CVE-2026-34227

creationtimestamp| type| source ---|---|--- 2026-03-27 21:00:04+00:00| published-proof-of-concept| Telegram/4Dok0lwXJBk164h58WI7MYFHPq5Lse38n7xHVnp6ML19Yk 2026-03-30 19:19:17+00:00| published-proof-of-concept| https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm 2026-04-03...

CVE-2026-33887

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the user invitation process. An attacker can gain unauthorized access with elevated privileges by using a valid invite token to create an account under any email address, thereby inheriting the role associated...

CVE-2025-15617

creationtimestamp| type| source ---|---|--- 2026-03-27 19:44:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2uxim3mn2o 2026-09-03 12:00:05+00:00| seen| Telegram/wjGJNcgiCtazOObm08zBWnjh0cnGBFnktQF1xuBs3F9UCdI 2026-09-04 00:00:48+00:00| published-proof-of-concept|...

CVE-2026-34411

creationtimestamp| type| source ---|---|--- 2026-03-27 19:19:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2tl7ovon2t...

CVE-2026-4961

creationtimestamp| type| source ---|---|--- 2026-03-27 19:19:24+00:00| seen| Telegram/oT6t4NRMpgoX3zBs2D6gNNWCx9cAFlVoBXSXqbTX6Ejwqdk 2026-03-27 19:39:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2uok4o332j 2026-03-27 20:04:35+00:00| seen|...

CVE-2026-28367

creationtimestamp| type| source ---|---|--- 2026-03-27 19:18:53+00:00| seen| Telegram/aqievDs9oCICHmk4C8wabuGpxUWUtlG5g0Gk9aIz6TfeTOo 2026-03-27 22:15:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35eyri5m2j 2026-04-10 15:07:08+00:00| seen|...

CVE-2026-34389 Fleet's user account creation via invite does not enforce invited email address

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token...

EUVD-2025-209100

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

GHSA-G6PG-52VF-843H MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2026-33206

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4...

GHSA-H3P4-M74F-43G6

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4...

CVE-2026-25396

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE...

CVE-2026-25334

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE 2026-04-07 04:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miuwyhv7db2w...

CVE-2026-33770

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-5036

creationtimestamp| type| source ---|---|--- 2026-03-27 16:25:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116302066909306765 2026-03-28 16:16:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116307694173463292 2026-03-29 09:00:30+00:00| seen|...

CVE-2026-33770

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-33770 AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized...

CVE-2026-33770

Summary: CVE-2026-33770 affects WWBN/AVideo up to version 26.0, where fixCleanTitle() in objects/category.php interpolates user-controlled data directly into a SQL query, enabling SQL injection when creating or renaming categories. The vulnerability stems from building the query with $clean_title...