EUVD-2026-20586

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any us...

GHSA-8RH5-4MVX-XJ7J CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

Summary The install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss TTL expiry or admin-triggered cache clear, the...

Cross-site Scripting (XSS)

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ajaxblackListpost process. An attacker can execute arbitrary JavaScript in the browser of other administrators by injecting malicious inpu...

CVE-2025-30650

creationtimestamp| type| source ---|---|--- 2026-04-08 19:10:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyyn3qqzs2t 2026-04-09 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/juniper-junos-os-multiple-vulnerabilities20260410...

CVE-2026-2377

creationtimestamp| type| source ---|---|--- 2026-04-08 18:36:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miywq2boeq23 2026-07-01 14:19:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplplgfo4n26...

CVE-2026-31040

creationtimestamp| type| source ---|---|--- 2026-04-08 17:56:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyuk5bpod25...

CVE-2026-0688

creationtimestamp| type| source ---|---|--- 2026-04-08 17:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miyt25axco2w...

CVE-2026-33229

creationtimestamp| type| source ---|---|--- 2026-04-08 16:00:21+00:00| seen| https://infosec.exchange/users/offseq/statuses/116369917209946972 2026-04-08 16:00:23+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3miynznv7la2f 2026-04-08 17:17:30+00:00| seen|...

CVE-2026-5795

creationtimestamp| type| source ---|---|--- 2026-04-08 14:57:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miykitb4ng2t 2026-04-08 15:16:41+00:00| seen| Telegram/Jgs5105KRNeeN6Me9oFeQT01tz9bvpQqKtTaGf0YvrxH7I 2026-04-20 11:54:00+00:00| seen|...

CVE-2026-1865

creationtimestamp| type| source ---|---|--- 2026-04-08 14:37:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyjg536k62t...

CVE-2026-28264

creationtimestamp| type| source ---|---|--- 2026-04-08 14:35:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyjbaoxui2z 2026-04-09 02:29:14+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mizr665myz26...

CVE-2026-39393

CVE-2026-39393 affects the ci4ms CodeIgniter 4-based CMS skeleton. Before 0.31.4.0, the install route guard uses a volatile cache check (cache('settings')) and .env existence to block setup access; if the database is temporarily unreachable during a cache miss, the guard can fail open, allowing a...

CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block...

CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block...

CVE-2026-39391 CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist ban note parameter in UserController::ajaxblackListpost is stored in the database without sanitization and rendered into a...

CVE-2026-32540

creationtimestamp| type| source ---|---|--- 2026-04-08 13:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miyfmzazry2h...

CVE-2026-39412

creationtimestamp| type| source ---|---|--- 2026-04-08 13:25:48+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv 2026-04-08 22:26:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizdmcxlbw2i...

CVE-2026-0232

creationtimestamp| type| source ---|---|--- 2026-04-08 13:04:52+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-331 2026-04-08 19:03:32+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3miyyb76lmf2p 2026-04-13 10:57:52+00:00| seen|...

EUVD-2026-20453

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-3396

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...