CVE-2026-5731

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-08 12:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6aeqsg2z 2026-04-09 00:01:20+00:00| seen|...

EUVD-2026-19773

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting Stored XSS vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator...

CVE-2026-35575

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting Stored XSS vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator...

CVE-2026-35575

ChurchCRM (open-source church management) has a Stored XSS in the admin panel’s group-creation feature, prior to version 6.5.3. The vulnerability allows any user with group-creation privileges to inject malicious JavaScript that executes when an administrator views the page, enabling theft of the...

CVE-2026-35575 ChurchCRM has Stored XSS in Group Name

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting Stored XSS vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator...

CVE-2026-35575 ChurchCRM has Stored XSS in Group Name

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting Stored XSS vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator...

CVE-2026-39314 CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in ppdCreateFromIPP cups/ppd-cache.c allows any unprivileged local user to crash the cupsd root process by supplying a negative...

CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

CVE-2026-22683

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

EUVD-2026-19688

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

EUVD-2026-19605

Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0b3 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking...

CVE-2026-4740

creationtimestamp| type| source ---|---|--- 2026-04-07 15:26:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3o7zjll2j 2026-04-07 17:29:14+00:00| published-proof-of-concept| Telegram/8eXn4QLj3W18AYc2pIsiDgfSWsuolTpz1YwE008yOgTXtw...

CVE-2026-3466

creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:30+00:00| published-proof-of-concept| Telegram/OQovZCNyncHtmKsEQoVAn9WglYI3Qk-HPEu8DU-i8r2-BaQ 2026-04-07 15:38:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw4crqhwx2n...

CVE-2026-5747

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5747 2026-04-08 00:27:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwzuw7cz52z 2026-04-08 01:15:45+00:00|...

CVE-2026-4401

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4401 2026-04-08 00:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwytkwmbm2z 2026-04-20 15:37:06+00:00| seen|...

CERTFR-2026-ACT-015

creationtimestamp| type| source ---|---|--- 2026-04-07 14:41:37+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mivz5ulz6q2n 2026-04-12 02:57:19+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mjbe4yzibh2t...

CVE-2026-5378 runZero Platform user creation leak

An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N 5.8 Medium. This issue was fix...

CVE-2026-5378 runZero Platform user creation leak

An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N 5.8 Medium. This issue was fix...

CVE-2026-5378

The CVE-2026-5378 issue affects the runZero Platform. Affected component: user management functionality in the RunZero platform. Description indicates an Incorrect Authorization flaw that allowed administrators to create and update users outside of their authorized organization scope. Root cause ...