CVE-2026-23853

creationtimestamp| type| source ---|---|--- 2026-04-17 07:50:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116418950688612205 2026-04-17 09:15:54+00:00| seen| Telegram/AZQnk1q88GRrPNbtJYRdzFvYzsq1JKqTcpasHMe998GraXQ 2026-04-17 10:14:19+00:00| seen|...

GHSA-XQ3M-2V4X-88GG

creationtimestamp| type| source ---|---|--- 2026-04-17 04:00:00+00:00| published-proof-of-concept| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg 2026-04-17 04:00:00+00:00| confirmed|...

xrdp 安全漏洞

XRDPT is an open-source remote desktop protocol server developed by Neutrinolabs. Versions of XRDPT prior to 0.10.5 contain security vulnerabilities. These vulnerabilities stem from out-of-bound reads during the RDP capability exchange phase, which may lead to denial of service or the disclosure ...

PT-2026-33501

xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerabilit...

BIT-AUTHENTIK-2024-23647 PKCE downgrade attack in Authentik

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the codechallenge parameter to the authorization request and adds the codeverifier parameter to the token request. Prior to...

Improper Validation of Unsafe Equivalence in Input

Overview @node-oauth/oauth2-server is a Complete, framework-agnostic, compliant and well tested module for implementing an OAuth2 Server in node.js Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the token process. An attacker can obtain...

GHSA-JHM7-29PJ-4XVF @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

Summary The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can...

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

Summary The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can...

CVE-2026-21719

creationtimestamp| type| source ---|---|--- 2026-04-16 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN78422311 2026-04-17 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116418519259243532 2026-04-17 06:00:31+00:00| seen|...

CVE-2026-39424

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file .xlsx via the...

[SECURITY] [DLA 4535-1] openssh security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4535-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 16, 2026 https://wiki.debian.org/LTS -...

CVE-2026-3428

creationtimestamp| type| source ---|---|--- 2026-04-16 17:19:57+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116415528739254723...

GHSA-Q2HG-643C-GW8H Apache Airflow: RCE by race condition in example_xcom dag

The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...

CVE-2025-54550

The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...

CVE-2026-1880

creationtimestamp| type| source ---|---|--- 2026-04-16 11:00:09+00:00| published-proof-of-concept| Telegram/OSlXig-eedzYms-Uc4dRsjDnmK2Ev9U-Z2yaOdZjz62KbI 2026-04-16 15:00:06+00:00| published-proof-of-concept| Telegram/erN7IpzCRCEbk-BjWUA3pp0zUmJycQB5Op0ThvHAcoJSrI0 2026-04-16 17:19:57+00:00| see...

CVE-2026-40504

creationtimestamp| type| source ---|---|--- 2026-04-16 05:17:50+00:00| published-proof-of-concept| Telegram/TCjlHJMv9N6S0B2yz3RFhhjLUk96NJtTkRt7NB8H70qfRI 2026-04-16 09:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116413565694523584 2026-04-16 13:48:20+00:00| seen|...

CVE-2026-4880

creationtimestamp| type| source ---|---|--- 2026-04-16 00:00:41+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjl44xsviz2c 2026-04-16 00:00:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116411442042183112 2026-04-16 02:17:40+00:00| seen|...

PT-2026-33365

Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw in CheckHostTrustController.getAuthority that allows an attacker to bypass the security fix for CVE-2026-32303. The method hardcodes the URI scheme based on port number, causin...

CVE-2026-6350

creationtimestamp| type| source ---|---|--- 2026-04-15 18:45:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10843-9ff91-2.html 2026-04-16 03:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116412149204832837 2026-04-16 03:00:32+00:00| seen|...

CVE-2026-23772

creationtimestamp| type| source ---|---|--- 2026-04-15 17:14:00+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116409843068495690 2026-04-16 11:16:12+00:00| seen| Telegram/j-zpZhFSipqPFVaOoufvpDRNhg2whahduAHfYT4AdF4gH4...