40337 matches found
CVE-2026-43873
creationtimestamp| type| source ---|---|--- 2026-04-25 00:46:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2 2026-05-12 05:38:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mln34ysrfi2t...
CVE-2026-41478
creationtimestamp| type| source ---|---|--- 2026-04-24 22:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbjlqme3z2n 2026-04-28 16:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mkkxq6o5ex2w 2026-04-28 16:07:10+00:00| seen|...
CVE-2026-41472 CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard
CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findingsjson field of...
CVE-2026-41328
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack require...
CVE-2026-41328
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack require...
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches
The U.S. Cybersecurity and Infrastructure Security Agency CISA has revealed that an unnamed federal civilian agency's Cisco Firepower device running Adaptive Security Appliance ASA software was compromised in September 2025 with a new malware called FIRESTARTER. FIRESTARTER, per CISA and the U.K....
GHSA-3JVJ-V6W2-H948 Lemmy has SSRF in /api/v3/post via Webmention dispatch
Summary Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but th...
Lemmy has SSRF in /api/v3/post via Webmention dispatch
Summary Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but th...
CVE-2026-21515
creationtimestamp| type| source ---|---|--- 2026-04-24 15:22:14+00:00| seen| Telegram/9MQPqn6NQB4yNQwBhEjQmfZAQamilmjjvNDDQhjtzrN-0VE 2026-04-24 22:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbjncutyp2t 2026-04-27 21:07:08+00:00| seen|...
DEBIAN-CVE-2026-31640
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial In rxrpcpostresponse, the code should be comparing the challenge serial number from the cached response before deciding to switch to a newer response, but...
CVE-2026-31668 seg6: separate dst_cache for input and output paths in seg6 lwtunnel
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dstcache per encap route, shared between seg6inputcore and seg6outputcore. These two paths can perform the post-encap SID lookup ...
CVE-2026-31609 smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbdfreesendio after smbdsendbatchflush smbdsendbatchflush already calls smbdfreesendio, so we should not call it again after smbdpostsend moved it to the batch list...
CVE-2026-31608
CVE-2026-31608 affects the Linux kernel SMB server. The issue is a double-free in smb_direct_free_sendmsg when invoked after smb_direct_flush_send_list(); smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so a second call after post_sendmsg() is incorrect. The fix moves the ca...
CVE-2026-42860
creationtimestamp| type| source ---|---|--- 2026-04-24 14:21:24+00:00| published-proof-of-concept| https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc 2026-05-11 18:18:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllv5mcnjo2w...
CVE-2026-40976
creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-04-27 05:23:49+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mkhdcsbjs22h 2026-04-28 01:01:21+00:00| seen|...
CVE-2026-40972
creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-04-28 01:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjf2yw4gh2k 2026-04-28 09:27:42+00:00| seen|...
CVE-2026-40971
creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-06-12 12:55:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3ry7mosb27...
CVE-2026-39858
creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanez5th22k 2026-07-12 20:31:39+00:00| seen| https://bsky.app/profile/releaseport.com/post/3mqhzi7ivgc2b 2026-08-04 13:00:19+00:00| seen| https://t.me/cyberoknews/222...
CVE-2026-40912
creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanez5th22k 2026-04-30 23:41:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkqs3ees2r2h 2026-07-08 14:15:14+00:00| seen|...