64784 matches found
GHSA-QVQR-5CV7-WH35
creationtimestamp| type| source ---|---|--- 2026-03-27 23:28:21+00:00| seen| Telegram/rRTxpaJmTYQmE8Q4CNoqCv49oiBv1g4u8JDlKqXnTcwR7sk...
GHSA-2328-F5F3-GJ25
creationtimestamp| type| source ---|---|--- 2026-03-27 23:28:03+00:00| seen| Telegram/EI25wC4yN3TaatXDJQ6U03Lar3nhYMfqPNXio5Iaw2cNO8...
CVE-2026-33991
WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletartag.php uses extract$REQUEST on line 14 and directly concatenates the $idtag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches t...
CVE-2026-27309
creationtimestamp| type| source ---|---|--- 2026-03-27 22:28:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi364lvtux2r 2026-03-27 22:49:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi37cgjnrz2i 2026-03-28 01:30:48+00:00| seen|...
Zebra node crash — V5 transaction hash panic (P2P reachable)
--- Remote Denial of Service via Crafted V5 Transactions Summary A vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic crash. This is triggered by sending a specially crafted V5 transaction that passes initial...
CVE-2026-33991
CVE-2026-33991 affects WeGIA (web manager for charitable institutions). Before version 3.6.7, html/socio/sistema/deletar_tag.php uses extract($_REQUEST) and directly concatenates $id_tag into SQL queries (no prepared statements/sanitization), enabling SQL injection. This results in potential data...
CVE-2026-33991 WeGIA has SQL Injection in deletar_tag.php
WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletartag.php uses extract$REQUEST on line 14 and directly concatenates the $idtag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches t...
CVE-2026-33991
WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletartag.php uses extract$REQUEST on line 14 and directly concatenates the $idtag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches t...
CVE-2026-4985
The CVE-2026-4985 entry concerns dloebl CGIF v0.5.2 and earlier, affecting the GIF Image Handler’s cgif_addframe (src/cgif.c). The vulnerability stems from an integer overflow caused by manipulating width/height, potentially exploitable remotely. A patch is available (patch id: b0ba830093f4317a5d...
GHSA-F92M-JPV7-55P2
creationtimestamp| type| source ---|---|--- 2026-03-27 21:22:55+00:00| seen| Telegram/Gog278dWyh4lEZUplneDunVggYKWxHPgBiv3mkrQtX1ZGY...
GHSA-XGV5-66WP-CH88
creationtimestamp| type| source ---|---|--- 2026-03-27 21:22:34+00:00| seen| Telegram/HCzuKY5MuLPsfoEI5S3ks6iQFEX7xEFL0kHnLhrHZ36Sb0...
GHSA-99HJ-44VG-HFCP
creationtimestamp| type| source ---|---|--- 2026-03-27 21:22:34+00:00| seen| Telegram/HCzuKY5MuLPsfoEI5S3ks6iQFEX7xEFL0kHnLhrHZ36Sb0...
CVE-2026-33946 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamablehttptransport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's...
CVE-2026-33946 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamablehttptransport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's...
CVE-2026-34205
creationtimestamp| type| source ---|---|--- 2026-03-27 21:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi2zau2fcs2x 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU 2026-03-28 03:00:13+00:00| seen|...
CVE-2026-31950
LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint /api/agents/chat/stream/:streamId does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and...
GHSA-H6R3-P5GV-5QGC vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-31950 LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats
LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint /api/agents/chat/stream/:streamId does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and...
