59128 matches found
CVE-2025-50196
creationtimestamp| type| source ---|---|--- 2026-03-02 16:47:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3pfy67g427...
CVE-2026-28286
ZimaOS 1.5.2-beta3 is affected: the UI blocks file/folder creation in internal paths, but the API bypasses this validation, allowing arbitrary file/directory creation in sensitive dirs (e.g., /etc, /usr) via crafted requests. Root cause is improper API path validation, enabling path traversal-lik...
CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...
CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...
CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...
CVE-2026-26695
creationtimestamp| type| source ---|---|--- 2026-03-02 16:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3nogbqu62k...
CVE-2025-52998
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...
CVE-2026-24115
creationtimestamp| type| source ---|---|--- 2026-03-02 16:08:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3n7zpghz2d...
CVE-2026-0995
creationtimestamp| type| source ---|---|--- 2026-03-02 15:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3mlcirgx2x...
CVE-2025-52998 Chamilo: PHAR deserialization bypass
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...
CVE-2025-52998 Chamilo: PHAR deserialization bypass
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...
CVE-2026-20430
creationtimestamp| type| source ---|---|--- 2026-03-02 14:41:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3idougdi2d 2026-03-02 18:20:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3uma3wcb24 2026-03-03 09:08:54+00:00| seen|...
CVE-2026-3431
creationtimestamp| type| source ---|---|--- 2026-03-02 13:17:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3do2p6kz26 2026-03-02 13:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3fokgmj42u 2026-03-02 15:36:47+00:00| seen|...
CVE-2022-50700
creationtimestamp| type| source ---|---|--- 2026-03-02 12:55:20+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mg3cgo5htc2g 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...
CVE-2025-30042
The CVE-2025-30042 entry concerns the CGM CLININET system, where smart card authentication is effectively bypassed because access verification uses only the certificate number on the client, not the presence of a smart card or private key. This allows authentication if the certificate number is k...
CVE-2025-30035 Lack of API authentication allowing session generation for any user
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the...
CVE-2025-30035 Lack of API authentication allowing session generation for any user
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the...
CVE-2025-10350
creationtimestamp| type| source ---|---|--- 2026-03-02 10:55:00+00:00| seen| https://cert.pl/en/posts/2026/03/CVE-2025-10350/ 2026-03-02 11:53:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg36xw3hev2x...
CVE-2026-20428
creationtimestamp| type| source ---|---|--- 2026-03-02 09:20:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116158838343422570 2026-03-03 09:08:54+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mediatek-6...