CVE-2026-34607

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip function include/lib/common.php:793. When extracting ZIP archives plugin/template uploads, backup imports, the function calls $zip-extractTo$path without sanitizing Z...

BIT-KYVERNO-2026-4789 CVE-2026-4789

Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions...

CLEANSTART-2026-ZU10048 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-527x-5wrf-22m2, ghsa-9h8m-3fm2-qjrq, ghsa-c9v3-4pv7-87pr, ghsa-h75p-j8xm-m278, ghsa-p77j-4mvh-x3m3 applied in versions: 1.26.7-r0, 1.26.7-r1, 1.26.7-r2

Multiple security vulnerabilities affect the kubernetes-dns-node-cache package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-5578

creationtimestamp| type| source ---|---|--- 2026-04-05 19:50:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mirjixtnor2g...

CVE-2026-5585 Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure

A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/taskmanager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit ha...

MAL-2026-2716 Malicious code in @needl-ai/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1b98ae2755d0fd7d61bc3dfd378dc1bad2eadf7ef0033ba66bbf1383a711e5c The package @needl-ai/common was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @needl-ai/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1b98ae2755d0fd7d61bc3dfd378dc1bad2eadf7ef0033ba66bbf1383a711e5c The package @needl-ai/common was found to contain malicious code. Source: ossf-package-analysis...

OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

...

LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories

Large language models LLMs are increasingly embedded in open-source software OSS ecosystems, creating complex interactions among natural language prompts, probabilistic model outputs, and execution-capable components. However, it remains unclear whether traditional vulnerability disclosure...

CVE-2026-5585: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/taskmanager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit ha...

CVE-2016-20052

creationtimestamp| type| source ---|---|--- 2026-04-04 15:25:45+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mioka3avcd2o 2026-04-04 15:40:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miokztck4i2j 2026-04-14 20:07:08+00:00| seen|...

cve-research

...

BELL-CVE-2026-31396

Bulletin has no description...

BELL-CVE-2026-31402

Bulletin has no description...

Exploit for OS Command Injection in Php

CVE-2024-4577 Python Exploit Toolkit A Python toolkit for exp...

DEBIAN-CVE-2026-23472

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handletx for PORTUNKNOWN uartwriteroom and uartwrite behave inconsistently when xmitbuf is NULL which happens for PORTUNKNOWN ports that were never properly initialized: - uartwriteroom returns...

DEBIAN-CVE-2026-23459

In the Linux kernel, the following vulnerability has been resolved: iptunnel: adapt iptunnelxmitstats to NETDEVPCPUSTATDSTATS Blamed commits forgot that vxlan/geneve use udptunnel6xmitskb which call iptunnelxmitstats. iptunnelxmitstats was assuming tunnels were only using NETDEVPCPUSTATTSTATS...

ppg-common (>=1.2.0, <=1.67.0) potentially affected by CVE-2026-35536 via tornado (4.5.0)

tornado PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - ppg-common =1.2.0, =1.67.0 Source cves: CVE-2026-35536 Source advisory: OSV:GHSA-FQWM-6JPJ-5WXC...

ppg-common (>=1.2.0, <=1.67.0) potentially affected by CVE-2026-35536 via tornado (4.5.0)

tornado PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - ppg-common =1.2.0, =1.67.0 Source cves: CVE-2026-35536 Source advisory: OSV:PYSEC-2026-2287...

CVE-2026-34397

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose...