CVE-2025-61309

creationtimestamp| type| source ---|---|--- 2026-05-05 14:56:05+00:00| seen| https://gist.github.com/ZeroBreach-GmbH/5b9fcd360e5a4d61523210ac8fcfca73...

CVE-2026-43571

creationtimestamp| type| source ---|---|--- 2026-05-05 13:48:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml4dbfc4yt2i 2026-05-05 17:18:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4oypmtrw2w 2026-05-07 17:07:09+00:00| seen|...

CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media...

CVE-2026-43532

OpenClaw 2026.4.7

CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media...

GHSA-W9J2-PVGH-6H63

creationtimestamp| type| source ---|---|--- 2026-05-05 05:10:29+00:00| seen| https://gist.github.com/alon710/19dd0e73e4b7ccaafafb6dcbeaa878b0...

CVE-2026-7781

creationtimestamp| type| source ---|---|--- 2026-05-05 02:42:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml362fquus2i...

CVE-2026-42034

creationtimestamp| type| source ---|---|--- 2026-05-05 02:40:29+00:00| seen| https://gist.github.com/alon710/0c5e31af5ca396bb556703780eb15c80 2026-05-07 12:01:30+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mlb677qhnu2l...

CVE-2026-7784

creationtimestamp| type| source ---|---|--- 2026-05-05 02:33:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml35jrpd752e...

GHSA-M7PR-HJQH-92CM

creationtimestamp| type| source ---|---|--- 2026-05-05 01:40:28+00:00| seen| https://gist.github.com/alon710/f7e9943ac304fddb338906da41495cb0...

GHSA-VF2M-468P-8V99

creationtimestamp| type| source ---|---|--- 2026-05-05 00:40:29+00:00| seen| https://gist.github.com/alon710/0dfb4618501419ce7bdb20d2764642a8...

This Week in Spring - May 5th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...

PT-2026-37313

Name of the Vulnerable Software and Affected Versions sse-channel versions prior to 4.0.1 Description Implementations that allow user-provided values to be passed to the event, retry, or id fields are susceptible to event spoofing. This allows an attacker to inject arbitrary Server-Sent Events SS...

CVE-2026-7791

creationtimestamp| type| source ---|---|--- 2026-05-04 22:49:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2qzt3ddo26 2026-05-04 23:11:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2samn7ly2p 2026-05-05 02:11:32+00:00| seen|...

CVE-2026-42155

creationtimestamp| type| source ---|---|--- 2026-05-04 20:56:34+00:00| published-proof-of-concept| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2cwr-gcf9-pvxr 2026-05-16 03:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlwu63uqud2d...

CVE-2026-42231

creationtimestamp| type| source ---|---|--- 2026-05-04 20:51:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2kgiomm52p 2026-05-05 07:14:35+00:00| seen| https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-n8n-patch-immediately-0 2026-05-11 03:41:08+00:00| seen|...

CVE-2026-42140

creationtimestamp| type| source ---|---|--- 2026-05-04 18:33:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2cpesil22k...

CVE-2026-29514

creationtimestamp| type| source ---|---|--- 2026-05-04 18:28:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2cgy4oyf2q...

GHSA-M8RW-V4F6-8787

creationtimestamp| type| source ---|---|--- 2026-05-04 14:34:05+00:00| seen| https://t.me/bdufstecru/3129 2026-05-11 18:18:34+00:00| seen| https://infosec.exchange/users/shadowserver/statuses/116557316906275011...

aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...