112844 matches found
CVE-2026-4903
creationtimestamp| type| source ---|---|--- 2026-03-27 00:36:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyuryxdch2o 2026-03-27 01:18:44+00:00| published-proof-of-concept| Telegram/iwwl46KpLYwipkJFr9bJW43ngNWdoc7X8GY9RAN-oHOG28 2026-03-31 23:20:09+00:00| seen|...
DEBIAN-CVE-2026-33898
Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by incus webui incorrectly validates the authentication token such that an invalid value will be accepted. incus webui runs a local web server on a random localhost port. For authentication, i...
Clickedu 跨站脚本漏洞
Clickedu is an academic management platform operated by Clickedu Corporation. Clickedu has a cross-site scripting vulnerability. This vulnerability stems from a reflective cross-site scripting flaw in the endpoint/user.php file. It may allow attackers to execute JavaScript code in the victim’s...
PT-2026-28724
A reflected Cross-Site Scripting XSS vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user...
PT-2026-28670
Name of the Vulnerable Software and Affected Versions Page-Replica Page Replica versions prior to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0 Description A server-side request forgery SSRF issue exists in the sitemap.fetch function within the /sitemap file of the Endpoint component. Manipulation of...
CVE-2026-30567
CVE-2026-30567 describes a reflected XSS in SourceCodester Sales and Inventory System 1.0, specifically in the view_product.php script via the input parameter “limit.” The root cause is lack of input sanitization, allowing an attacker to inject arbitrary script or HTML through a crafted URL. The ...
AlmaLinux 9 : golang (ALSA-2026:5942)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:5942 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...
RockyLinux 10 : yggdrasil-worker-package-manager (RLSA-2026:5145)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:5145 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 Tenable has extracted the preceding description block directly from the...
RockyLinux 10 : yggdrasil (RLSA-2026:5146)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:5146 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 golang: net/url: Memory exhaustion i...
CVE-2026-30637
CVE-2026-30637 is an SSRF vulnerability in OTCMS prior to V7.66, affecting the AnnounContent in /admin/read.php. The issue allows unauthenticated attackers to craft HTTP requests to internal or arbitrary remote URLs. The CVSS v3.1 base score is 7.5 (HIGH) with network access, low attack complexit...
CVE-2026-30567
A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the viewproduct.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL...
PT-2026-28704
Name of the Vulnerable Software and Affected Versions Twilio integration affected versions not specified Description The Twilio integration webhook handler improperly validates requests, accepting any POST request without verifying the 'X-Twilio-Signature' header. When handling media messages, th...
PT-2026-28614
Name of the Vulnerable Software and Affected Versions Happy DOM versions prior to 20.8.9 Description Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, has an issue where it may attach cookies from the current page origin instead of the request target URL...
PT-2026-28633
Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 8.0.1 Varnish Enterprise versions prior to 6.0.16r12 Description The software may improperly handle URLs with a path of '/' for HTTP/1.1 in certain unchecked request URL scenarios. This could potentially lead to...
Linux Distros Unpatched Vulnerability : CVE-2026-33898
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by incus webui incorrectly validates the authentication...
CVE-2025-41359
creationtimestamp| type| source ---|---|--- 2026-03-26 23:55:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhysjmjlib2c...
CVE-2026-33640
creationtimestamp| type| source ---|---|--- 2026-03-26 23:16:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyqdbay5k2g 2026-03-26 23:19:48+00:00| seen| Telegram/lYHJ2uqEkk9SWNnUth8Z9R1ezNKbfqND5wGUosjkyCOBSr0...
CVE-2026-33399
creationtimestamp| type| source ---|---|--- 2026-03-26 22:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhyockhqr32f 2026-05-07 18:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbsmrbmxi2c...
OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals
Summary Google Chat app-url webhook verification accepted add-on principals outside the intended deployment binding. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 630f1479c44f78484dfa21bb407cbe6f171dac87 - Latest published...
CVE-2026-26213
creationtimestamp| type| source ---|---|--- 2026-03-26 21:36:23+00:00| seen| Telegram/qpJXIfLucPvhQtEDSHE7IdszXR3MHRZbZWkV9-ESfqWxnI 2026-03-26 23:11:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyq2cru5l2d...