CVE-2026-43940

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget...

Maestro 0.15.4

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...

Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Summary When the Timeoutable module is enabled in Devise, the FailureAppredirecturl method returns request.referrer — the HTTP Referer header, which is attacker-controllable — without validation for any non-GET request that results in a session timeout. An attacker who hosts a page with an...

Origin Validation Error

Overview cinny is a Yet another matrix client Affected versions of this package are vulnerable to Origin Validation Error in the process that handles emoji pack avatar URLs in the service worker. An attacker can obtain a victim's access token by crafting a malicious emote pack with an...

GHSA-J944-W549-3453 Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for...

CVE-2026-6002

creationtimestamp| type| source ---|---|--- 2026-05-07 15:31:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbjwvxqko2c 2026-05-07 19:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlbvm7lg442f 2026-09-12 10:00:13+00:00| seen|...

CVE-2026-7413

creationtimestamp| type| source ---|---|--- 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7413/ 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7414/ 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7415/ 2026-05-07 19:36:35+00:00| seen|...

CVE-2026-44407

creationtimestamp| type| source ---|---|--- 2026-05-07 13:49:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbe7yrvv62v...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.23 LTS and 13.1.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: IBM App Connect Enterprise Certified Container backup and restore is vulnerable to authorization bypass (CVE-2026-33186)

Summary gRPC-Go is used by the IBM App Connect Enterprise Certified Container Velero image. IBM App Connect Enterprise Certified Container deployments that use Velero for backup and restore are vulnerable to authorization bypass. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality (CVE-2025-62718)

Summary Node.js module axios is used by IBM App Connect Enterprise Certified Container for HTTP communications. IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)

Summary Node.js module handlebars is used by all IBM App Connect Enterprise Certified Container operands. IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941 and denial of service...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to loss of confidentiality (CVE-2026-39892, CVE-2026-34073) and arbitrary code execution (CVE-2026-40087)

Summary IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of confidentiality CVE-2026-39892, CVE-2026-34073. Dashboard operands that use the App Connect Enterprise Agent are vulnerable to arbitrary code execution...

Build Fast, Build Secure: Wiz findings are now in Lovable

With Wiz in Lovable, every builder can catch and fix risks in real time, keeping apps secure as they’re created...

Thousands of Vibe-Coded Apps Expose Corporate and Personal Data on the Open Web

Companies like Lovable, Base44, Replit, and Netlify use AI to let anyone build a web app in seconds—and in thousands of cases, spill highly sensitive data onto the public internet...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a confidential disclosure (CVE-2026-5515)

Summary Users of WS-Security with java 17 in IBM App Connect Enterprise are vulnerable to a confidential disclosure. Vulnerability Details CVEID:CVE-2026-5515 DESCRIPTION: IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user. CVSS...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality (CVE-2026-25679)

Summary IBM App Connect Enterprise Certified Container operator and DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in Golang module url.Parse...

CVE-2026-41890

creationtimestamp| type| source ---|---|--- 2026-05-07 06:32:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlaltohzys2i...

io.mosip.kernel:kernel-config-server (1.0.6), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=darwin.release, <=darwin.sr1) +1 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.mosip.kernel:kernel-config-server 1.0.6 -...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=einstein.sr1, <=einstein.sr3) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...