CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

Nginx-UI: Disabled users retain full API access through previously issued bearer tokens

Summary A user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected...

GHSA-J3Q9-MXJG-W52F

creationtimestamp| type| source ---|---|--- 2026-04-21 11:56:50+00:00| seen| https://gist.github.com/MindfulLearner/c8453868d5bef6ee64c2f01d7c7f658d...

CVE-2026-39946

A flaw was found in OpenBao. When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, it failed to use proper database quoting on schema names. This oversight could lead to role revocation failures or, in rarer instances, allow a management user to perform SQL injectio...

CVE-2026-41036

creationtimestamp| type| source ---|---|--- 2026-04-21 10:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116442230247379634 2026-04-21 10:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjyrnsvu2r23 2026-04-21 11:16:33+00:00| published-proof-of-concept|...

CVE-2026-31370

creationtimestamp| type| source ---|---|--- 2026-04-21 10:18:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjyqywa7zl2o...

CVE-2026-40431

creationtimestamp| type| source ---|---|--- 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12...

CVE-2026-35503

creationtimestamp| type| source ---|---|--- 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12 2026-04-24 01:18:04+00:00| seen| Telegram/S8ox9UMDIAxfwdU4Vdf7uPBMfOmVZYt0JmzSEaP85k3wGMs 2026-04-24 23:00:59+00:00| seen|...

CVE-2026-42239

creationtimestamp| type| source ---|---|--- 2026-04-21 08:38:20+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642r 2026-05-07 20:21:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc25mkshw2c 2026-05-07...

GHSA-M8MH-X359-VM8M

creationtimestamp| type| source ---|---|--- 2026-04-21 03:18:08+00:00| seen| Telegram/y8A40ypWR-zTQL04UvuWU-fhawBkUz4Q7ssav8OQJXhAoc...

GHSA-VP62-R36R-9XQP

creationtimestamp| type| source ---|---|--- 2026-04-21 03:18:04+00:00| seen| Telegram/QlBPoNymR9hPCPyX2NtJM9uRRriKED-kqAlb1qrMP0xHygk 2026-05-08 12:12:39+00:00| seen| https://bsky.app/profile/betterhn20.e-work.xyz/post/3mldpc3s27h2l 2026-05-13 16:13:48+00:00| seen|...

GHSA-9PRC-PP2C-3427

creationtimestamp| type| source ---|---|--- 2026-04-21 03:18:04+00:00| seen| Telegram/QlBPoNymR9hPCPyX2NtJM9uRRriKED-kqAlb1qrMP0xHygk...

GHSA-G5CG-8X5W-7JPM

creationtimestamp| type| source ---|---|--- 2026-04-21 01:19:10+00:00| published-proof-of-concept| Telegram/LrBuhuc7HcH3kswc1a1az3fvuC6rURNPubqOsu4a3yYkj38...

CVE-2026-41299

creationtimestamp| type| source ---|---|--- 2026-04-21 01:18:48+00:00| seen| Telegram/wz0kiY1tb5u805P38ZVeawoTKuvhTd24bOWQm-Bt9SZek-4...

GHSA-2QRV-RC5X-2G2H

creationtimestamp| type| source ---|---|--- 2026-04-21 01:18:48+00:00| seen| Telegram/wz0kiY1tb5u805P38ZVeawoTKuvhTd24bOWQm-Bt9SZek-4...

GHSA-6XG4-82HV-CP6F

creationtimestamp| type| source ---|---|--- 2026-04-21 01:18:48+00:00| seen| Telegram/wz0kiY1tb5u805P38ZVeawoTKuvhTd24bOWQm-Bt9SZek-4...

CVE-2026-39946

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...

CVE-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011078 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxeqpdocleanup when socket create failed There is a null-ptr-dere...