CVE-2026-23778

creationtimestamp| type| source ---|---|--- 2026-04-17 10:40:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjoqdhifmh2s 2026-04-17 11:17:26+00:00| seen| Telegram/Gicxpbsei5vwZhhkOJEP5kItUnFZEzNYMMsg3c4t0xeHr7Q 2026-04-17 11:17:38+00:00| seen|...

CVE-2026-33557

creationtimestamp| type| source ---|---|--- 2026-04-17 09:12:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjolfzqx6z25 2026-04-20 12:20:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjwhd7qk4z2x 2026-04-20 16:02:32+00:00| seen|...

CVE-2026-6421

creationtimestamp| type| source ---|---|--- 2026-04-17 07:16:22+00:00| seen| Telegram/tG2JfBYkK87mHaeOPjoo4KUhb5Z5XakpvfcfSoidkAS14Y 2026-07-14 01:00:04+00:00| seen| https://t.me/bdufstecru/3297 2026-07-15 00:00:35+00:00| seen| https://t.me/bdufstecru/3297 2026-07-16 19:00:20+00:00| seen|...

EUVD-2026-23358

The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubiorestpreinsertimportassets function, which is hooked to the restpreinsertposttype filter for posts, pages, templates, and template...

CVE-2026-5162

creationtimestamp| type| source ---|---|--- 2026-04-17 06:30:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjocfdxviq2f 2026-04-17 14:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjp5c52pil27...

CVE-2026-5427

creationtimestamp| type| source ---|---|--- 2026-04-17 06:13:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjobfqtiah2k 2026-04-17 23:32:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjq3hp52oo2l...

GHSA-9PR4-RF97-79QH

creationtimestamp| type| source ---|---|--- 2026-04-17 03:16:02+00:00| published-proof-of-concept| Telegram/OCRuCpCrMYyNHl7tK2WvZ5-EwER3iqlB4XvdcqwHWSldrs...

CVE-2026-40322

creationtimestamp| type| source ---|---|--- 2026-04-17 00:14:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnneetnsb2q 2026-04-17 01:16:10+00:00| published-proof-of-concept| Telegram/L7r3B6HZ1No5mrz6jolg2h46aKqgVbGrSL49d6iAO6fVY 2026-04-17 17:01:39+00:00| seen|...

ROS-20260417-73-0045

Vulnerability in glpi is related to failure to take measures to neutralize special elements in the template creation mechanism. Exploitation of the vulnerability may allow an attacker to execute arbitrary code...

GLSA-202604-04 : DTrace: Arbitrary file creation via dtprobed

The remote host is affected by the vulnerability described in GLSA-202604-04 DTrace: Arbitrary file creation via dtprobed A vulnerability has been found in dtprobed that allows for arbitrary file creation through specially crafted USDT provider names. Tenable has extracted the preceding descripti...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007227)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007227 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap-private...

DTrace: Arbitrary file creation via dtprobed

Background DTrace is a dynamic tracing tool for analysing or debugging the whole system. Specifically, dtprobed is a component of the DTrace system that keeps track of USDT probes within running processes, parsing and storing the DOF they provide for later consumption by dtrace proper. Descriptio...

Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-007346)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007346 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when...

BIT-MLFLOW-2025-10279 Privilege Escalation in mlflow/mlflow

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions 0o777. This vulnerability allows an attacker with write access to the /tmp directory to exploit a race condition and overwrite .py files in the virtual...

BIT-AUTHENTIK-2022-46172 authentik allows existing authenticated users to create arbitrary accounts

authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable...

BIT-AUTHENTIK-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

CVE-2026-41113

creationtimestamp| type| source ---|---|--- 2026-04-16 23:18:29+00:00| published-proof-of-concept| Telegram/uUtOgPMgnfpzQaGdgE5uvRP8Wc5QVkmzi4lAg5HL6Ws0-I 2026-04-17 00:06:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnmwg5nl42k 2026-04-18 19:43:06+00:00| seen|...

GHSA-3XX2-MQJM-HG9X Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise

Summary The GET, POST, and DELETE handlers under /agents/:id/keys in the Paperclip control-plane API only call assertBoardreq, which verifies that the caller has a board-type session but does not verify that the caller has access to the company owning the target agent. A board user whose membersh...

Incorrect Authorization

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization via the createOAuthClientEndpoint endpoint. An attacker can gain unauthorized access to register OAuth clients by bypassing the intended...

OAuth 2.1 Provider: Unprivileged users can register OAuth clients

Am I affected? You're affected if all of the following are true: - Using @better-auth/oauth-provider at version specified below - You configured clientPrivileges in the plugin options expecting it to gate who can create OAuth clients - The /oauth2/create-client or /admin/oauth2/create-client...