CVE-2026-34314

Oracle Financial Services Analytical Applications Infrastructure (OFSAAI), specifically the Platform component, is affected in versions 8.0.7.9, 8.0.8.7, and 8.1.2.5. The vulnerability allows a low-privilege, unauthenticated attacker with network access via HTTP to cause unauthorized creation, de...

CVE-2026-34310

...

CVE-2026-34286

...

CVE-2026-34275

...

GHSA-73F2-P9JR-M44X

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:26+00:00| seen| Telegram/raJRCian8jdwHZHMkV6wtcQApYY70x43uMZTCVVg-5BoqY...

GHSA-5R9W-9FG6-266Q

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:26+00:00| seen| Telegram/raJRCian8jdwHZHMkV6wtcQApYY70x43uMZTCVVg-5BoqY...

CVE-2026-24177

creationtimestamp| type| source ---|---|--- 2026-04-21 19:25:24+00:00| seen| Telegram/IV3XUTumqBvhxDGxYKmJv890gnK1hu13PgwZ6nuJXKkSo...

CVE-2018-12437

creationtimestamp| type| source ---|---|--- 2026-04-21 19:25:24+00:00| seen| Telegram/IV3XUTumqBvhxDGxYKmJv890gnK1hu13PgwZ6nuJXKkSo...

CVE-2026-40865

Horilla is a free and open source Human Resource Management System HRMS. In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR...

CVE-2026-40867

Horilla CVE-2026-40867 affects Horilla HRMS (version 1.5.0). A broken access control flaw in the helpdesk attachment viewer lets any authenticated user view attachments from other tickets by altering the attachment ID, exposing sensitive support files and internal documents across unrelated users...

CVE-2026-40867 Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation

Horilla is a free and open source Human Resource Management System HRMS. In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files an...

CVE-2026-40865 Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>

Horilla is a free and open source Human Resource Management System HRMS. In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR...

CVE-2026-40599

CVE-2026-40599 affects ClearanceKit on macOS. Before 5.0.5, a process with an empty Team ID but non-empty Signing ID can be misidentified as an Apple platform binary, enabling a malicious app to impersonate an Apple process in the global allowlist and access protected files. The issue is fixed in...

CVE-2026-40599 ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple...

CVE-2026-5789

creationtimestamp| type| source ---|---|--- 2026-04-21 17:18:10+00:00| seen| Telegram/GomAqAKioRw5ORwyc6ugTkWhk08fHowYPUM-Q49l2oeUgi0 2026-04-21 17:18:19+00:00| published-proof-of-concept| Telegram/Dp3cHxEcbabtcr78eMwYzIZdIkaK3NXYlVFRQJBCFObozHI...

Real Apple notifications are being used to drive tech support scams

Scammers have found a way to abuse legitimate Apple account notification emails to trick targets into calling fake tech support numbers. According to a report from BleepingComputer, scammers create an Apple account and insert a phishing message into the personal information fields, then modify th...

BIT-GRAFANA-2026-21727 Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing orgid = 0 records to be returned across organizations, a user with datasource management privileges could read and permanentl...

CVE-2026-39467

creationtimestamp| type| source ---|---|--- 2026-04-21 10:25:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjyrfmdo7m2h 2026-04-21 11:16:33+00:00| published-proof-of-concept| Telegram/Kfu-jY0-fwjq6nikv0Y5FAaiWBVRI0K7iXQovwBJu867kaE...

CVE-2026-40431

creationtimestamp| type| source ---|---|--- 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12...

CVE-2026-42239

creationtimestamp| type| source ---|---|--- 2026-04-21 08:38:20+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642r 2026-05-07 20:21:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc25mkshw2c 2026-05-07...