in address-autocompletetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b797224d264945b820a632a44fdf26c3baa54e8f1b5f6fe3db4a1739ee726f58 The package address-autocompletetest was found to contain malicious code. Source: ossf-package-analysis...

CVE-2019-25571

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a...

CVE-2019-25571

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a...

CVE-2026-3478 Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the reduxp AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint wpajaxnoprivreduxp that is accessible to...

CVE-2026-2290 Post Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field

The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to initiate arbitrary outbound requests from the...

CVE-2026-33179

creationtimestamp| type| source ---|---|--- 2026-03-21 01:54:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhjweler5j2w 2026-03-21 04:45:06+00:00| seen| https://bsky.app/profile/crustytldr.bsky.social/post/3mhk7vmgu6d2e 2026-03-24 12:18:06+00:00| seen|...

EUVD-2026-13808

ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content...

PT-2026-26884

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.52.0 Apache ActiveMQ Artemis versions 2.0.0 through 2.44.0 Description An authorization issue exists in Apache Artemis and Apache ActiveMQ Artemis. Specifically, when an application utilizing the OpenWi...

PT-2026-26916

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a...

CVE-2026-33237

CVE-2026-33237 affects WWBN AVideo. The Scheduler plugin’s run() path in plugin/Scheduler/Scheduler.php uses callbackURL with isValidURL() (URL format check) but omits isSSRFSafeURL(), allowing SSRF to RFC-1918/private and cloud metadata endpoints. Concrete details show the vulnerable code at Sch...

CVE-2026-33422

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ipaddress of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, a...

CVE-2026-33422 Discourse exposes ip_address of flagged user

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ipaddress of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, a...

EUVD-2026-13900

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ipaddress of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, a...

CVE-2026-33422

Discourse has a vulnerability where the ip_address of a flagged user is exposed to users who can access the review queue. Affected versions are prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The issue is mitigated in 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 via a patch. No workarounds are l...