CVE-2026-42238 Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...

CVE-2026-6321

creationtimestamp| type| source ---|---|--- 2026-05-04 19:36:47+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3ml2gaeaaas2n 2026-05-04 20:18:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2il54ya22q 2026-05-04 22:34:34+00:00| seen|...

CVE-2025-47405

creationtimestamp| type| source ---|---|--- 2026-05-04 19:07:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2emokys72g...

CVE-2026-43616

creationtimestamp| type| source ---|---|--- 2026-05-04 18:50:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2dn4fq4j2p...

CVE-2026-42092

creationtimestamp| type| source ---|---|--- 2026-05-04 18:31:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2cm7hqfa2q...

CVE-2026-41571

creationtimestamp| type| source ---|---|--- 2026-05-04 18:24:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2c6ljvvg2r 2026-05-04 20:27:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2j2fwzwb2e 2026-09-12 10:00:17+00:00| seen|...

CVE-2026-41571

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt"null" placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password:...

io.apicurio:apicurio-registry-app (1.0.2.final), io.apicurio:apicurio-registry-storage-infinispan (1.0.2.final) +83 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (0.26.1)

io.quarkus:quarkus-vertx-http MAVEN version 0.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.apicurio:apicurio-registry-app 1.0.2.final - io.apicurio:apicurio-registry-storage-infinispan...

io.quarkiverse.githubapp:quarkus-github-app (>=1.5.0, <=1.6.0), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.5.0, <=1.6.0) +111 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.5.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.6.0 -...

io.quarkiverse.githubapp:quarkus-github-app (>=1.1.2, <=1.1.3), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.1.2, <=1.1.3) +114 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.3 -...

com.github.mcollovati:quarkus-hilla (>=24.7.1, <=24.9.0), com.github.mcollovati:quarkus-hilla-commons (>=24.7.1, <=24.9.0) +43 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-undertow (>=3.21.0, <=3.27.3)

io.quarkus:quarkus-undertow MAVEN version =3.21.0, =24.7.1, =24.7.1, =24.7.1, =24.7.1, =24.7.1, =24.7.1, =1.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =10.0.0-beta1, =3.1.5, =3.1.5, =3.1.5, =3.2.5 and more Source cves: CVE-2026-39852 Source advisory:...

io.quarkiverse.githubapp:quarkus-github-app (0.0.5), io.quarkiverse.githubapp:quarkus-github-app-deployment (0.0.5) +99 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.11.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app 0.0.5 -...

CVE-2026-42090 Notesnook: RCE via stored XSS in note export rendering

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook iOS/Android version 3.3.20, a stored XSS vulnerability in the note export flow can be escalated to remote code execution in the desktop app. The root cause is...

CVE-2026-5654

A flaw was found in Wireshark. This vulnerability allows a remote attacker to cause the application to crash by exploiting an issue within the AMR-NB codec. Successful exploitation leads to a denial of service, which prevents Wireshark from functioning and analyzing network traffic. Mitigation To...

CVE-2026-41044

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the admin web console to craft a malicious broker name. This malicious name, containing an xbean binding, can be used by a virtual machine VM transport to load a remote Spring...

CVE-2026-7735

creationtimestamp| type| source ---|---|--- 2026-05-04 06:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz3hedhnt2q...

Malicious Package

Overview @alfa.life.mapp/app.web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @w3m-app/getchainid is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-3273 Malicious code in @w3m-app/is_connected (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793804fbeaedf1325065aa857a03e0aba4bacd06b686728efeeb4a406f2e2668 The package @w3m-app/isconnected was found to contain malicious code. Source: ghsa-malware...

Malicious code in @w3m-app/get_chain_id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a5497ea6ed8479f242764e1c85fb02158843dd5dec341d2054ea7ef49adb4d The package @w3m-app/getchainid was found to contain malicious code. Source: ghsa-malware...