Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Summary When the Timeoutable module is enabled in Devise, the FailureAppredirecturl method returns request.referrer — the HTTP Referer header, which is attacker-controllable — without validation for any non-GET request that results in a session timeout. An attacker who hosts a page with an...

GHSA-J944-W549-3453 Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for...

Origin Validation Error

Overview cinny is a Yet another matrix client Affected versions of this package are vulnerable to Origin Validation Error in the process that handles emoji pack avatar URLs in the service worker. An attacker can obtain a victim's access token by crafting a malicious emote pack with an...

CVE-2026-6002

creationtimestamp| type| source ---|---|--- 2026-05-07 15:31:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbjwvxqko2c 2026-05-07 19:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlbvm7lg442f 2026-09-12 10:00:13+00:00| seen|...

CVE-2026-7413

creationtimestamp| type| source ---|---|--- 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7413/ 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7414/ 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7415/ 2026-05-07 19:36:35+00:00| seen|...

CVE-2026-44407

creationtimestamp| type| source ---|---|--- 2026-05-07 13:49:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbe7yrvv62v...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.23 LTS and 13.1.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: IBM App Connect Enterprise Certified Container backup and restore is vulnerable to authorization bypass (CVE-2026-33186)

Summary gRPC-Go is used by the IBM App Connect Enterprise Certified Container Velero image. IBM App Connect Enterprise Certified Container deployments that use Velero for backup and restore are vulnerable to authorization bypass. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality (CVE-2025-62718)

Summary Node.js module axios is used by IBM App Connect Enterprise Certified Container for HTTP communications. IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)

Summary Node.js module handlebars is used by all IBM App Connect Enterprise Certified Container operands. IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941 and denial of service...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to loss of confidentiality (CVE-2026-39892, CVE-2026-34073) and arbitrary code execution (CVE-2026-40087)

Summary IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of confidentiality CVE-2026-39892, CVE-2026-34073. Dashboard operands that use the App Connect Enterprise Agent are vulnerable to arbitrary code execution...

Build Fast, Build Secure: Wiz findings are now in Lovable

With Wiz in Lovable, every builder can catch and fix risks in real time, keeping apps secure as they’re created...

Thousands of Vibe-Coded Apps Expose Corporate and Personal Data on the Open Web

Companies like Lovable, Base44, Replit, and Netlify use AI to let anyone build a web app in seconds—and in thousands of cases, spill highly sensitive data onto the public internet...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a confidential disclosure (CVE-2026-5515)

Summary Users of WS-Security with java 17 in IBM App Connect Enterprise are vulnerable to a confidential disclosure. Vulnerability Details CVEID:CVE-2026-5515 DESCRIPTION: IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user. CVSS...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality (CVE-2026-25679)

Summary IBM App Connect Enterprise Certified Container operator and DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in Golang module url.Parse...

CVE-2026-41890

creationtimestamp| type| source ---|---|--- 2026-05-07 06:32:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlaltohzys2i...

CVE-2026-41202

creationtimestamp| type| source ---|---|--- 2026-05-07 06:17:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlakynbolz2e 2026-05-07 09:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116532473442667986 2026-05-07 09:00:34+00:00| seen|...

webkitgtk: Processing maliciously crafted web content may disclose internal states of the app

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory initialization issue due to improper memory handling and result in the disclosure of the internal states of the application...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +5581 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-compression (>=4.2.0.alpha3, <=4.2.12.final)

io.netty:netty-codec-compression MAVEN version =4.2.0.alpha3, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42587 Source advisory: SNYK:JAVA-IONETTY-16438931...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4650 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42587 Source advisory: OSV:GHSA-F6HV-JMP6-3VWV...