CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

EUVD-2026-34320

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522 Iris has an Improper Authorization issue

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522

Affected software: Iris DFIR-IRIS web collaboration platform. Vulnerable version: earlier than 2.4.28. Issue: optional GraphQL endpoint at /graphql did not enforce the same authorization as the REST API, enabling three unauthorized actions by any authenticated user: (1) IOC read across cases (IDO...

GHSA-V39M-97P8-GQG7 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

UserController::upsertUser writes user data in SYSTEMSCOPE and does not filter the admin field. A non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users, escalating to full admin access. The Problem In...

CVE-2026-41207

creationtimestamp| type| source ---|---|--- 2026-06-04 19:24:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnidzlfbgm2f...

GHSA-WC3V-3457-C8CM OpenMeter: SQL injection through meter creation

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

OpenMeter: SQL injection through meter creation

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

CVE-2026-10864

creationtimestamp| type| source ---|---|--- 2026-06-04 15:51:15+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116692633027353872...

CVE-2025-62338

creationtimestamp| type| source ---|---|--- 2026-06-04 15:11:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnhvupnvuy2p...

CVE-2026-40605

creationtimestamp| type| source ---|---|--- 2026-06-04 15:02:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnhvehyugn2b...

CVE-2026-50076

creationtimestamp| type| source ---|---|--- 2026-06-04 15:00:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnhvaiggnp2z 2026-06-04 22:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnimqlnbzi2f 2026-07-03 22:54:47+00:00| seen|...

CVE-2019-25745

creationtimestamp| type| source ---|---|--- 2026-06-04 14:49:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnhunutpu526 2026-06-04 23:28:00+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnirmljg7r2d 2026-06-04 23:30:30+00:00| seen|...

CVE-2026-10861

creationtimestamp| type| source ---|---|--- 2026-06-04 14:46:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnhuhzxasw2b...

CVE-2026-10840

creationtimestamp| type| source ---|---|--- 2026-06-04 14:21:53+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116692281779225455 2026-07-25 23:56:44+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrj2yw5jzz2c...

CVE-2019-25742 WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS

WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execu...

CVE-2019-25742

CVE-2019-25742 affects WordPress Theme Zoner Real Estate 4.1.1 with a persistent XSS in the Address field during property creation. Authenticated agents can inject JavaScript payloads that execute when administrators view the property for approval, enabling cookie theft and potential session hija...

EUVD-2019-20178

WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execu...

CVE-2026-9491

creationtimestamp| type| source ---|---|--- 2026-06-04 13:20:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnhpnwevta2j 2026-08-28 10:15:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/f2cnt3uqpummc...

EUVD-2026-34257

A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially...