Missing Authentication for Critical Function

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the status.json.php and disable.json.php endpoints when the authentication key is left at its default empty value. ...

CVE-2026-33751

creationtimestamp| type| source ---|---|--- 2026-03-25 21:40:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw2j5sxx525...

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Summary When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue...

GHSA-94XM-JJ8X-3CR4 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Summary When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue...

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

Summary The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and...

GHSA-M99F-MMVG-3XMX AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

Summary The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and...

EUVD-2026-14498

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint...

Cross-site Request Forgery (CSRF)

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the UpdateAccessControlPolicyActiveStatus endpoint. An attacker can change the active status of access control...

EUVD-2026-15806

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

Mattermost doesn't properly validate CSRF tokens

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-27659

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

CVE-2026-27659

Mattermost CSRF in UpdateAccessControlPolicyActiveStatus: versions 11.2.x ≤ 11.2.2, 10.11.x ≤ 10.11.10, 11.4.x ≤ 11.4.0, 11.3.x ≤ 11.3.1 fail to validate CSRF tokens on /api/v4/access_control_policies/{policy_id}/activate, enabling an attacker to trick an admin into changing an access control pol...

CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-33992

creationtimestamp| type| source ---|---|--- 2026-03-25 13:09:33+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-m74m-f7cr-432x 2026-03-28 01:18:50+00:00| seen| Telegram/DQ8Phmkx05Q1rHpnB8sJ1vhC9dSxcFzzTf0RtJAOAn3w7JQ 2026-03-28 02:13:28+00:00| seen|...

CVE-2026-28859

creationtimestamp| type| source ---|---|--- 2026-03-25 07:28:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116288631079391237 2026-03-27 04:46:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116299318674903445...

CVE-2026-28858

creationtimestamp| type| source ---|---|--- 2026-03-25 06:20:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116288365225347899 2026-03-29 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/ 2026-04-06 18:00:04+00:00| seen| https://t.me/GithubRedTeam/79...

CVE-2026-4696

creationtimestamp| type| source ---|---|--- 2026-03-25 04:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhu7cz6h4i22 2026-03-26 11:43:17+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhxjlxpqna2k 2026-03-29 17:00:00+00:00| seen|...

CVE-2026-4721

creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260325 2026-03-25 04:01:28+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhu7d6hbhv2w 2026-03-29 17:00:00+00:00| seen|...