CVE-2026-28367

creationtimestamp| type| source ---|---|--- 2026-03-27 19:18:53+00:00| seen| Telegram/aqievDs9oCICHmk4C8wabuGpxUWUtlG5g0Gk9aIz6TfeTOo 2026-03-27 22:15:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35eyri5m2j 2026-04-10 15:07:08+00:00| seen|...

CVE-2026-34389 Fleet's user account creation via invite does not enforce invited email address

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token...

EUVD-2025-209100

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

GHSA-G6PG-52VF-843H MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2026-33206

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4...

GHSA-H3P4-M74F-43G6

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4...

CVE-2026-25396

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE...

CVE-2026-25334

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE 2026-04-07 04:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miuwyhv7db2w...

CVE-2026-33770

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-5036

creationtimestamp| type| source ---|---|--- 2026-03-27 16:25:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116302066909306765 2026-03-28 16:16:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116307694173463292 2026-03-29 09:00:30+00:00| seen|...

CVE-2026-33770

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-33770 AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-33770

Summary: CVE-2026-33770 affects WWBN/AVideo up to version 26.0, where fixCleanTitle() in objects/category.php interpolates user-controlled data directly into a SQL query, enabling SQL injection when creating or renaming categories. The vulnerability stems from building the query with $clean_title...

CVE-2026-27877

creationtimestamp| type| source ---|---|--- 2026-03-27 16:03:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2ilk6erq2s...

CVE-2026-1496

creationtimestamp| type| source ---|---|--- 2026-03-27 15:56:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2i7xzklv2s 2026-03-27 17:22:21+00:00| seen| Telegram/YkFovyOp1l89l2HrsHhU-e8kv9HXA0gCdui6VpSIt8SuiME...

CVE-2026-33044

creationtimestamp| type| source ---|---|--- 2026-03-27 15:48:13+00:00| published-proof-of-concept| https://github.com/home-assistant/core/security/advisories/GHSA-r584-6283-p7xc 2026-03-27 21:22:55+00:00| seen| Telegram/Gog278dWyh4lEZUplneDunVggYKWxHPgBiv3mkrQtX1ZGY 2026-03-28 19:35:35+00:00| see...

Allocation of Resources Without Limits or Throttling

Overview miraheze/ts-portal is a Portal for handling and managing the investigation lifecycle for Trust and Safety at the WikiTide Foundation Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DPAAlreadyLive validation process. An...

GHSA-6FQ7-PGJ3-6CFP

creationtimestamp| type| source ---|---|--- 2026-03-27 15:17:36+00:00| seen| Telegram/LBnoZEkIgYZcAalPkuHtbpp5d2DNhQfVZICyQCgDXFXXQ...

CVE-2026-4620

creationtimestamp| type| source ---|---|--- 2026-03-27 15:17:14+00:00| seen| Telegram/svRbUAS3r6GAYzDJQh3Todl-Lk2he1i8bWMEx2GJpog2k 2026-03-27 16:05:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2ipzkusr2s 2026-04-02 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN89339669/...