CVE-2026-30829

Checkmate is an open‑source self‑hosted tool for monitoring server hardware and incidents. Before version 3.4.0, the GET /api/v1/status-page/:url endpoint exposes full status page details without authentication or published-page checks, allowing access to unpublished pages and internal data to an...

CVE-2026-30829 Checkmate: Unauthenticated Access to Unpublished Status Page

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url...

CVE-2026-30829 Checkmate: Unauthenticated Access to Unpublished Status Page

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url...

Incorrect Authorization

Overview grumpydictator/firefly-iii is a personal finances manager. Affected versions of this package are vulnerable to Incorrect Authorization via the index and show functions in the user management API endpoints, which lack proper role verification. An attacker can access sensitive information...

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

Summary The User management API endpoints GET /api/v1/users and GET /api/v1/users/id are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. Affected Endpoints 1. GET /api/v1/users UserController::index, line ...

Checkmate Information Leakage Vulnerability

Checkmate is an open-source, self-hosted tool developed by BlueWave. It aims to provide visually appealing real-time tracking and monitoring of server hardware, uptime, response times, and events. Versions of Checkmate prior to 3.4.0 contained a security vulnerability related to information...

CVE-2026-30829: Exposure of Sensitive Information to an Unauthorized Actor

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url...

PT-2026-23831

Name of the Vulnerable Software and Affected Versions Checkmate versions prior to 3.4.0 Description An unauthenticated information disclosure issue exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify if a status page is published before...

UptimeFlare information leakage vulnerability

UptimeFlare is a cloud-based website availability monitoring and status page software developed by lyc8503 as an individual developer. UptimeFlare has a vulnerability related to information leakage, which stems from the direct import of server-side configurations from client code, potentially...

CVE-2026-2371

Summary (CVE-2026-2371) The Greenshift – animation and page builder blocks WordPress plugin versions up to and including 12.8.3 are vulnerable to an insecure direct object reference in the gspb_el_reusable_load AJAX handler. The handler accepts an arbitrary post_id and renders the content of any ...

CVE-2026-2371

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the gspbelreusableload AJAX handler. The handler accepts an...

CVE-2026-3679

creationtimestamp| type| source ---|---|--- 2026-03-06 21:36:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116184381636813177 2026-03-07 22:15:47+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3679 2026-03-13 06:33:11+00:00| seen|...

CVE-2026-30843

creationtimestamp| type| source ---|---|--- 2026-03-06 21:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg7vhzc662u...

CVE-2026-29087

creationtimestamp| type| source ---|---|--- 2026-03-06 19:57:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg3uyapxa2o 2026-03-07 09:30:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghjdj5siw2v 2026-04-15 07:07:08+00:00| seen|...

CGA-W9HP-459Q-75Q3

Bulletin has no description...

CVE-2026-30831

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP...

GHSA-G8R9-G2V8-JV6F

creationtimestamp| type| source ---|---|--- 2026-03-06 17:10:06+00:00| seen| https://gist.github.com/alon710/4e3441e930710881f9a07d433f110f07...

CVE-2026-30869

creationtimestamp| type| source ---|---|--- 2026-03-06 08:41:37+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w 2026-03-10 00:00:59+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201936937270822...

CVE-2026-28682

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...

CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...