24393 matches found
GHSA-M983-V2FF-WQ65 LiveQuery protected field leak via shared mutable state across concurrent subscribers
Impact When multiple clients subscribe to the same class via LiveQuery, the event handlers process each subscriber concurrently using shared mutable objects. The sensitive data filter modifies these shared objects in-place, so when one subscriber's filter removes a protected field, subsequent...
CVE-2026-3775
creationtimestamp| type| source ---|---|--- 2026-03-30 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0382/ 2026-03-31 14:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mieg3rhqh224 2026-04-01 02:24:47+00:00| seen|...
CVE-2026-4425
creationtimestamp| type| source ---|---|--- 2026-03-30 16:16:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mic2pnbenz2g 2026-04-02 11:57:35+00:00| seen| https://bsky.app/profile/thecybermind.co/post/3mij5nyg3mq2e...
CVE-2024-48408
creationtimestamp| type| source ---|---|--- 2026-03-30 16:00:22+00:00| seen| https://gist.github.com/Geobm/81155ee01d0d61794afd623f842d764a...
EUVD-2026-17084
A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...
CVE-2026-3321
A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...
CVE-2026-3321
A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...
CVE-2026-3321
CVE-2026-3321 describes an authorization bypass in ON24 Q&A chat, via a user-controlled key in the endpoint console-survey/api/v1/answer/{EVENTID}/{TIMESTAMP}/. An unauthenticated attacker can enumerate event IDs and access the full Q&A history, exposing IDs, private URLs, messages, references, a...
CVE-2026-3321 Authorization Bypass in ON24 Q&A chat
A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint. Exploiting this vulnerability would allow an unauthenticated attacker to enumerate event IDs and obtain the complete Q&A history. This publicly exposed data may...
CVE-2019-25654
creationtimestamp| type| source ---|---|--- 2026-03-30 12:27:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mibnwl6uza2z 2026-04-08 17:00:16+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miyreqsjmz2i...
CVE-2026-5119
creationtimestamp| type| source ---|---|--- 2026-03-30 08:20:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miba5rua5c2s 2026-03-30 18:58:59+00:00| seen| https://bsky.app/profile/kona.meow.social.ap.brid.gy/post/3micdspwo23u2 2026-06-04 11:21:51+00:00| seen|...
CVE-2026-30937
creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:32+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...
CVE-2025-61612
creationtimestamp| type| source ---|---|--- 2026-03-30 05:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miauwxg4iw2k...
PT-2026-29024
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A vulnerability exists that allows authorization bypass through a user-controlled key in the 'console-survey/api/v1/answer/EVENTID/TIMESTAMP/' endpoint...
ON24 Q&A Chat 安全漏洞
ON24 Q&A Chat is an online interactive Q&A and chat component developed by ON24 Inc. There is a security vulnerability in ON24 Q&A Chat. This vulnerability stems from the console-survey/api/v1/answer/EVENTID/TIMESTAMP/ endpoint, which allows unauthorized access through bypassing user-controlled...
GHSA-QC36-X95H-7J53
creationtimestamp| type| source ---|---|--- 2026-03-29 15:20:09+00:00| seen| Telegram/bOji7uFGKpjQ-Vv3CFZvWqxNHLg4F03MY6E5pxai3iB8W0...
CVE-2026-4995 wandb OpenUI Window Message Event index.html cross site scripting
A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...
CVE-2026-4995
wandb OpenUI up to version 1.0 is affected. The vulnerability targets the Window Message Event Handler in frontend/public/annotator/index.html, enabling cross-site scripting. Exploitation can be performed remotely, and the exploit has been publicly disclosed. The vendor was contacted early but di...
CVE-2026-4995 wandb OpenUI Window Message Event index.html cross site scripting
A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...