CVE-2026-27301

creationtimestamp| type| source ---|---|--- 2026-04-15 00:06:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjilygpeht2z...

CVE-2026-34002

creationtimestamp| type| source ---|---|--- 2026-04-15 00:01:54+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjilqa5my42c 2026-04-15 00:01:58+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjilqdjg3t2u 2026-04-19 02:01:28+00:00| seen|...

Schneider Electric PowerChute Serial Shutdown Resource Management Error Vulnerability

Schneider Electric PowerChute Serial Shutdown is a UPS management, normal shutdown and energy management software from Schneider Electric France. Schneider Electric PowerChute Serial Shutdown suffers from a Resource Management Error vulnerability that stems from uncontrolled resource consumption,...

WordPress plugin Avada (Fusion) Builder 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-33013

Name of the Vulnerable Software and Affected Versions VI: Include Post By versions prior to 0.4.200706 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and...

WordPress plugin VI: Include Post By 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-32995

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusion get post custom field function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...

CVE-2026-1314 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sendpostpagesjson function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticat...

Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

Summary The conditions filter webhook at libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts line 261 sends POST requests to user-configured URLs using raw axios.post with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses...

CVE-2026-35196

creationtimestamp| type| source ---|---|--- 2026-04-14 23:22:29+00:00| published-proof-of-concept| Telegram/70ang71mEb6lYSNq2VZHiuuV7i7KfipPcLMkKoGk9-znXQ 2026-04-15 12:08:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjudrmv7g2u...

CVE-2026-41060

creationtimestamp| type| source ---|---|--- 2026-04-14 23:22:01+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-j432-4w3j-3w8j 2026-04-21 23:22:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk24rzao262t 2026-04-22 01:19:03+00:00| seen|...

CVE-2026-27282

creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 01:56:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjis4gfiax2a 2026-04-15 12:08:47+00:00| seen|...

CVE-2026-24893

creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:40+00:00| published-proof-of-concept| Telegram/vFalP9cCg-kFoPrSdHM4ZH4qnLHRdngXJCuq8FbW2RkF4k 2026-04-15 14:09:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjk34nm6dl24 2026-04-28 18:07:07+00:00| seen|...

CVE-2026-35034 Jellyfin: Potential Application DoS from excessively large SyncPlay group names

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...

CVE-2026-35034

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...

CVE-2026-35034

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...

CVE-2026-35034

CVE-2026-35034 affects Jellyfin before 10.11.7, where an authenticated user can abuse the SyncPlay group creation endpoint (POST /SyncPlay/New) due to insufficient input validation. By sending large payloads (with arbitrary group IDs), an attacker can cause high memory usage and lock out other cl...

CVE-2026-27313

creationtimestamp| type| source ---|---|--- 2026-04-14 21:25:42+00:00| published-proof-of-concept| Telegram/YBv3RW-vRVGMDDlTI6JsAJBRTWorFJbZdjQQujfRdi3MBhU 2026-04-15 14:18:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjk3ltl55n2f 2026-06-11 14:37:06+00:00| seen|...

CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...

CVE-2026-34161 Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...