CVE-2026-41430

Summary: CVE-2026-41430 affects Press, a Frappe custom app running in Frappe Cloud. The issue is a reflected XSS on the login redirect parameter, arising from inadequate validation of redirect URLs. The publicly disclosed fix (commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6) restricts redirects t...

CVE-2026-41430 Press vulnerable to reflected XSS on login redirection

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-41317

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

ai.h2o:h2o-admissibleml (>=3.34.0.1, <=3.46.0.9), ai.h2o:h2o-algos (>=3.0.0.5, <=3.46.0.9) +48 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (>=3.0.0.5, <=3.46.0.9)

ai.h2o:h2o-core MAVEN version =3.0.0.5, =3.34.0.1, =3.0.0.5, =3.0.0.5, =3.12.0.1, =3.8.2.4, =3.14.0.7, =3.16.0.1, =3.14.0.1, =3.24.0.1, =3.30.1.1, =3.26.0.4, =3.10.5.1, =3.24.0.1, =3.30.0.1, =3.34.0.3, =3.46.0.9 and more Source cves: CVE-2026-3960 Source advisory: SNYK:JAVA-AIH2O-16417170...

CVE-2026-33078: Improper Neutralization of Special Elements used in an SQL Command

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxysectionsave function in app/routes/config/routes.py. The serverip parameter, sourced from the URL path, is passed unsanitized through...

CVE-2026-4117

creationtimestamp| type| source ---|---|--- 2026-04-23 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mk76czqxax2s...

CVE-2026-32210

creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:09+00:00| published-proof-of-concept| Telegram/kiTcjsXT1hi2Y3u94e7GhzIuEtNJE-kdjO7sui75MorBPg 2026-04-23 23:27:16+00:00| seen| Telegram/IhrbuMncMOQ2aXKn55DBnsRKZnrdzyQXI4i7tcZ3JysOVtE 2026-04-25 01:01:03+00:00| seen|...

Missing Authorization

Overview @actual-app/sync-server is an actual syncing server Affected versions of this package are vulnerable to Missing Authorization via the change-password endpoint, which lacks proper authorization checks. An attacker can gain administrative privileges by overwriting the password hash for the...

CVE-2026-6550

creationtimestamp| type| source ---|---|--- 2026-04-23 20:20:50+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mk6tla7hwe2h...

CLSA-2026-1776949031 flatpak: Fix of CVE-2026-34079

CVE-2026-34079: restrict cached-file removal to alphanumeric targets in flatpakswitchsymlinkandremove to prevent path-traversal unlink via a sandboxed-app-controlled symlink...

ai.h2o:h2o-algos (0.2.3.5), ai.h2o:h2o-app (0.2.3.5) +2 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.2.3.5)

ai.h2o:h2o-core MAVEN version 0.2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.2.3.5 - ai.h2o:h2o-app 0.2.3.5 - ai.h2o:h2o-persist-hdfs 0.2.3.5 - ai.h2o:h2o-scala2.10 0.2.3.5 Source cves:...

ai.h2o:h2o-algos (0.1.18), ai.h2o:h2o-app (0.1.18) +1 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.18)

ai.h2o:h2o-core MAVEN version 0.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.1.18 - ai.h2o:h2o-app 0.1.18 - ai.h2o:h2o-scala2.10 0.1.18 Source cves: CVE-2026-3960 Source advisory:...

ai.h2o:h2o-app (0.1.12) potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.12)

ai.h2o:h2o-core MAVEN version 0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-app 0.1.12 Source cves: CVE-2026-3960 Source advisory: OSV:GHSA-QMCV-HH7C-3M56...

ai.h2o:h2o-algos (0.1.9), ai.h2o:h2o-app (0.1.9) +2 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.9)

ai.h2o:h2o-core MAVEN version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.1.9 - ai.h2o:h2o-app 0.1.9 - ai.h2o:h2o-scala2.10 0.1.9 - ai.h2o:sparkling-water-core2.10 0.2.0 Source cves:...

ai.h2o:h2o-algos (0.1.14), ai.h2o:h2o-app (0.1.14) +1 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.14)

ai.h2o:h2o-core MAVEN version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.1.14 - ai.h2o:h2o-app 0.1.14 - ai.h2o:h2o-scala2.10 0.1.14 Source cves: CVE-2026-3960 Source advisory:...

ai.h2o:h2o-algos (0.1.13), ai.h2o:h2o-app (0.1.13) +1 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.13)

ai.h2o:h2o-core MAVEN version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.1.13 - ai.h2o:h2o-app 0.1.13 - ai.h2o:h2o-scala2.10 0.1.13 Source cves: CVE-2026-3960 Source advisory:...

ai.h2o:h2o-algos (0.1.10), ai.h2o:h2o-app (0.1.10) +1 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.10)

ai.h2o:h2o-core MAVEN version 0.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.1.10 - ai.h2o:h2o-app 0.1.10 - ai.h2o:h2o-scala2.10 0.1.10 Source cves: CVE-2026-3960 Source advisory:...

ai.h2o:h2o-algos (0.2.3.6), ai.h2o:h2o-app (0.2.3.6) +2 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.2.3.6)

ai.h2o:h2o-core MAVEN version 0.2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.2.3.6 - ai.h2o:h2o-app 0.2.3.6 - ai.h2o:h2o-persist-hdfs 0.2.3.6 - ai.h2o:h2o-scala2.10 0.2.3.6 Source cves:...

ai.h2o:h2o-algos (0.1.20), ai.h2o:h2o-app (0.1.20) +3 more potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.20)

ai.h2o:h2o-core MAVEN version 0.1.20 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-algos 0.1.20 - ai.h2o:h2o-app 0.1.20 - ai.h2o:h2o-scala2.10 0.1.20 - ai.h2o:sparkling-water-core2.10 =0.2.2, =0.2.3 -...

ai.h2o:h2o-app (0.1.17), ai.h2o:sparkling-water-core_2.10 (0.2.1) potentially affected by CVE-2026-3960 via ai.h2o:h2o-core (0.1.17)

ai.h2o:h2o-core MAVEN version 0.1.17 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-app 0.1.17 - ai.h2o:sparkling-water-core2.10 0.2.1 Source cves: CVE-2026-3960 Source advisory: OSV:GHSA-QMCV-HH7C-3M5...