Joomla! Component User Status - Local File Inclusion

A directory traversal vulnerability in userstatus.php in the User Status comuserstatus component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1304 info: name: Joomla! Component User Status - Local File...

CVE-2026-22746 User Attribute Enumeration when Using DaoAuthenticationProvider

Vulnerability in Spring Spring Security. If an application is using the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, o...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the Connected Workspaces API. An attacker can change the displayed status of local users by connecting a malicious remote server using the Connected Workspaces feature. Remediation Upgrade...

CVE-2026-27769

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

CVE-2026-40683

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the userenabledinvert configuration option is False the default. The ldaprestomodel method in the UserApi class only performed string-to-boolean conversion when...

PT-2026-32021

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update user from username endpoint. A student status=5 can change their status to Teacher/CourseManager status=1, gaining course creation and...

CVE-2026-2571

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

PT-2026-27445

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.18.0 through 2.2.0 Description Vikunja is a self-hosted task management platform. When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. The API tokens,...

EUVD-2026-13065

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Discord security vulnerabilities

Discord is a free chat service provided by the Discord company. Versions of Discord dated January 16, 2026 and earlier have security vulnerabilities. These vulnerabilities stem from the WebSocket API responding with status information about hidden users, which may lead to the inference of a user’...

GO-2026-4295 Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server...

CVE-2020-12472

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...

GHSA-JC3F-C62G-V7QW

creationtimestamp| type| source ---|---|--- 2026-01-07 17:39:28+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115855036756832399...

CVE-2020-36905

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 16:37:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrf7a6mfw2y 2026-01-07 21:03:03+00:00| seen|...

CVE-2025-66911

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...

CVE-2025-56083

creationtimestamp| type| source ---|---|--- 2025-12-11 18:33:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115702365711663519...

GHSA-4C65-9GQF-4W8H

creationtimestamp| type| source ---|---|--- 2025-12-11 17:18:35+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115702072250790374...

CVE-2025-13809

creationtimestamp| type| source ---|---|--- 2025-12-01 06:04:16+00:00| seen| https://infosec.exchange/users/offseq/statuses/115642797535662438...

GHSA-JHJX-X4CF-4VM8

creationtimestamp| type| source ---|---|--- 2025-11-04 21:45:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115493614774031888...

GHSA-2RRC-F24F-94F6

creationtimestamp| type| source ---|---|--- 2025-10-23 16:27:22+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115424417623809144...