GHSA-3V3M-WC6V-X4X3

creationtimestamp| type| source ---|---|--- 2026-05-04 08:45:23+00:00| seen| https://bsky.app/profile/mfahlandt.bsky.social/post/3mkzbtsjhx52w 2026-05-08 20:47:09+00:00| seen| https://bsky.app/profile/kubonai.bsky.social/post/3mlem23uryx2s 2026-05-13 14:46:52+00:00| seen|...

Weak Password Recovery Mechanism for Forgotten Password

Overview phpbb/phpbb is a Forum Software application. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via the forceservervars configuration being disabled. An attacker can cause password reset emails to contain links to attacker-controll...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-7721

creationtimestamp| type| source ---|---|--- 2026-05-04 06:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz3srlohr2e...

CVE-2026-7732

creationtimestamp| type| source ---|---|--- 2026-05-04 06:54:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz3msex6f2i...

CVE-2026-7722

creationtimestamp| type| source ---|---|--- 2026-05-04 06:45:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz35ybzbu2r...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-29199

CVE-2026-29199 affects phpBB prior to 3.3.16. The issue is a Host Header Injection in which, when force_server_vars is disabled, the server hostname is sourced from the HTTP Host header to build the password reset URL. An attacker who can control or influence the Host header can cause password re...

vulnerability-research

Vulnerability Research & Responsible Disclosure Shivam Paji...

CVE-2026-7718

creationtimestamp| type| source ---|---|--- 2026-05-04 04:41:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkyu7b3ajc2o...

Malicious Package

Overview @activationcode/activate is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-42369

creationtimestamp| type| source ---|---|--- 2026-05-04 01:18:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkyiu6f3ct2w 2026-05-04 02:50:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkynz6jpjl2h 2026-05-04 04:53:12+00:00| seen|...

CVE-2026-7717

creationtimestamp| type| source ---|---|--- 2026-05-04 01:17:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkyitpy4ep2l 2026-05-04 03:06:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkyovthfca2r...

CVE-2026-7711

creationtimestamp| type| source ---|---|--- 2026-05-04 00:58:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkyhr4pfcp2c...

EUVD-2026-26863

Multiple reflected cross-site scripting xss vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this...

CVE-2026-7710

creationtimestamp| type| source ---|---|--- 2026-05-04 00:32:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkygbvfube2k...

D-Link DIR-600L 信任管理问题漏洞

The D-Link DIR-600L is an entry-level wireless router from D-Link Corporation. It supports 150Mbps wireless transmission and has 4 Gigabit wired ports. The DIR-600L has a trust management vulnerability, which stems from a hard-coded telnet backdoor. This vulnerability could allow unauthenticated...

PT-2026-36833

Name of the Vulnerable Software and Affected Versions D-Link DIR-605L Hardware Revision A1 Description A hardcoded telnet backdoor exists where the device starts a telnet daemon at boot via the /bin/telnetd.sh script. The system uses a static username "Alphanetworks" and password "wrgn35 dlwbr...