24217 matches found
CVE-2026-30925
CVE-2026-30925 affects Parse Server with LiveQuery enabled. A crafted $regex subscription can cause catastrophic backtracking in JavaScript regex evaluation on the Node.js event loop, blocking the server and making the entire deployment unresponsive. This impacts all clients for affected deployme...
GHSA-V359-JJ2V-J536
creationtimestamp| type| source ---|---|--- 2026-03-09 21:10:06+00:00| seen| https://gist.github.com/alon710/4d9727ddef862a1e929678af12c10073...
Authorization Bypass Through User-Controlled Key
Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the useruuid parameter in the event participation process. An attacker can...
EUVD-2026-10438
Admidio: Event participation IDOR - non-leaders can register other users for events via useruuid parameter...
GHSA-7PFV-HR63-H7CW Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Vulnerability In modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. Line 47: $getUserUuid = admFuncVariableIsValid$GET, 'useruuid', 'uuid', ... Line 424: if...
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Vulnerability In modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. Line 47: $getUserUuid = admFuncVariableIsValid$GET, 'useruuid', 'uuid', ... Line 424: if...
EUVD-2026-10333
Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes...
CERTFR-2026-ACT-010
creationtimestamp| type| source ---|---|--- 2026-03-09 13:50:58+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116199538935463629 2026-06-10 07:49:59+00:00| seen| https://bsky.app/profile/test-cvp.bsky.social/post/3mnw7yrxsbg2i 2026-06-10 13:04:23+00:00| seen|...
CVE-2026-2261
The CVE-2026-2261 issue affects blocklistd where a programming error leaks a socket descriptor per adverse event, eventually exhausting file descriptors. After a moderate number of leaks, the process cannot run the helper script because a forked child dereferences a null pointer and crashes, prev...
CVE-2025-70048
creationtimestamp| type| source ---|---|--- 2026-03-09 06:05:47+00:00| seen| https://gist.github.com/zcxlighthouse/ae89b0542ef3e39cd6dcac9d529c2c69 2026-03-09 15:16:15+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-70048...
PT-2026-24152
Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.6 Description Admidio is a user management solution. A flaw exists in the event participation logic within the modules/events/events function.php file. This allows any user permitted to participate in an event to...
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Register unwilling users for events potential harassment/spam - Cancel other users' event participation - Manipulate event participant counts and comments - If events have participation limits, fill slots with unwanted registrations...
PT-2026-24151
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.0-alpha.14 Parse Server versions prior to 8.6.11 Description A crafted $regex pattern within a LiveQuery subscription can cause catastrophic backtracking, blocking the Node.js event loop and rendering the...
WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin Themify Event Post versions = 1.3.4...
CVE-2026-3663
creationtimestamp| type| source ---|---|--- 2026-03-07 17:09:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgicx52oon2k...
CVE-2026-30838
creationtimestamp| type| source ---|---|--- 2026-03-07 15:15:56+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-30838 2026-03-07 19:22:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgikfukdrr27...
CVE-2026-29184 @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass
Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4...
CVE-2025-14675
creationtimestamp| type| source ---|---|--- 2026-03-07 09:27:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghj627mz72u...