CVE-2026-33143 OneUptime: WhatsApp Webhook Missing Signature Verification

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any...

GHSA-VQ4Q-79HH-Q767 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

Summary A flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The ResetPassword function sets the user’s status to StatusActive after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token...

CVE-2026-33482

creationtimestamp| type| source ---|---|--- 2026-03-20 14:59:56+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c 2026-03-23 15:28:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqereajdu2p 2026-03-23 16:15:54+00:0...

RUSTSEC-2026-0049 CRLs not considered authoritative by Distribution Point due to faulty matching logic

If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored. The impact was that correctly provided CRLs wou...

CRLs not considered authoritative by Distribution Point due to faulty matching logic

If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored. The impact was that correctly provided CRLs wou...

CVE-2026-3550 RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions

The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missing capability checks on multiple AJAX actions rockpressimport, rockpressimportstatus, rockpresslastimport, rockpressresetimport, and rockpresscheckservices...

MINI-P92P-H48P-6PMR

Bulletin has no description...

CVE-2026-4455

creationtimestamp| type| source ---|---|--- 2026-03-20 06:55:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116260189773239032 2026-03-22 02:33:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhmizkjhtl2h 2026-03-22 02:34:21+00:00| seen|...

CVE-2026-33024

creationtimestamp| type| source ---|---|--- 2026-03-20 06:01:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116259978430738520 2026-03-20 06:01:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mhhtpbx2qi2n 2026-03-20 06:04:20+00:00| seen|...

CVE-2026-21992

creationtimestamp| type| source ---|---|--- 2026-03-20 06:01:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116259977375105317 2026-03-20 13:05:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhilf4nf2c2s 2026-03-20 13:09:35+00:00| seen|...

CVE-2026-31805 Discourse has a poll authorization bypass via post_id array parameter

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing...

CVE-2026-31805 Discourse has a poll authorization bypass via post_id array parameter

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing...

CVE-2026-31805 Discourse has a poll authorization bypass via post_id array parameter

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing...

CVE-2026-32765

This repository is no longer public...

PT-2026-26753

Name of the Vulnerable Software and Affected Versions Vikunja affected versions not specified Description A flaw in the password reset logic allows disabled users to regain access to their accounts. The ResetPassword function sets the user’s status to StatusActive after a successful password rese...

OneUptime 数据伪造问题漏洞

OneUptime is a comprehensive solution developed by OneUptime OpenSource. It is used to monitor and manage your online services. Versions of OneUptime prior to 10.0.34 contained a data manipulation vulnerability. This vulnerability stemmed from the WhatsApp POST webhook processor not verifying the...

Fixed in Apache Tomcat 9.0.116

Moderate: The fix forCVE-2025-66614 was incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. This was fixed with commit 95f77782. This issue was reported to the Tomcat security team o...

Linux Distros Unpatched Vulnerability : CVE-2026-4453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...

PT-2026-26542

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2 Description Discourse is an open-source discussion platform. An authorization bypass in the poll plugin allowed authenticat...

Fixed in Apache Tomcat 11.0.20

Moderate: The fix forCVE-2025-66614 was incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. This was fixed with commit 021d1f83. This issue was reported to the Tomcat security team o...