https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T17:40:05.386558+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-21641 fkie_cve-2026-21641 2026-10-03T17:40:06.508795+00:00

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0227 GCVE-1988-2026-0227 — [REVIVE-SA-2026-001] Revive Adserver Vulnerabilities 2026-10-03T17:40:06.508919+00:00

Affected: unknown Revive Adserver Vulnerabilities

======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-001 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-001 ------------------------------------------------------------------------ Date: 2026-01-14 Risk Level: High Applications affected: Revive Adserver Versions affected: <= 6.0.4 Versions not affected: >= 6.0.5 Website: https://www.revive-adserver.com/ ========================================================================

======================================================================== Vulnerability 1: Format string injection ======================================================================== Vulnerability Type: Use of Externally-Controlled Format String [CWE-134] CVE-ID: CVE-2026-21640 Risk level: Low CVSS Base Score: 2.7 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L ========================================================================

Description -----------

Details -------

References ---------- https://hackerone.com/reports/3445332 https://github.com/revive-adserver/revive-adserver/commit/c40187d8 https://cwe.mitre.org/data/definitions/134.html

======================================================================== Vulnerability 2: Authorization Bypass…

 https://vulnerability.circl.lu/vuln/ghsa-2prx-vw7r-hjgr GHSA-2prx-vw7r-hjgr 2026-10-03T17:40:06.509044+00:00

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.