CVE-2025-65112Critical· 9.4▾ MidnightPubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.
pubnet < 1.1.4Upgrade past the affected range:
pubnet 1.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102503Critical· 9.3Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
CVE-2026-103091Critical· 9.3Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
CVE-2026-102748Critical· 9.2Dgraph is an open source distributed GraphQL database
CVE-2025-61777Critical· 9.4Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-14567Medium· 5.3A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0
CVE-2025-14038High· 7.0EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints