CVE-2026-57947

creationtimestamp| type| source ---|---|--- 2026-06-29 18:33:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph4skkzjk25 2026-06-29 21:15:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphfujgoba2o 2026-06-29 21:53:41+00:00| seen|...

CVE-2025-70100

creationtimestamp| type| source ---|---|--- 2026-06-29 18:33:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mph4s5nizo2y...

CVE-2026-39459

creationtimestamp| type| source ---|---|--- 2026-06-29 18:18:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph3y7zccz2n...

CVE-2026-57945

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...

CVE-2026-13589

creationtimestamp| type| source ---|---|--- 2026-06-29 17:54:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2nhql4y2g 2026-06-29 20:10:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphcavhuog2q 2026-06-29 20:44:29+00:00| seen|...

CVE-2026-13752

creationtimestamp| type| source ---|---|--- 2026-06-29 17:53:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2ktndmm2d 2026-06-29 18:34:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph4tvl67r2d 2026-06-29 20:06:28+00:00| seen|...

CVE-2026-12912

creationtimestamp| type| source ---|---|--- 2026-06-29 17:51:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2hxypn322 2026-06-29 20:20:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphcssleox2p 2026-07-03 17:50:34+00:00| seen|...

CVE-2026-13591

creationtimestamp| type| source ---|---|--- 2026-06-29 17:50:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2geoxdw2t 2026-06-29 18:48:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5ngctor23 2026-06-29 20:35:47+00:00| seen|...

CVE-2026-13588

creationtimestamp| type| source ---|---|--- 2026-06-29 17:50:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2fqub6f2o 2026-06-29 20:02:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphbsix7rl2h 2026-06-29 20:38:53+00:00| seen|...

CVE-2026-13582

creationtimestamp| type| source ---|---|--- 2026-06-29 17:32:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgzgdp5gw2o 2026-06-29 20:32:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphdi2rf6h23 2026-06-29 22:14:12+00:00| seen|...

CVE-2025-20272

creationtimestamp| type| source ---|---|--- 2026-06-29 17:31:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgzdmybk62o...

CVE-2026-57952

Mythic before 3.4.0.60 contains an authorization bypass in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpo...

CVE-2026-57952

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

CVE-2026-57952 Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

EUVD-2026-40169

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

CVE-2026-57952 Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

CVE-2026-57945

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...

CVE-2026-57945

Summary of CVE-2026-57945 (PhotoPrism) : A broken access control flaw in PhotoPrism prior to 260601-a7d098548 allows authenticated non-admin users to modify other users’ profile information by exploiting the PUT /api/v1/users/{uid} endpoint. The root cause is missing validation that ties the sess...

CVE-2026-57945 PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...

CVE-2026-57945 PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...