PT-2026-34012

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting XSS vulnerability in the mailbox signature feature. The sanitization function Helper::stripDangerousTags app/Misc/Helper.php:568 uses an incomplete blocklist of only four HTM...

Oracle Enterprise Manager Base Platform 安全漏洞

Oracle Enterprise Manager Base Platform is a local management platform developed by Oracle Corporation in the United States. This platform is primarily used for managing the deployment of Oracle products. Versions 13.5 and 24.1 of Oracle Enterprise Manager Base Platform contain security...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013100 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: croseckeyb - fix an invalid memory access If croseckeybregistermatrix isn't called due to...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013289)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013289 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in tracebufferedeventdisable Warning happened in tracebufferedeventdisable a...

PT-2026-33988

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description On Windows systems, the sock recvfrom into function within asyncio.ProacterEventLoop lacks a boundary check for the data buffer when the nbytes parameter is used. This flaw can lead to an...

CVE-2026-4852

creationtimestamp| type| source ---|---|--- 2026-04-20 22:24:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjxj2wb56l2i...

CVE-2026-29647

creationtimestamp| type| source ---|---|--- 2026-04-20 22:09:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjxiacjxcy2e...

GHSA-6W96-9QW7-M599

creationtimestamp| type| source ---|---|--- 2026-04-20 21:22:08+00:00| seen| Telegram/afpqx5U4BmLApg0vDDGxSmW2u1LMTzTENI3LCYVeeaEOYCo...

GHSA-9G44-8XV2-F2M9

creationtimestamp| type| source ---|---|--- 2026-04-20 21:22:08+00:00| seen| Telegram/afpqx5U4BmLApg0vDDGxSmW2u1LMTzTENI3LCYVeeaEOYCo...

CVE-2026-24506

creationtimestamp| type| source ---|---|--- 2026-04-20 21:21:58+00:00| seen| Telegram/itZIvBa41gHmxLOZ4e3ooVdAvJm4yIE4KZd9P4HVJMq4o...

kernel: ALSA: aloop: Fix racy access at PCM trigger

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are...

CVE-2026-39109

creationtimestamp| type| source ---|---|--- 2026-04-20 20:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxb2tnbmy2r...

GHSA-W73R-2449-QWGH

creationtimestamp| type| source ---|---|--- 2026-04-20 17:21:45+00:00| seen| Telegram/7kKxZY5KjVtNNq82uAZn6qPfMFkWsKJQXsAec31tFmY88...

CVE-2026-6625

creationtimestamp| type| source ---|---|--- 2026-04-20 11:16:38+00:00| seen| Telegram/dHFBNa6z0pCHPScrBZS6WnqsKmYP7k1ORYb9rRTMhJ2WJuM 2026-04-20 12:20:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwhd2vsya2i...

CVE-2026-6643

creationtimestamp| type| source ---|---|--- 2026-04-20 07:50:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvybbngej2h 2026-04-20 09:17:22+00:00| seen| Telegram/Lm9dzPhVRFRRMgyzsUGG1X5A2Qj2Q71JCDe8XQUe2-0mpLw 2026-04-28 09:00:05+00:00| seen|...

FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...

GHSA-5H65-JX66-J7P5 FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...

CVE-2026-6591

creationtimestamp| type| source ---|---|--- 2026-04-20 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjvczbzwd32f 2026-04-20 04:28:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvmxmb3x72i...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS leading to cross-site scripting, via custom elements. When CUSTOMELEMENTHANDLING is not enabled, and an attacker has already polluted the prototype...

CVE-2026-6518

creationtimestamp| type| source ---|---|--- 2026-04-18 06:48:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqtueebpf26 2026-04-18 07:01:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjqukpruc52v 2026-04-18 07:16:24+00:00| seen|...