EUVD-2026-17084

A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...

CVE-2026-3321

A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...

CVE-2026-3321 Authorization Bypass in ON24 Q&A chat

A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...

CVE-2026-3321

A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...

CVE-2026-3321

CVE-2026-3321 describes an authorization bypass in ON24 Q&A chat, via a user-controlled key in the endpoint console-survey/api/v1/answer/{EVENTID}/{TIMESTAMP}/. An unauthenticated attacker can enumerate event IDs and access the full Q&A history, exposing IDs, private URLs, messages, references, a...

CVE-2019-25654

creationtimestamp| type| source ---|---|--- 2026-03-30 12:27:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mibnwl6uza2z 2026-04-08 17:00:16+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miyreqsjmz2i...

CVE-2026-5119

creationtimestamp| type| source ---|---|--- 2026-03-30 08:20:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miba5rua5c2s 2026-03-30 18:58:59+00:00| seen| https://bsky.app/profile/kona.meow.social.ap.brid.gy/post/3micdspwo23u2 2026-06-04 11:21:51+00:00| seen|...

CVE-2026-30937

creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:32+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...

CVE-2025-61612

creationtimestamp| type| source ---|---|--- 2026-03-30 05:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miauwxg4iw2k...

ON24 Q&A Chat 安全漏洞

ON24 Q&A Chat is an online interactive Q&A and chat component developed by ON24 Inc. There is a security vulnerability in ON24 Q&A Chat. This vulnerability stems from the console-survey/api/v1/answer/EVENTID/TIMESTAMP/ endpoint, which allows unauthorized access through bypassing user-controlled...

PT-2026-29024

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A vulnerability exists that allows authorization bypass through a user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint...

GHSA-QC36-X95H-7J53

creationtimestamp| type| source ---|---|--- 2026-03-29 15:20:09+00:00| seen| Telegram/bOji7uFGKpjQ-Vv3CFZvWqxNHLg4F03MY6E5pxai3iB8W0...

CVE-2026-4995 wandb OpenUI Window Message Event index.html cross site scripting

A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...

CVE-2026-4995

wandb OpenUI up to version 1.0 is affected. The vulnerability targets the Window Message Event Handler in frontend/public/annotator/index.html, enabling cross-site scripting. Exploitation can be performed remotely, and the exploit has been publicly disclosed. The vendor was contacted early but di...

CVE-2026-4995 wandb OpenUI Window Message Event index.html cross site scripting

A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...

GHSA-QX3G-5G22-FQ5W

creationtimestamp| type| source ---|---|--- 2026-03-28 01:18:50+00:00| seen| Telegram/DQ8Phmkx05Q1rHpnB8sJ1vhC9dSxcFzzTf0RtJAOAn3w7JQ...

GHSA-6Q6H-J7HJ-3R64

creationtimestamp| type| source ---|---|--- 2026-03-27 23:28:21+00:00| seen| Telegram/rRTxpaJmTYQmE8Q4CNoqCv49oiBv1g4u8JDlKqXnTcwR7sk...

GHSA-QVQR-5CV7-WH35

creationtimestamp| type| source ---|---|--- 2026-03-27 23:28:21+00:00| seen| Telegram/rRTxpaJmTYQmE8Q4CNoqCv49oiBv1g4u8JDlKqXnTcwR7sk...

GHSA-PPP5-5V6C-4JWP

creationtimestamp| type| source ---|---|--- 2026-03-27 23:27:55+00:00| seen| Telegram/9UoOcMml4hO1LPqEQWig8KjS1ZNRBXJeCq-u3-UaU0LNh0...

CVE-2026-33632

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — ESEVENTTYPEAUTHEXCHANGEDATA and ESEVENTTYPEAUTHCLONE — were not intercepted by ClearanceKit's opfilter system extension, allowing local...