Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: containers-common: containers-common-0.67.0-1.1.hum1 noarch containers-common-extra-0.67.0-1.1.hum1 noarch containers-common-0.67.0-1.1.hum1.src src...

CVE-2026-35595 Vikunja Affected by Privilege Escalation via Project Reparenting

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/projectpermissions.go:139-148 only requires CanWrite on the new parent project when changing parentprojectid. However, Vikunja's permission model uses a recursive CTE that walks up th...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to an integer overflow in the wcCmacUpdate function. An attacker can generate forged CMAC tags by exploiting the wraparound of the totalSz variable after processing 4 GiB of data, which causes the...

CVE-2026-5995

The CVE affects Totolink A7100RU (firmware 7.4cu.2313_b20191024). The vulnerable component is /cgi-bin/cstecgi.cgi, function setMiniuiHomeInfoShow, where manipulating the lan_info argument enables OS command injection. Impact is described as high for confidentiality, integrity, and availability, ...

CVE-2019-25681

creationtimestamp| type| source ---|---|--- 2026-04-09 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj3pn3kuej2i...

Exploit for Out-of-bounds Read in Microsoft

!CVEhttps://img.shields.io/badge/CVE-2025--60709-FF0000?styl...

CVE-2026-5973

The CVE-2026-5973 entry concerns FoundationAgents MetaGPT up to version 0.8.1. Affected component: the get_mime_type function in metagpt/utils/common.py. Root cause: input handling within that function allows OS command injection, enabling remote execution. Exploit status: public; exploitation po...

CVE-2026-4916

creationtimestamp| type| source ---|---|--- 2026-04-09 00:17:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizjtilwou2g 2026-04-09 12:45:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z 2026-04-09 20:00:00+00:00| seen|...

OPENSUSE-SU-2026:10519-1 glances-common-4.5.3-1.1 on GA media

These are all security issues fixed in the glances-common-4.5.3-1.1 package on the GA media of openSUSE Tumbleweed...

Erlang/OTP 27.x < 27.3.4.10 / 28.x < 28.4.2 OCSP Certificate Validation Bypass (CVE-2026-32144)

The version of Erlang/OTP installed on the remote host is 27.x prior to 27.3.4.10 or 28.x prior to 28.4.2. It is, therefore, affected by a certificate validation bypass vulnerability: - Improper certificate validation in the publickey application's OCSP response validation allows an attacker who...

CVE-2026-34392

creationtimestamp| type| source ---|---|--- 2026-04-08 23:33:06+00:00| seen| Telegram/nb1jq11aD1wlJ1YglJrLy9zN5IvfOUCCPtd3YJ7-KFKCMzY 2026-04-09 08:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj2douz4vn2s 2026-04-18 07:37:08+00:00| seen|...

CVE-2026-5813 PHPGurukul Online Course Registration check_availability.php sql injection

A weakness has been identified in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /checkavailability.php. Executing a manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-33753

rfc3161-client is a Python library implementing the Time-Stamp Protocol TSP described in RFC 3161. Prior to 1.0.6, an Authorization Bypass vulnerability in rfc3161-client's signature verification allows any attacker to impersonate a trusted TimeStamping Authority TSA. By exploiting a logic flaw i...

Multiple Vulnerabilities in Hitachi Ops Center Common Services

Overview Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2024-4028, CVE-2025-8714, CVE-2025-8715, CVE-2025-10044, CVE-2025-12817, CVE-2025-12818, CVE-2025-41248, CVE-2025-41249 CVE-2026-1190 is removed from the list. Impact Regarding the impact of the vulnerability, plea...

PT-2026-31450

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.15.0 through 1.42.0 Description The fix for a previous issue changed the path used for one command but left another command vulnerable to a PATH hijacking attack on BSD and Solaris platforms. Specifically, the kenv...

CVE-2026-39865

creationtimestamp| type| source ---|---|--- 2026-04-07 15:38:21+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8 2026-04-08 18:06:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyv426cdt2g...

EUVD-2026-19634

An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N 8.1 High. This issue was fixed in version...

CVE-2026-24450

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:28+00:00| seen| https://infosec.place/objects/29afbc8a-5592-4e64-8450-859a4223cef1 2026-04-07 15:28:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3s5o2cj2s 2026-04-07 17:28:45+00:00|...

Stealthy and Adjustable Text-Guided Backdoor Attacks on Multimodal Pretrained Models

Multimodal pretrained models are vulnerable to backdoor attacks, yet most existing methods rely on visual or multimodal triggers, which are impractical since visually embedded triggers rarely occur in real-world data. To overcome this limitation, we propose a novel Text-Guided Backdoor TGB attack...

CVE-2018-6605

creationtimestamp| type| source ---|---|--- 2026-04-07 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2026-04-07 2026-04-12 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-04-12 2026-04-15 00:00:00+00:00| exploited| The Shadowserver...