CVE-2026-40728

creationtimestamp| type| source ---|---|--- 2026-04-15 12:38:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjvyiajkd2z...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to loss of confidentiality (CVE-2026-26007)

Summary Python module cryptography is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance and Dashboard operands that enable the App Connect Enterprise Agent are vulnerable to loss of...

Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to denial of service (CVE-2026-39865)

Summary Node.js module axios is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Node.js module axios CVE-2026-3986...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to denial of service (CVE-2026-0994)

Summary Python module protobuf is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...

CVE-2026-3643

The Accessibly WordPress plugin (versions ≤ 3.0.3) is vulnerable to an unauthenticated Stored XSS via REST API endpoints /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config. These endpoints have permission_callback set to __return_true, so no auth checks occur. updateWidgetOptions()...

CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API

The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...

MAL-2026-2916 Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 457170b51d87c7f84644a72a71a9979508a99061e7e8fdee3aa8c2e170493b12 The package @jesusvizcaino2021/com.baogong.app-push-permission was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-6293

creationtimestamp| type| source ---|---|--- 2026-04-15 08:17:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjhgs6p7x2m 2026-04-15 15:24:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116409411290435695...

CVE-2026-40688

creationtimestamp| type| source ---|---|--- 2026-04-15 01:07:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjipfz5xkn2a 2026-04-15 01:19:46+00:00| published-proof-of-concept| Telegram/beRkyaQYF6-HbSXwJObWqlvUpmDUmKmHxxmaYmzALf1MGQ...

CVE-2026-40385

creationtimestamp| type| source ---|---|--- 2026-04-15 00:01:50+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjilq3xxjt2u...

(0Day) Docker Desktop credentialHelper Directory Traversal Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to escape the container and execute high-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The specific flaw...

CVE-2026-27304

creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 01:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116406132959257406 2026-04-15 01:30:31+00:00| seen|...

Malicious code in ant-mcp-proxy-for-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564 During use of the package, it silently downloads and executes remote executables or scripts. During analysis, the remote resources were no longer available. Th...

MAL-2026-2669 Malicious code in ant-mcp-proxy-for-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564 During use of the package, it silently downloads and executes remote executables or scripts. During analysis, the remote resources were no longer available. Th...

CVE-2026-34614

creationtimestamp| type| source ---|---|--- 2026-04-14 20:21:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mji7frytpy23...

CVE-2026-27245

creationtimestamp| type| source ---|---|--- 2026-04-14 20:07:48+00:00| seen| Telegram/vjfxnNTg64imjnjxPGtl8BfvNjTDmt0KKDhXRC5WEaV7Sg 2026-04-15 09:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116407902478004814 2026-04-15 09:00:32+00:00| seen|...

CVE-2026-37596

creationtimestamp| type| source ---|---|--- 2026-04-14 17:34:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhw2rqxqm2m...

CVE-2026-4369 Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant Name

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to...

CVE-2020-26141

creationtimestamp| type| source ---|---|--- 2026-04-14 13:10:22+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjhhd6zgtz2a 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-07...

Malicious Package

Overview pt-sc-demo-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...