PT-2026-23815

The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date from' and 'date to' parameters in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Freedom Factory dGEN1 授权问题漏洞

The Freedom Factory dGEN1 is a Ethereum mobile device produced by the Freedom Factory company. Versions of Freedom Factory dGEN1 dated back to 20260221 and earlier contained an authorization issue vulnerability. This vulnerability stemmed from incorrect operations on the FakeAppProvider function...

WordPress plugin CM Custom Reports 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Freedom Factory dGEN1 授权问题漏洞

The Freedom Factory dGEN1 is a Ethereum mobile device produced by the Freedom Factory company. Versions of the Freedom Factory dGEN1 dated 20260221 and earlier have a licensing issue vulnerability. This vulnerability stems from incorrect operations on the AlarmService function in the com.dgen.ala...

CVE-2026-30244

creationtimestamp| type| source ---|---|--- 2026-03-06 23:48:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggisvjt5g2y 2026-03-07 09:05:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghhx5epgt2u...

GHSA-MQ4R-H2GH-QV7X Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

CVE-2026-30846

creationtimestamp| type| source ---|---|--- 2026-03-06 21:04:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg7mjmbwh2n...

CVE-2026-30847

creationtimestamp| type| source ---|---|--- 2026-03-06 20:54:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg72mcthh2d...

GHSA-W6VW-MRGV-69VF

creationtimestamp| type| source ---|---|--- 2026-03-06 20:09:04+00:00| seen| https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/ 2026-03-10 23:10:58+00:00| seen|...

CVE-2025-69644

creationtimestamp| type| source ---|---|--- 2026-03-06 19:00:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfyps4ynz2k 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2026-29122

International Data Casting IDC SFX2100 satellite receiver comes with the /bin/date utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file...

CVE-2018-25188

creationtimestamp| type| source ---|---|--- 2026-03-06 14:07:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfid75x6u24...

CVE-2018-25189

creationtimestamp| type| source ---|---|--- 2026-03-06 13:54:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfhlde5ii2e...

CVE-2026-30885

creationtimestamp| type| source ---|---|--- 2026-03-06 13:27:33+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5...

CVE-2026-29059

creationtimestamp| type| source ---|---|--- 2026-03-06 13:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgfffrkmn22w 2026-04-14 20:03:14+00:00| published-proof-of-concept| Telegram/P20Htht508gPcGtfhYsw3BkHMYZAVXCzBRlMvbh3o3mGtY 2026-06-03 04:09:58+00:00| confirmed|...

CVE-2026-23097

creationtimestamp| type| source ---|---|--- 2026-03-06 13:10:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgff4w63em24 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-03-20 13:05:29+00:00| seen|...

CVE-2025-11792

creationtimestamp| type| source ---|---|--- 2026-03-06 13:03:05+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis...

CVE-2026-27417

Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through 4.0.1...

CVE-2026-28681

creationtimestamp| type| source ---|---|--- 2026-03-06 06:04:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgend7unkc2k 2026-03-06 08:07:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu6w36ns2f 2026-03-06 08:09:25+00:00| seen|...