CVE-2026-2446

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options such as defaultrole etc and create arbitrary admin users...

CVE-2026-1825

creationtimestamp| type| source ---|---|--- 2026-03-07 07:16:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1825 2026-03-07 10:13:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghlqjmp562d...

CVE-2026-1820

creationtimestamp| type| source ---|---|--- 2026-03-07 07:16:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1820 2026-03-07 09:39:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghjsyfvin2d...

CVE-2026-30822

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13...

CVE-2026-1981

creationtimestamp| type| source ---|---|--- 2026-03-07 03:57:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggwpnlpxe2u...

CVE-2026-2494

creationtimestamp| type| source ---|---|--- 2026-03-07 03:47:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggw5qqdqf2d...

CVE-2026-1902

creationtimestamp| type| source ---|---|--- 2026-03-07 03:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgguj34uut2v...

CVE-2026-3233

creationtimestamp| type| source ---|---|--- 2026-03-07 03:04:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggtqrk7wd2z...

CVE-2025-14353

creationtimestamp| type| source ---|---|--- 2026-03-07 03:02:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggtnmaqmu2x 2026-03-07 04:20:41+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mggxz3abjs2n 2026-03-07 08:16:04+00:00| seen|...

CVE-2026-30228

creationtimestamp| type| source ---|---|--- 2026-03-06 23:38:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggiayky772o...

Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

CVE-2026-30843

creationtimestamp| type| source ---|---|--- 2026-03-06 21:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg7vhzc662u...

GHSA-79WJ-8RQV-JVP5

creationtimestamp| type| source ---|---|--- 2026-03-06 20:40:06+00:00| seen| https://gist.github.com/alon710/c6f9f46bb80364d9d8a079167039fc0b...

CVE-2026-30229

creationtimestamp| type| source ---|---|--- 2026-03-06 20:40:06+00:00| seen| https://gist.github.com/alon710/c6f9f46bb80364d9d8a079167039fc0b 2026-03-06 23:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgggqhqr5r27...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789

Summary: Vito (self-hosted web app) suffers a cross-project privilege escalation due to a missing authorization check in workflow site-creation actions. Affected versions: prior to 3.20.3. Impact: an authenticated user with workflow write access in one project can create/manage sites on servers b...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

EUVD-2026-10068

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-30228 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API POST /files/:filename, DELETE /files/:filename. This bypasses the...

CVE-2026-30228 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API POST /files/:filename, DELETE /files/:filename. This bypasses the...