CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

OCSP result bypass in stream

OCSP result bypass in stream Severity: medium CVE-2026-28755 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 1.27.2-1.29.6...

CVE-2026-28755

CVE-2026-28755 affects both NGINX Plus and NGINX Open Source via the ngx_stream_ssl_module . The vulnerability arises from improper handling of revoked certificates when ssl_verify_client is enabled and ssl_ocsp is on, causing the TLS handshake to succeed even after an OCSP revocation check ident...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2025-41660

creationtimestamp| type| source ---|---|--- 2026-03-24 07:16:00+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-41660 2026-03-24 07:47:49+00:00| seen| https://infosec.exchange/users/certvde/statuses/116283045909330832 2026-03-24 10:33:13+00:00| seen|...

CVE-2026-4744

creationtimestamp| type| source ---|---|--- 2026-03-24 03:17:32+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4744 2026-03-24 04:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116282270051137305 2026-03-24 04:30:33+00:00| seen|...

CVE-2026-4673

creationtimestamp| type| source ---|---|--- 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260324 2026-03-24 01:32:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116281570422735585 2026-03-24 02:43:18+00:00| seen|...

CVE-2026-4678

creationtimestamp| type| source ---|---|--- 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260324 2026-03-24 02:00:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116281679016564532 2026-03-24 02:24:21+00:00| seen|...

PT-2026-27433

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description The ngx stream ssl module module contains an issue with the improper handling of revoked certificates. When configured with the ssl verify...

PT-2026-27445

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.18.0 through 2.2.0 Description Vikunja is a self-hosted task management platform. When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. The API tokens,...

CVE-2026-33290 WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permission

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment allows an authenticated low-privileged user including a custom role with zero capabilities to change moderation status of their own comment for example to APPROVE without the...

CVE-2026-23482

creationtimestamp| type| source ---|---|--- 2026-03-23 22:54:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr5puj2272f 2026-04-27 12:07:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-23482.yaml...

CVE-2026-32910

This CVE ID has been rejected...

CVE-2026-32066

This CVE ID has been rejected...

CVE-2026-32012

This CVE ID has been rejected...

CVE-2026-28483

This CVE ID has been rejected...

CVE-2026-28455

This CVE ID has been rejected...

CVE-2026-33688

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames a...

CVE-2026-33719 AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured...