27160 matches found
CVE-2025-62126
creationtimestamp| type| source ---|---|--- 2026-03-26 09:21:07+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-62126.yaml 2026-03-30 21:03:05+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mickqnddkr2a...
CVE-2026-23343
creationtimestamp| type| source ---|---|--- 2026-03-26 07:06:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116294206546463815 2026-03-27 03:49:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116299094510404574 2026-03-29 17:00:00+00:00| seen|...
CVE-2026-4389
creationtimestamp| type| source ---|---|--- 2026-03-26 04:16:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4389...
CVE-2025-14684
creationtimestamp| type| source ---|---|--- 2026-03-26 00:01:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwcevm4vk2n...
Grafana Tempo security vulnerabilities
Grafana Tempo is a distributed tracking data storage and querying system developed by Grafana in open source. There is a security vulnerability in Grafana Tempo, which stems from the /status/config endpoint exposing the S3 SSE-C encryption key in plain text. This could allow unauthorized users to...
Linux Distros Unpatched Vulnerability : CVE-2026-4923
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtrackin...
CVE-2026-28377: Inadequate Encryption Strength
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to williamgoodfellow for reporting this vulnerability...
GHSA-R64R-883R-WCWH AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
Summary The CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured the default state, the key validation check is completely bypassed, allowin...
Missing Authentication for Critical Function
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the status.json.php and disable.json.php endpoints when the authentication key is left at its default empty value. ...
CVE-2026-33751
creationtimestamp| type| source ---|---|--- 2026-03-25 21:40:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw2j5sxx525...
GHSA-94XM-JJ8X-3CR4 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
Summary When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue...
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
Summary When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue...
GHSA-M99F-MMVG-3XMX AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
Summary The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and...
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
Summary The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and...
EUVD-2026-14498
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint...
Cross-site Request Forgery (CSRF)
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the UpdateAccessControlPolicyActiveStatus endpoint. An attacker can change the active status of access control...
EUVD-2026-15806
Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...
Mattermost doesn't properly validate CSRF tokens
Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...
CVE-2026-27659
Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...
tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation
A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...