GHSA-382Q-FPQH-29F7

creationtimestamp| type| source ---|---|--- 2026-02-07 21:10:05+00:00| seen| https://gist.github.com/alon710/b598c4c5e72f81adce75e2bb0f575305...

CVE-2026-1731

creationtimestamp| type| source ---|---|--- 2026-02-07 11:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mebbcbu3zb26 2026-02-07 11:00:58+00:00| seen| https://infosec.exchange/users/offseq/statuses/116028999623507500 2026-02-08 15:01:24+00:00| seen|...

CVE-2026-25763

creationtimestamp| type| source ---|---|--- 2026-02-07 09:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116028645772242625 2026-02-07 09:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3meb4bemilo2h 2026-08-15 11:00:04+00:00| published-proof-of-concept|...

GHSA-VHVQ-FV9F-WH4Q

creationtimestamp| type| source ---|---|--- 2026-02-07 02:40:06+00:00| seen| https://gist.github.com/alon710/8323d7b3849b55718473864a8e9cc2a6...

CVE-2020-37106

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

PT-2026-6926

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19 Description The software contains an insecure direct object reference IDOR in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied...

PT-2026-6931

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19 Description An authorization issue exists in WeKan where the allowPrivateOnly instance configuration setting is not fully enforced during board creation. When allowPrivateOnly is enabled, users are still able to...

CVE-2026-25644

creationtimestamp| type| source ---|---|--- 2026-02-06 23:22:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mea2bd4wba2g...

CVE-2026-2070

creationtimestamp| type| source ---|---|--- 2026-02-06 23:21:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mea2b4jy522v...

CVE-2026-25803

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials admin/admin upon the first initialization. Attackers with network access to the application's login interface can gain full...

CVE-2020-37160

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain...

CVE-2020-37160 SprintWork 2.3.1 - Local Privilege Escalation

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain...

CVE-2020-37106 Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2020-37106

The CVE-2020-37106 issue affects Business Live Chat Software 1.0 and is described as a cross-site request forgery (CSRF) vulnerability. A remote attacker can craft a malicious HTML form that sends a POST to the user creation endpoint with administrative access parameters to change user account ro...

CVE-2020-37106

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2026-25544

creationtimestamp| type| source ---|---|--- 2026-02-06 22:16:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7wmw6fh723 2026-02-07 14:00:20+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mebldrpbyd24 2026-02-07 14:00:25+00:00| seen|...

CVE-2026-2067

creationtimestamp| type| source ---|---|--- 2026-02-06 21:18:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tdxkruj23 2026-02-06 21:18:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tezhskz23...

CVE-2026-25749

creationtimestamp| type| source ---|---|--- 2026-02-06 19:21:38+00:00| seen| https://gist.github.com/EbonJaeger/d35ee8e23d9e45964fc3a86bc738c87d 2026-03-18 05:03:24+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mhcpjgbgmce2 2026-03-19 00:00:00+00:00| seen|...

CVE-2026-23989

REVA (OpenCloud Reva component) contains a vulnerability in its GRPC authorization middleware that lets a malicious user bypass the public link scope verification via the archiver service, enabling creation of an archive (zip/tar) containing all resources within the link’s scope. Affected version...

CVE-2026-23989 REVA Public Link Exploit

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to...