CVE-2026-34472

creationtimestamp| type| source ---|---|--- 2026-03-27 23:26:51+00:00| seen| https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 2026-04-08 17:40:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miytm3nifb2a 2026-05-20 14:34:56+00:00| seen|...

CVE-2019-25652

creationtimestamp| type| source ---|---|--- 2026-03-27 22:30:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi367qfys22s 2026-03-28 01:29:28+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mi3iaamanj2k...

CVE-2026-33907

creationtimestamp| type| source ---|---|--- 2026-03-27 22:22:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi35sa7cyt2n...

CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network service...

CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network service...

CVE-2026-33874

creationtimestamp| type| source ---|---|--- 2026-03-27 21:44:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi33nanktw2x 2026-03-27 23:27:39+00:00| seen| Telegram/rLqHCNltFCNj1PrF3FJbrFEjnsSClo3JgFDbDQ7L99dJsxY 2026-04-01 15:20:09+00:00| seen|...

CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

EUVD-2026-16870

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders...

CVE-2026-33875

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update...

CVE-2026-34205

creationtimestamp| type| source ---|---|--- 2026-03-27 21:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi2zau2fcs2x 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU 2026-03-28 03:00:13+00:00| seen|...

CVE-2026-33885

Statamic Open Redirect (CVE-2026-33885): Affected versions before 5.73.16 and before 6.7.2 have an issue where external URL detection for redirect validation on unauthenticated endpoints could be bypassed via URL parsing differentials. Impact is redirects to external URLs after actions like form ...

CVE-2026-4964

creationtimestamp| type| source ---|---|--- 2026-03-27 19:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2vse55qh2o...

CVE-2025-15617

creationtimestamp| type| source ---|---|--- 2026-03-27 19:44:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2uxim3mn2o 2026-09-03 12:00:05+00:00| seen| Telegram/wjGJNcgiCtazOObm08zBWnjh0cnGBFnktQF1xuBs3F9UCdI 2026-09-04 00:00:48+00:00| published-proof-of-concept|...

CVE-2026-28367

creationtimestamp| type| source ---|---|--- 2026-03-27 19:18:53+00:00| seen| Telegram/aqievDs9oCICHmk4C8wabuGpxUWUtlG5g0Gk9aIz6TfeTOo 2026-03-27 22:15:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35eyri5m2j 2026-04-10 15:07:08+00:00| seen|...

CVE-2026-30574

creationtimestamp| type| source ---|---|--- 2026-03-27 19:06:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2stc4bhr2i...

CVE-2026-34394

creationtimestamp| type| source ---|---|--- 2026-03-27 18:37:45+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01...

EUVD-2026-16727

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function convertmessagecreatetomessage of the file letta/helpers/messagehelper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request...

EUVD-2026-16704

A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Inventory System 1.0 in the viewcategory.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL...