CVE-2026-40590 FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create. Under limited visibility, the endpoint drops unique-email validation. If the supplied email already...

CVE-2026-40590

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create. Under limited visibility, the endpoint drops unique-email validation. If the supplied email already...

Detection strategies across cloud and identities against infiltrating IT workers

In this article 1. Attack chain overview 1. Activities in pre-recruitment phase 2. Activities in recruiting phase 3. Activities in post-recruitment phase 2. Mitigation and protection guidance 3. Microsoft Defender XDR detections The shift to remote and hybrid work since the pandemic expanded glob...

Detection strategies across cloud and identities against infiltrating IT workers

In this article 1. Attack chain overview 1. Activities in pre-recruitment phase 2. Activities in recruiting phase 3. Activities in post-recruitment phase 2. Mitigation and protection guidance 3. Microsoft Defender XDR detections The shift to remote and hybrid work since the pandemic expanded glob...

CVE-2025-29635: Mirai Campaign Targets D-Link Devices

...

EUVD-2026-24133

Dovestones Softwares AD Self Update 4.0.0.5 is vulnerable to Cross Site Request Forgery CSRF. The affected endpoint processes state-changing requests without requiring a CSRF token or equivalent protection. The endpoint accepts application/x-www-form-urlencoded requests, and an originally...

EUVD-2026-24096

Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150...

CVE-2026-40938

creationtimestamp| type| source ---|---|--- 2026-04-21 14:12:35+00:00| published-proof-of-concept| https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq 2026-04-21 14:12:35+00:00| published-proof-of-concept|...

CVE-2026-6755

Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-6755 Mitigation bypass in the DOM: postMessage component

Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-6755

Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

GHSA-8Q4H-8CRM-5CVC

creationtimestamp| type| source ---|---|--- 2026-04-21 11:00:26+00:00| seen| https://bsky.app/profile/getpacketai.bsky.social/post/3mjytdcford24 2026-04-23 21:26:07+00:00| published-proof-of-concept| Telegram/wY3PGk1V7kusFG8GbDK0g0CtGhXXIm9UsDC-frBku-7BiY...

CVE-2026-6703

creationtimestamp| type| source ---|---|--- 2026-04-21 10:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjysr3qpxz2h 2026-04-25 05:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkccvodbpz2i...

CVE-2026-31369

creationtimestamp| type| source ---|---|--- 2026-04-21 10:40:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjys76tb3d2r...

CVE-2026-6711

creationtimestamp| type| source ---|---|--- 2026-04-21 10:30:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjyrnbvuip2t 2026-04-28 09:38:39+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mkkbzhrjt32g...

CVE-2026-39467

creationtimestamp| type| source ---|---|--- 2026-04-21 10:25:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjyrfmdo7m2h 2026-04-21 11:16:33+00:00| published-proof-of-concept| Telegram/Kfu-jY0-fwjq6nikv0Y5FAaiWBVRI0K7iXQovwBJu867kaE...

CVE-2026-42239

creationtimestamp| type| source ---|---|--- 2026-04-21 08:38:20+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642r 2026-05-07 20:21:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc25mkshw2c 2026-05-07...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to failure to validate user channel membership when attaching posts to Jira issues, which allows an authenticated attacker with Jira plugin access to read post content and attachments from...

CVE-2026-41316

creationtimestamp| type| source ---|---|--- 2026-04-21 07:48:52+00:00| published-proof-of-concept| https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv 2026-04-21 09:22:21+00:00| seen| https://bsky.app/profile/k0kubun.com/post/3mjynturvyk2i 2026-04-22 02:01:16+00:00| seen|...

CVE-2026-40497

creationtimestamp| type| source ---|---|--- 2026-04-21 03:21:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxzodj3pu2k 2026-04-21 05:15:20+00:00| published-proof-of-concept| Telegram/1Pb-KptaOS8jtUqbqEGgMTqxd6XnuqAfoWvymUwYUnm4klk 2026-04-21 06:14:37+00:00| seen|...