https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T05:43:57.322681+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335639 EUVD-2026-335639 2026-10-10T05:43:57.324960+00:00 EUVD-2026-335639 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57994 fkie_cve-2026-57994 2026-10-10T05:43:57.324993+00:00

phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content. Specifically, GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer, while GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return the inactive FAQ title and answer preview, disclosing non-public content.

 https://cve.radiocsirt.org/vuln/ghsa-7582-hcc6-fvcg GHSA-7582-hcc6-fvcg 2026-10-10T05:43:57.325025+00:00

phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content. Specifically, GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer, while GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return the inactive FAQ title and answer preview, disclosing non-public content.