CVE-2026-40900

creationtimestamp| type| source ---|---|--- 2026-04-16 23:18:23+00:00| published-proof-of-concept| Telegram/x6U1CUbtpfWdw00zGhzow4OOkK7AiEHUVbiM6o3SMYH6zs0 2026-04-17 00:21:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnnruzhip2k 2026-04-20 20:32:29+00:00| seen|...

Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization

Summary MarkdownBody, the shared component used to render every Markdown surface in the Paperclip UI issue documents, issue comments, chat threads, approvals, agent details, export previews, etc., passes urlTransform=url = url to react-markdown. That override replaces react-markdown's built-in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the MarkdownBody class, where user-supplied markdown content is rendered without proper URL sanitization due to an overridden urlTransform function. An attacker can execute arbitrary JavaScript in the context...

CVE-2026-33122

creationtimestamp| type| source ---|---|--- 2026-04-16 21:20:19+00:00| published-proof-of-concept| Telegram/Aucjp3CgnELaS6Gr5NTHztcQZsmAAmJEC2bwRSYMi6Gi6QU 2026-04-20 21:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxefktdwk2c...

CVE-2026-40933

creationtimestamp| type| source ---|---|--- 2026-04-16 21:18:17+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-c9gw-hvqq-f33r 2026-04-17 01:18:30+00:00| seen| https://bsky.app/profile/cyberlensai.bsky.social/post/3mjnqwtsarh26 2026-04-21 22:51:58+00:00| seen|...

CVE-2018-14028

creationtimestamp| type| source ---|---|--- 2026-04-16 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mjncncas7o2e...

CVE-2026-41433

creationtimestamp| type| source ---|---|--- 2026-04-16 21:01:04+00:00| published-proof-of-concept| https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4 2026-05-14 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mlttclqwvi2...

CVE-9999-0001

creationtimestamp| type| source ---|---|--- 2026-04-16 20:56:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjncbsr4sl2l 2026-04-16 22:56:34+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjniyect222c...

Weblate: Arbitrary File Read via Symlink

Impact The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository. Patches https://github.com/WeblateOrg/weblate/pull/18683 References Thanks to @DavidCarliez for reporting this vulnerability via GitHub...

GHSA-VJ45-X3PJ-F4W4 Weblate: Improper access control for pending tasks in API

Impact The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. Patches https://github.com/WeblateOrg/weblate/pull/18515 Workarounds The attacker needs to guess the random UUID of the task, so...

Malicious code in chai-as-optimized (npm)

chai-as-optimized is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint.io/0ac7efbc0b6b1a53b305 and executes it similar to malware in to chai-await-test. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

CVE-2026-5426

creationtimestamp| type| source ---|---|--- 2026-04-16 18:04:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmymffdvg2t 2026-04-17 00:00:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116417104416675988 2026-04-17 00:00:42+00:00| seen|...

CVE-2026-40308

creationtimestamp| type| source ---|---|--- 2026-04-16 17:52:10+00:00| published-proof-of-concept| https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch 2026-04-16 23:18:29+00:00| published-proof-of-concept| Telegram/uUtOgPMgnfpzQaGdgE5uvRP8Wc5QVkmzi4lAg5HL6Ws0-I...

EUVD-2026-23231

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message...

CVE-2026-30459

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message...

CVE-2024-8010

creationtimestamp| type| source ---|---|--- 2026-04-16 14:44:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmnidlf3e26...

CVE-2024-4867

creationtimestamp| type| source ---|---|--- 2026-04-16 14:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmlx47bla2q...

CVE-2026-33804

creationtimestamp| type| source ---|---|--- 2026-04-16 14:02:05+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjml4smbi22n 2026-04-16 17:20:51+00:00| seen| Telegram/s117pb2GT3VwdfXaV13Oi8Gqr-ePRyI5oBJZVU7ek3MbpQ...

CVE-2026-6270

creationtimestamp| type| source ---|---|--- 2026-04-16 13:50:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjmki3smik2n 2026-04-16 15:19:53+00:00| seen| Telegram/5D912vOHN-G66auq1Hho6wwp26h6YJ5ZFpozWyyt1z6weM...

CVE-2026-3489

creationtimestamp| type| source ---|---|--- 2026-04-16 13:05:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmhxikp3s26 2026-04-16 13:15:15+00:00| seen| Telegram/AxxdIKwHC80bdVPCpOjpFf-JZoQD5Wyx830mnikToRUE...