49802 matches found
CVE-2026-92000
creationtimestamp| type| source ---|---|--- 2026-09-15 22:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlmqp54zu2m...
CVE-2026-54544
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...
CVE-2026-87287
creationtimestamp| type| source ---|---|--- 2026-09-15 21:03:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvljkoglcz2z...
CVE-2026-87286
creationtimestamp| type| source ---|---|--- 2026-09-15 21:01:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvljh2lpuk2b...
CVE-2026-88975
creationtimestamp| type| source ---|---|--- 2026-09-15 21:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvljgt7w5m2s...
CVE-2026-81925
Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...
CVE-2026-19885
creationtimestamp| type| source ---|---|--- 2026-09-15 20:13:27+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvlgrj64du2g...
CVE-2026-19781
creationtimestamp| type| source ---|---|--- 2026-09-15 20:13:25+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvlgrhiprk2z...
EUVD-2026-79939
Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...
EUVD-2026-79672
Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...
CVE-2026-89040
Tencent Mass Service Engine in Cluster (MSEC) is affected by a path traversal vulnerability that allows a remote, unauthenticated attacker to send a crafted POST request containing ../, gaining root access on the target device. An attacker who uploads a webshell can then execute arbitrary code as...
CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) path traversal
Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...
CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) path traversal
Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...
CVE-2026-81924
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...
CVE-2026-58483
creationtimestamp| type| source ---|---|--- 2026-09-15 19:11:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ijvgmephozgs4...
Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w39f-h553-h2mx. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task...
Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate...
CVE-2026-63443
creationtimestamp| type| source ---|---|--- 2026-09-15 18:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvl7gf4kyf2s...