CVE-2026-27836

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited us...

GHSA-PRJF-86W9-MFQV

creationtimestamp| type| source ---|---|--- 2026-02-27 20:10:11+00:00| seen| https://gist.github.com/alon710/b3ea10b84b3ec49955d7221d8d85c2f7...

CVE-2026-27836

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint /api/webauthn/prepare creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited us...

CVE-2026-27836

phpMyFAQ prior to v4.0.18 is vulnerable due to the WebAuthn prepare endpoint (/api/webauthn/prepare), which creates new active user accounts without authentication, CSRF protection, captcha, or config checks. This allows unauthenticated attackers to create unlimited user accounts even when regist...

CVE-2026-27793 Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the GET /api/v1/user/:id endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of...

CVE-2026-27793

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the GET /api/v1/user/:id endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of...

CVE-2026-27707 Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in POST /api/v1/auth/jellyfin allows an unauthenticated attacker to register a new Seerr account on any Plex-configure...

CVE-2025-15576

creationtimestamp| type| source ---|---|--- 2026-02-27 16:51:02+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/freebsd-security-advisory-av26-179 2026-02-28 16:20:03+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mfwmwwxhm22q...

CVE-2025-9959

creationtimestamp| type| source ---|---|--- 2026-02-27 13:46:21+00:00| seen| https://gist.github.com/YLChen-007/7146f45960f79bc1e2976fed526e0a9b 2026-02-27 13:47:21+00:00| seen| https://gist.github.com/YLChen-007/35b7d46e892266a0ed6dbe57802858be 2026-02-27 13:48:34+00:00| seen|...

CVE-2025-9907

creationtimestamp| type| source ---|---|--- 2026-02-27 10:08:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfthp6x3tg2n...

EUVD-2026-9006

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller BMC component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote...

Command Injection

Overview rubyipmi is a Controls IPMI devices via command line wrapper for ipmitool and freeipmi Affected versions of this package are vulnerable to Command Injection via the username parameter in the BMC interface. An attacker can execute arbitrary system commands by supplying a specially crafted...

EUVD-2025-208134

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash // prefix in the gatewaypath. A malicious or socially engineered administrator can configure a...

CVE-2026-2383

creationtimestamp| type| source ---|---|--- 2026-02-27 09:20:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mftez7xqdw2n...

CVE-2026-2362

creationtimestamp| type| source ---|---|--- 2026-02-27 09:18:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mftew2gavx2u...

SUSE-SU-2026:20551-1 Security update for kubevirt

This update for kubevirt fixes the following issues: Update to version 1.7.0 bsc1257128. Security issues fixed: - CVE-2025-64435: logic flaw in the virt-controller can lead to incorrect status updates and potentially causing a DoS bsc1253189. - CVE-2024-45310: kubevirt vendored...

CVE-2025-49654

creationtimestamp| type| source ---|---|--- 2026-02-27 08:45:57+00:00| seen| https://gist.github.com/morecitricacid-coder/ec64f9313e2ced9b564171986dff5be5...

CVE-2026-0980

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller BMC component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote...

CVE-2026-0980 Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller BMC component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote...

CVE-2025-9909 Aap-gateway: improper path validation in gateway allows credential exfiltration

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash // prefix in the gatewaypath. A malicious or socially engineered administrator can configure a...