GHSA-C9GW-HVQQ-F33R

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:54+00:00| seen| Telegram/CTUi-siovRZPMXoRCribr6B1ZCHTTpPI8Ha33jZ7j7d94jM...

GHSA-4C3Q-X735-J3R5

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:49+00:00| seen| Telegram/WzFh75qC0rKhc-ksOtYvdTuNUy7-5M1wjcl5aTvCRw8jriM...

CVE-2026-22011

creationtimestamp| type| source ---|---|--- 2026-04-21 23:29:31+00:00| seen| Telegram/EOnjNYApXgYHJan5J2dTdjjTaiwT5fD5DgY21SwpLPKRuSg...

CVE-2026-35231

creationtimestamp| type| source ---|---|--- 2026-04-21 23:24:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk24vaufko2t 2026-04-21 23:30:11+00:00| seen| Telegram/14RDzCjaAGLQIuKBJtHoIYde60oDRnqUnuM1SZUlRS4U4fg...

CVE-2026-5512

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error...

CVE-2026-3307

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the ownerid parameter in the request bod...

CVE-2026-3307

GitHub Enterprise Server vulnerability CVE-2026-3307 allows an admin on one repository to modify the secret scanning push protection delegated bypass reviewers for another repository by changing the owner_id in the request body. Authorization is checked against the URL repository, but the action ...

CVE-2026-3307 Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the ownerid parameter in the request bod...

CVE-2026-3307

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the ownerid parameter in the request bod...

CVE-2026-3307 Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the ownerid parameter in the request bod...

CVE-2026-5512 Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error...

CVE-2026-40905

creationtimestamp| type| source ---|---|--- 2026-04-21 22:01:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjzyc6yddp2g 2026-04-21 22:37:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk22bozmx72o 2026-04-21 23:30:36+00:00| published-proof-of-concept|...

GHSA-XVJ8-PH7X-65GF

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:12+00:00| seen| Telegram/F2G63fMNgyZcc0oNt6XGHExAkvTr9kUyS9C9Ki-AIDnnQ5g...

GHSA-GHMH-Q25G-GXXX

creationtimestamp| type| source ---|---|--- 2026-04-21 21:26:51+00:00| seen| Telegram/FmTSSVQ1J3rSbvAltEePP9EbJsBmWNaUcXM1uvMHIpeiAtQ...

CVE-2026-40946

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience aud claim validation at the library level. This allows tokens issued for unrelate...

CVE-2026-34303

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQ...

CVE-2026-40945 Oxia: Bearer token exposed in debug log messages on authentication failure

Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This...

CVE-2026-40945 Oxia: Bearer token exposed in debug log messages on authentication failure

Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This...

EUVD-2026-24496

The Data Sharing Framework DSF implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison isBefore instead of isAfter, causing the cache to never return cached values. Every...

CVE-2026-40939

The CVE concerns the Data Sharing Framework (DSF). Before version 2.1.0, OIDC-authenticated sessions had no maximum inactivity timeout, allowing sessions to persist indefinitely after login and token expiry. The issue is fixed in v2.1.0. Affected components are DSF FHIR and BPE servers with OIDC ...