CVE-2026-24913

creationtimestamp| type| source ---|---|--- 2026-04-07 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN33581068/ 2026-04-08 06:19:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixnln6bez2h 2026-04-08 07:15:31+00:00| seen|...

CVE-2026-39332

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:33+00:00| seen| Telegram/MwNatB1kDaoxbSrZihFWwC12FE1HreAtxbr2hmQcZTjcFY 2026-04-07 19:39:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwjrzupty23 2026-04-08 08:15:04+00:00| seen|...

CVE-2026-39337

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:33+00:00| seen| Telegram/MwNatB1kDaoxbSrZihFWwC12FE1HreAtxbr2hmQcZTjcFY 2026-04-07 19:48:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwkcbdjif2g 2026-04-08 00:41:21+00:00| seen|...

CVE-2026-39329

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:24+00:00| seen| Telegram/d9ntGhgAXUNib3HVhoGCh5gTeuhEkXLp8JxGb0TRA4y7Jks 2026-04-08 08:09:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixtply4fk2x 2026-04-12 08:07:07+00:00| seen|...

CVE-2026-39327

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:24+00:00| seen| Telegram/d9ntGhgAXUNib3HVhoGCh5gTeuhEkXLp8JxGb0TRA4y7Jks 2026-04-08 09:07:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixwxybqkw2s 2026-04-11 01:07:08+00:00| seen|...

CVE-2026-39323

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:16+00:00| seen| Telegram/yEepCm2Odjvpf0uI90hS1hr8dhkmidpoORZ8hNAmW5Xwfo 2026-04-07 19:44:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwk4carkf2q 2026-04-08 09:07:35+00:00| seen|...

CVE-2026-35576

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:02+00:00| published-proof-of-concept| Telegram/b7kqkVlyupyGML8IRNuJF5vW46V1gBKnrWAnE54KrYglqM 2026-04-07 19:35:16+00:00| seen| Telegram/yEepCm2Odjvpf0uI90hS1hr8dhkmidpoORZ8hNAmW5Xwfo 2026-04-08 10:00:28+00:00| seen|...

CVE-2026-39330

creationtimestamp| type| source ---|---|--- 2026-04-07 19:34:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwjjg4oll2q 2026-04-07 19:35:24+00:00| seen| Telegram/d9ntGhgAXUNib3HVhoGCh5gTeuhEkXLp8JxGb0TRA4y7Jks 2026-04-07 19:35:33+00:00| seen|...

CVE-2026-35581

creationtimestamp| type| source ---|---|--- 2026-04-07 19:33:54+00:00| seen| Telegram/2sVgvXJxKnqdd0t3ix7z2PFFoP4qMIqNMJ7HHwXtd94aJL4 2026-04-17 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjp3vgyzwy2v...

CVE-2026-35574

creationtimestamp| type| source ---|---|--- 2026-04-07 19:33:43+00:00| seen| Telegram/7stdzVfIjMVb7tvEQLoql-CFRLg5JIYu0eUqsXCfmQ30DI4 2026-04-07 19:33:54+00:00| seen| Telegram/2sVgvXJxKnqdd0t3ix7z2PFFoP4qMIqNMJ7HHwXtd94aJL4 2026-04-17 05:07:08+00:00| seen|...

CVE-2026-5734

creationtimestamp| type| source ---|---|--- 2026-04-07 19:33:24+00:00| seen| Telegram/UR5TCX5vufcj9skQtsOGmPNpHO32u3eWlC-vhPXaaDs7Lc 2026-04-08 12:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6aeqsg2z 2026-04-09 00:01:20+00:00| seen|...

CVE-2026-39326

creationtimestamp| type| source ---|---|--- 2026-04-07 19:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwjfl5pyy2z 2026-04-07 19:35:24+00:00| seen| Telegram/d9ntGhgAXUNib3HVhoGCh5gTeuhEkXLp8JxGb0TRA4y7Jks 2026-04-08 09:07:42+00:00| seen|...

CVE-2026-39354 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user's existing question by supplying that question's public ID as the postId parameter to POST /questions/ask...

CVE-2026-39354 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user's existing question by supplying that question's public ID as the postId parameter to POST /questions/ask...

CVE-2026-39354

CVE-2026-39354 affects Scoold prior to version 1.66.2, where an authenticated low-privilege user can overwrite another user’s question by supplying the victim question’s public ID as postId to POST /questions/ask. This enables direct integrity loss in an existing discussion thread. Root cause is ...

CVE-2026-39347 OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

OrangeHRM is a comprehensive human resource management HRM system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability...

Improper Privilege Management

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Privilege Management in the POST /sessions/:sessionKey/kill process. An attacker can terminate active subagent sessions by sending requests with only read-scoped identity-bearing...

CVE-2026-4277

A flaw was found in Django. This vulnerability allows an attacker to bypass permission validation by submitting forged POST data to the GenericInlineModelAdmin component. As a result, unauthorized inline model instances could be added, potentially leading to privilege abuse or unauthorized data...

CVE-2026-4292

A flaw was found in Django. Admin changelist forms utilizing ModelAdmin.listeditable were susceptible to improper access control. A remote attacker could exploit this by sending forged POST data, leading to the unauthorized creation of new instances within the application. Mitigation Mitigation f...

USN-8154-1: Django vulnerabilities

Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. CVE-2026-33033 It was discovered that Djang...