24815 matches found
GHSA-GQW4-4W2P-838Q
creationtimestamp| type| source ---|---|--- 2026-04-15 23:27:35+00:00| seen| Telegram/ajbOyvFAewWZ2L70l5GRQuj2wRnDYaN4zfpEHfJh7NMuY...
GHSA-855C-R2VQ-C292
creationtimestamp| type| source ---|---|--- 2026-04-15 23:26:09+00:00| seen| Telegram/uDqb5UNOJD19g19jmJKdnJBBrEUml8WxLQrnFn708j03zpg...
CVE-2026-6398
creationtimestamp| type| source ---|---|--- 2026-04-15 22:16:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkwcfxaei2a...
NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
A flaw was found in NGINX, specifically within its ngxstreamsslmodule. When NGINX is configured to verify client certificates and use the Online Certificate Status Protocol OCSP for revocation checks, it fails to properly enforce the revocation status. This allows a Transport Layer Security TLS...
CVE-2026-33708
Chamilo LMS is a learning management system. Prior to 1.11.38, the getuserinfofromusername REST API endpoint returns personal information email, first name, last name, user ID, active status of any user to any authenticated user, including students. There is no authorization check. This...
GHSA-78X4-6X83-JX75
creationtimestamp| type| source ---|---|--- 2026-04-15 19:21:23+00:00| seen| Telegram/7Ck-SXA1c6Vf9FqVW81avKVix-fYO39OzelndhESQPxXBQ...
CVE-2026-6310
creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 21:12:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjksqevtfj2z 2026-04-15 23:26:54+00:00|...
tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation
A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...
CVE-2026-23772
creationtimestamp| type| source ---|---|--- 2026-04-15 17:14:00+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116409843068495690 2026-04-16 11:16:12+00:00| seen| Telegram/j-zpZhFSipqPFVaOoufvpDRNhg2whahduAHfYT4AdF4gH4...
CVE-2026-27769
Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...
CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...
CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...
CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...
CVE-2026-27769
Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...
CVE-2026-27769
Mattermost CVE-2026-27769 affects Mattermost 10.11.x up to 10.11.12 where the Connected Workspaces feature does not validate that users are correctly owned by the target Connected Workspace. This allows a malicious remote server connected via the Connected Workspaces API to change the displayed s...
SUSE CVE-2026-3842
A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpuphysicalmemorymap returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in...
CVE-2026-40090
creationtimestamp| type| source ---|---|--- 2026-04-15 04:31:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjj2rvphkr2z 2026-04-17 17:30:37+00:00| published-proof-of-concept| Telegram/99IlCPIS9qBv42yzAhiUHqlKgiNRb4WP8dx5pH1uskzhuw...
WordPress Nexi XPay plugin <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification vulnerability
Missing Authorization to Unauthenticated Order Status Modification vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Nexi XPay versions = 8.3.0...