https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:40:05 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-21641 <p>HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.</p> <p>HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-21641 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0227 <p><strong>Affected:</strong> unknown Revive Adserver Vulnerabilities</p> <p>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-001 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-001 ------------------------------------------------------------------------ Date: 2026-01-14 Risk Level: High Applications affected: Revive Adserver Versions affected: &lt;= 6.0.4 Versions not affected: &gt;= 6.0.5 Website: https://www.revive-adserver.com/ ========================================================================</p> <p>======================================================================== Vulnerability 1: Format string injection ======================================================================== Vulnerability Type: Use of Externally-Controlled Format String [CWE-134] CVE-ID: CVE-2026-21640 Risk level: Low CVSS Base Score: 2.7 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L ========================================================================</p> <p>Description -----------</p> <p>Details -------</p> <p>References ---------- https://hackerone.com/reports/3445332 https://github.com/revive-adserver/revive-adserver/commit/c40187d8 https://cwe.mitre.org/data/definitions/134.html</p> <p>======================================================================== Vulnerability 2: Authorization Bypass…</p> <p><strong>Affected:</strong> unknown Revive Adserver Vulnerabilities</p> <p>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-001 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-001 ------------------------------------------------------------------------ Date: 2026-01-14 Risk Level: High Applications affected: Revive Adserver Versions affected: &lt;= 6.0.4 Versions not affected: &gt;= 6.0.5 Website: https://www.revive-adserver.com/ ========================================================================</p> <p>======================================================================== Vulnerability 1: Format string injection ======================================================================== Vulnerability Type: Use of Externally-Controlled Format String [CWE-134] CVE-ID: CVE-2026-21640 Risk level: Low CVSS Base Score: 2.7 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L ========================================================================</p> <p>Description -----------</p> <p>Details -------</p> <p>References ---------- https://hackerone.com/reports/3445332 https://github.com/revive-adserver/revive-adserver/commit/c40187d8 https://cwe.mitre.org/data/definitions/134.html</p> <p>======================================================================== Vulnerability 2: Authorization Bypass…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0227 https://vulnerability.circl.lu/vuln/ghsa-2prx-vw7r-hjgr <p>HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.</p> <p>HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.</p> https://vulnerability.circl.lu/vuln/ghsa-2prx-vw7r-hjgr