Tenda AC5 安全漏洞

Tenda AC5 is a wireless router produced by the Chinese company Tenda. Version 15.03.06.47 of Tenda AC5 contains a security vulnerability. This vulnerability stems from incorrect handling of the parameter “page” in the file/goform/addressNat component’s POST Request Handler, which may lead to a...

PT-2026-28666

Name of the Vulnerable Software and Affected Versions Tenda AC5 version 15.03.06.47 Description A flaw exists in the function formQuickIndex located in the file /goform/QuickIndex within the POST Request Handler component. Manipulation of the PPPOEPassword argument can lead to a stack-based buffe...

Mattermost 安全漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. There is a security vulnerability in Mattermost, which stems from the failure to clean up post content controlled by users. This vulnerability could allow attackers to manipulate administrator...

PT-2026-28203

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2s security nonce, both...

PT-2026-28193

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post content' of admin form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybe unserialize function without class restrictions on...

PT-2026-28245

qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter byCommentCreatedFrom and filter...

PT-2026-28665

Name of the Vulnerable Software and Affected Versions Tenda AC5 version 15.03.06.47 Description A flaw exists in the Tenda AC5 version 15.03.06.47 device. This issue is located within the POST Request Handler component, specifically in the fromAddressNat function of the /goform/addressNat file...

CVE-2026-33722

creationtimestamp| type| source ---|---|--- 2026-03-25 22:09:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw45lirag22 2026-03-26 03:00:16+00:00| seen| https://github.com/n8n-io/n8n/security/advisories/GHSA-58qr-rcgv-642v...

CVE-2026-33724

creationtimestamp| type| source ---|---|--- 2026-03-25 22:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw3un2mne2j 2026-03-26 03:00:16+00:00| seen| https://github.com/n8n-io/n8n/security/advisories/GHSA-58qr-rcgv-642v 2026-03-27 21:22:34+00:00| seen|...

CVE-2026-32513

creationtimestamp| type| source ---|---|--- 2026-03-25 22:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw3nmparc2j 2026-03-25 22:20:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw4pwp3c72h 2026-04-08 09:30:19+00:00| seen|...

EUVD-2026-14508

AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized userid Parameter...

GHSA-FFR8-FXHV-FV8H AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter

Summary The Subscribe::save method in objects/subscribe.php concatenates the $this-usersid property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from $POST'userid' in both subscribe.json.php and subscribeNotify.json.php. An authenticate...

CVE-2026-1001

creationtimestamp| type| source ---|---|--- 2026-03-25 21:49:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw2zrrx5k2q 2026-06-23 08:23:37+00:00| seen| https://gist.github.com/zanetworker/1c2f8d6638917ee25ed7da3865900455...

CVE-2026-32537

creationtimestamp| type| source ---|---|--- 2026-03-25 21:45:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw2qxwddv2w...

CVE-2026-32534

creationtimestamp| type| source ---|---|--- 2026-03-25 21:44:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw2ph2xz22s...

CVE-2026-30975

creationtimestamp| type| source ---|---|--- 2026-03-25 21:40:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw2joy5652w 2026-03-26 00:08:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwcrav7db2d 2026-03-30 19:40:09+00:00| seen|...

CVE-2026-33809

creationtimestamp| type| source ---|---|--- 2026-03-25 21:27:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhvzs7g4ex2d...

CVE-2026-33713

creationtimestamp| type| source ---|---|--- 2026-03-25 20:39:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhvx4dfsfe24 2026-03-26 03:00:16+00:00| seen| https://github.com/n8n-io/n8n/security/advisories/GHSA-58qr-rcgv-642v 2026-03-26 08:43:53+00:00| seen|...

CVE-2026-33980

creationtimestamp| type| source ---|---|--- 2026-03-25 20:38:27+00:00| published-proof-of-concept| https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp 2026-03-27 22:19:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35m2lzdf2m 2026-03-27...

curl: Security Vulnerability Report: Protocol Injection via Programmatic Options

Summary Multiple text-based protocol handlers in libcurl including FTP, SMTP, POP3, and IMAP are vulnerable to protocol command injection. This occurs when an application sets credentials or other protocol-specific options programmatically e.g., via CURLOPTUSERNAME, CURLOPTPASSWORD, or...