CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

EUVD-2026-16870

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

CVE-2026-33875

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update...

CVE-2026-34205

creationtimestamp| type| source ---|---|--- 2026-03-27 21:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi2zau2fcs2x 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU 2026-03-28 03:00:13+00:00| seen|...

CVE-2026-33885

Statamic Open Redirect (CVE-2026-33885): Affected versions before 5.73.16 and before 6.7.2 have an issue where external URL detection for redirect validation on unauthenticated endpoints could be bypassed via URL parsing differentials. Impact is redirects to external URLs after actions like form ...

CVE-2026-4964

creationtimestamp| type| source ---|---|--- 2026-03-27 19:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2vse55qh2o...

CVE-2025-15617

creationtimestamp| type| source ---|---|--- 2026-03-27 19:44:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2uxim3mn2o 2026-09-03 12:00:05+00:00| seen| Telegram/wjGJNcgiCtazOObm08zBWnjh0cnGBFnktQF1xuBs3F9UCdI 2026-09-04 00:00:48+00:00| published-proof-of-concept|...

CVE-2026-28367

creationtimestamp| type| source ---|---|--- 2026-03-27 19:18:53+00:00| seen| Telegram/aqievDs9oCICHmk4C8wabuGpxUWUtlG5g0Gk9aIz6TfeTOo 2026-03-27 22:15:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35eyri5m2j 2026-04-10 15:07:08+00:00| seen|...

CVE-2026-30574

creationtimestamp| type| source ---|---|--- 2026-03-27 19:06:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2stc4bhr2i...

CVE-2026-34394

creationtimestamp| type| source ---|---|--- 2026-03-27 18:37:45+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01...

EUVD-2026-16727

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function convertmessagecreatetomessage of the file letta/helpers/messagehelper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request...

EUVD-2026-16704

A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Inventory System 1.0 in the viewcategory.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2026-33938

creationtimestamp| type| source ---|---|--- 2026-03-27 18:20:44+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-3mfm-83xf-c92r 2026-03-27 21:38:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi33d7jqdq2s 2026-03-27 22:25:00+00:00| seen|...

CVE-2026-30567

A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the viewproduct.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL...

EUVD-2026-16886

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration...

CVE-2026-34381

creationtimestamp| type| source ---|---|--- 2026-03-27 17:29:42+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01...

CVE-2026-25026

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:05+00:00| seen| Telegram/0TkjLsQfxXDhGLxRci6Ro2HiEhTKYRR1p268AcWiw3KWvWE 2026-04-07 07:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mivb2dxf262l...

CVE-2026-32859

creationtimestamp| type| source ---|---|--- 2026-03-27 16:27:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2jxm35fy2z...

CVE-2026-4621

creationtimestamp| type| source ---|---|--- 2026-03-27 16:14:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2jab2g4j2t 2026-04-02 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN89339669/...