GO-2026-4912 Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet

Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet...

CVE-2026-34120

creationtimestamp| type| source ---|---|--- 2026-04-02 18:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijtnewzrz2z 2026-04-02 19:26:29+00:00| seen| Telegram/tHMZo4t6KJ7O3rHGS3YAWNGCGRHee0gil3YJsfVKclsQ...

CVE-2026-34593

Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.castinput/2 unconditionally creates a new Erlang atom via Module.concatvalue for any user-supplied binary string that starts with "Elixir.", before verifying whether the...

CVE-2026-34121

creationtimestamp| type| source ---|---|--- 2026-04-02 18:03:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijs4szzh22j 2026-04-02 19:26:54+00:00| seen| Telegram/Wnflj9AVRNFcbzmT8RV9QbE39gd8mxBym86BZleqlS4uOZ8...

GHSA-38M8-XRFJ-V38X

creationtimestamp| type| source ---|---|--- 2026-04-02 17:37:38+00:00| seen| Telegram/s8qY890P48N3Wo9aQa8rI-zenhf5cWovFj-1HEcEoggzt84...

GHSA-7P93-6934-F4Q7

creationtimestamp| type| source ---|---|--- 2026-04-02 17:37:18+00:00| seen| Telegram/asfs2UkHDA2dEAWxK7wNvn0OefGesF-RFz1ocNui3XpVnY...

GHSA-HR89-H2PP-F3C8

creationtimestamp| type| source ---|---|--- 2026-04-02 17:37:03+00:00| seen| Telegram/37miVMXR04DKfwyt7TTlg-rZzunXudUntV94ZrNBpzOyTo...

CVE-2026-23288

creationtimestamp| type| source ---|---|--- 2026-04-02 17:35:12+00:00| seen| Telegram/3APQ39-K1LHM0CmYF3M5tKMjdN0xum908YoEAwfNaFeP1w 2026-04-02 17:35:28+00:00| seen| Telegram/HZqA8JUt2FAozZYRytzYF7AaLh-0IOaNQQoRXBtgecHRGmg...

CVE-2026-23280

creationtimestamp| type| source ---|---|--- 2026-04-02 17:35:12+00:00| seen| Telegram/3APQ39-K1LHM0CmYF3M5tKMjdN0xum908YoEAwfNaFeP1w...

CVE-2026-23242

creationtimestamp| type| source ---|---|--- 2026-04-02 17:33:51+00:00| seen| Telegram/-E8D-G5mrov9BTBwIGpE99cQvtqBsnFAkyRSFMUliZNHWgQ 2026-05-05 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260506 2026-07-02 05:47:22+00:00| seen|...

CVE-2026-5350

creationtimestamp| type| source ---|---|--- 2026-04-02 17:33:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijqgxo7wm2i 2026-04-02 17:38:06+00:00| published-proof-of-concept| Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwamg57gds1UAnW3xco8kE 2026-04-03 07:00:53+00:00| seen|...

CVE-2026-34794

creationtimestamp| type| source ---|---|--- 2026-04-02 17:28:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijq5z75b62d 2026-04-02 17:38:00+00:00| seen| Telegram/-NvE3DOHeY-1Q0zG5YCstM01cFOFdgBxqrRb0oXZGokSQ 2026-04-03 08:00:23+00:00| seen|...

CVE-2026-34590

Postiz (AI social media scheduling tool) contains a vulnerability in the POST /webhooks/ endpoint prior to v2.21.4, where WebhooksDto validates the url with only @IsUrl() (format check) and lacks @IsSafeWebhookUrl, allowing blind SSRF because the orchestrator fetches the stored webhook URL withou...

CVE-2026-34590 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl format check, missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The updat...

CVE-2026-34590 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl format check, missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The updat...

CVE-2026-34793

creationtimestamp| type| source ---|---|--- 2026-04-02 17:02:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijoos7p4f2n 2026-04-02 17:37:38+00:00| seen| Telegram/s8qY890P48N3Wo9aQa8rI-zenhf5cWovFj-1HEcEoggzt84 2026-04-02 17:38:00+00:00| seen|...

CVE-2025-40221

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

CVE-2025-39938

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

CVE-2025-39969

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

CVE-2025-39982

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...