9839 matches found
CVE-2026-8205
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...
CVE-2026-28910
creationtimestamp| type| source ---|---|--- 2026-05-21 17:47:19+00:00| seen| https://infosec.exchange/users/alexandreborges/statuses/116613816857863838 2026-05-21 17:47:29+00:00| seen| https://bsky.app/profile/alexandreborges.bsky.social/post/3mmexyl75a22g 2026-05-22 04:40:06+00:00| seen|...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to stream corruption in Spring MVC and WebFlux [CVE-2026-22735]
Summary IBM Watson Speech Services Cartridge is vulnerable to stream corruption in Spring MVC and WebFlux when using Server-Sent Events SSE CVE-2026-22735. Spring MVC and WebFlux are used in our speech microservices. This vulnerabilitiy has been addressed. Please read the details for remediation...
CVE-2026-9141
creationtimestamp| type| source ---|---|--- 2026-05-20 21:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcsfgqmlg2k 2026-05-21 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmdbhrxmv52l 2026-05-21 01:30:33+00:00| seen|...
CVE-2025-32750
creationtimestamp| type| source ---|---|--- 2026-05-20 17:56:56+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmci4r6pzr2q 2026-05-20 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcp25o5552e...
CVE-2026-42462
creationtimestamp| type| source ---|---|--- 2026-05-20 17:38:59+00:00| seen| https://bsky.app/profile/fedify.hollo.social.ap.brid.gy/post/3mmcgyic3lig2 2026-05-20 18:10:13+00:00| seen| https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mmcinnvfjdd2 2026-05-21 02:33:02+00:00| seen|...
Missing Authentication for Critical Function
Overview symfony/twilio-notifier is a Symfony Twilio Notifier Bridge Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the doParse webhook request parser in the notifier bridge. An attacker can submit forged webhook status events because the pars...
Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *
Summary The SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a...
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS
Summary The SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553" — a Go http.Server.Addr of ":5553" listens on every interface. On...
CVE-2026-45070
creationtimestamp| type| source ---|---|--- 2026-05-20 13:37:36+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbzn2gy7z2m 2026-05-20 14:15:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qc4eg22q 2026-07-14 19:58:43+00:00| seen|...
CVE-2026-8469 Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook
Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenixstorybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.toatom/1 without...
CVE-2026-47783
creationtimestamp| type| source ---|---|--- 2026-05-20 11:52:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmbtqvnqvt2k 2026-05-21 23:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmfllxhfro2s...
CVE-2026-47212
creationtimestamp| type| source ---|---|--- 2026-05-20 11:02:20+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbqxgdjg72y 2026-05-20 14:15:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qc4eg22q...
CVE-2026-42534
creationtimestamp| type| source ---|---|--- 2026-05-20 10:36:25+00:00| seen| https://social.nlnetlabs.nl/users/nlnetlabs/statuses/116606458492280712 2026-05-20 10:41:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmbps2tve32k 2026-08-11 04:45:05+00:00| seen|...
CVE-2026-24425
creationtimestamp| type| source ---|---|--- 2026-05-20 10:30:25+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbp6dmkls26 2026-05-20 15:48:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcawp4kev2t 2026-06-02 02:37:07+00:00| seen|...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Added an increment to the count field in struct tripstats, which represents the number of times the zone’s temperature exceeded the trip point. This increment must be performed in thermaldebugtztripup, for two...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix WARN with uffd that has remap events disabled Registering userfaultd on a VMA that spans at least one PMD and then mremap'ing that VMA can trigger a WARN when recovering from a failed page table move due to a page...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Ensure that the write index cannot be negative. The write index indicates which event the data corresponds to and accesses a per-file array. This index is passed by user processes during write calls as the fir...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: perf: Ensure that the swevent hrtimer is properly destroyed. With the change to hrtimertrytocancel in perfsweventcancelhrtimer, it appears possible for the hrtimer to still be active by the time the event is freed. Make sure that...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu-start/stop on perf events in PERFEVENTSTATEOFF can leave event-hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift...