CVE-2026-27685

creationtimestamp| type| source ---|---|--- 2026-03-10 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0256/ 2026-03-10 01:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116202289801188286 2026-03-10 14:56:21+00:00| seen|...

PT-2026-24252

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms api/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails t...

PT-2026-24375

Name of the Vulnerable Software and Affected Versions Giflib affected versions not specified Description Giflib contains a double-free vulnerability stemming from a shallow copy within the GifMakeSavedImage function and inadequate error handling. Triggering this issue may be difficult, but is...

CVE-2025-11739

creationtimestamp| type| source ---|---|--- 2026-03-10 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0254/ 2026-03-19 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-04...

CVE-2026-30837

creationtimestamp| type| source ---|---|--- 2026-03-09 23:07:15+00:00| published-proof-of-concept| https://github.com/elysiajs/elysia/security/advisories/GHSA-f45g-68q3-5w8x 2026-03-10 22:10:06+00:00| seen| https://gist.github.com/alon710/d6b1fc7825008cc6314a624b23b7b0a9 2026-03-20 16:20:09+00:00...

CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...

EUVD-2026-10433

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...

CVE-2026-28431

creationtimestamp| type| source ---|---|--- 2026-03-09 22:30:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201580941905093...

GHSA-V359-JJ2V-J536

creationtimestamp| type| source ---|---|--- 2026-03-09 21:10:06+00:00| seen| https://gist.github.com/alon710/4d9727ddef862a1e929678af12c10073...

GHSA-QH4C-XF7M-GXFC

creationtimestamp| type| source ---|---|--- 2026-03-09 21:10:06+00:00| seen| https://gist.github.com/alon710/4d9727ddef862a1e929678af12c10073...

CVE-2026-3750

A security vulnerability has been detected in ContiNew Admin up to 4.2.0. This issue affects the function URI.create of the file continew-system/src/main/java/top/continew/admin/system/factory/S3ClientFactory.java of the component Storage Management Module. The manipulation leads to server-side...

CVE-2026-3638

creationtimestamp| type| source ---|---|--- 2026-03-09 19:30:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116200873186129950...

GHSA-HWX8-Q9CG-MQMC

creationtimestamp| type| source ---|---|--- 2026-03-09 19:10:06+00:00| seen| https://gist.github.com/alon710/3fd4142edf95384fd65face73227a201...

GHSA-Q5Q9-2RHP-33QW

creationtimestamp| type| source ---|---|--- 2026-03-09 18:40:05+00:00| seen| https://gist.github.com/alon710/b35bd22da36673db291bcd39a01cd730...

GHSA-4HGG-C4RR-6H7F

creationtimestamp| type| source ---|---|--- 2026-03-09 17:40:05+00:00| seen| https://gist.github.com/alon710/97d8836abc82cac88ce934ff047f0ac3...

CVE-2025-70238

creationtimestamp| type| source ---|---|--- 2026-03-09 16:12:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116200094574895659...

CVE-2026-3814

creationtimestamp| type| source ---|---|--- 2026-03-09 10:32:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116198759465088172 2026-03-23 05:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhpdvvbv252h...

CVE-2025-41757

A low-privileged remote attacker can abuse the backup restore functionality of UBR ubr-restore which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system...

CVE-2025-41757 Arbitrary Write with ubr-restore

A low-privileged remote attacker can abuse the backup restore functionality of UBR ubr-restore which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system...

CVE-2026-30822

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13...