PT-2026-27959

Name of the Vulnerable Software and Affected Versions codepeople CP Multi View Event Calendar versions through 1.4.35 Description The software contains a flaw related to improper input handling during web page generation, leading to a cross-site scripting issue. This allows for Stored XSS attacks...

Linux Distros Unpatched Vulnerability : CVE-2026-23311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/core: Fix invalid wait context in ctxschedin Lockdep found a bug in the event scheduling when a pinned event was failed and wakes up the threads in the rin...

PT-2026-27808

Name of the Vulnerable Software and Affected Versions Metagauss EventPrime versions n/a through 4.2.6.0 Description A missing authorization flaw exists in Metagauss EventPrime eventprime-event-calendar-management. This issue allows exploitation of incorrectly configured access control security...

CVE-2026-23920

A flaw was found in Zabbix. Authenticated users can bypass input validation in host and event action scripts by injecting a newline character. This bypass occurs because the validation regex, which uses start-of-line ^ and end-of-line $ anchors, operates in multiline mode. Successful exploitation...

CVE-2026-23920

Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...

EUVD-2026-14905

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

CVE-2026-23920 Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...

CVE-2026-29840

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

CVE-2019-25629

creationtimestamp| type| source ---|---|--- 2026-03-24 13:59:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhsqbqobq42f 2026-03-28 05:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mi3waib3ha2d...

CVE-2019-25645

creationtimestamp| type| source ---|---|--- 2026-03-24 13:33:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhsosjtn4t2x...

CVE-2026-33767

creationtimestamp| type| source ---|---|--- 2026-03-24 13:12:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-fj74-qxj7-r3vc 2026-03-27 19:17:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2th3cqwv2q 2026-03-27 19:19:15+00:00|...

CVE-2019-25626

creationtimestamp| type| source ---|---|--- 2026-03-24 13:03:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhsn4yamts25 2026-05-31 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn4vln7vbg22...

CVE-2026-4624

creationtimestamp| type| source ---|---|--- 2026-03-24 04:09:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrpdcwogj2p...

CVE-2026-4738

creationtimestamp| type| source ---|---|--- 2026-03-24 03:17:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4738 2026-03-24 07:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrztxgbz72x...

CVE-2026-33634

creationtimestamp| type| source ---|---|--- 2026-03-23 22:57:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr5vaikg22i 2026-03-24 00:00:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116281208959546737 2026-03-24 00:00:42+00:00| seen|...

CVE-2026-33548 MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline

Mantis Bug Tracker MantisBT is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline myviewpage.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has...

CVE-2026-27459

creationtimestamp| type| source ---|---|--- 2026-03-23 16:05:34+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mhqgu2fwbtq2 2026-07-11 13:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqer4pfyuk22...

Malicious Package

Overview sfx-event-bridge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2099 Malicious code in sfx-event-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ed3495e868bcd1db85182332d575437978593cda12ceca6ab4acf1c4b28accf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sfx-event-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ed3495e868bcd1db85182332d575437978593cda12ceca6ab4acf1c4b28accf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...