PT-2026-29863

Name of the Vulnerable Software and Affected Versions leancrypto versions prior to 1.7.1 Description The leancrypto library, a cryptographic library focused on post-quantum cryptography, has an issue in the lc x509 extract name segment function. A cast from size t to uint8 t when handling the...

WordPress plugin Webmention 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-29686

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

PT-2026-29792

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to...

Synthetic Trust Attacks: Modeling How Generative AI Manipulates Human Decisions in Social Engineering Fraud

Imagine receiving a video call from your CFO, surrounded by colleagues, asking you to urgently authorise a confidential transfer. You comply. Every person on that call was fake, and you just lost $25 million. This is not a hypothetical. It happened in Hong Kong in January 2024, and it is becoming...

Apache Traffic Server 安全漏洞

Apache Traffic Server ATS is a scalable HTTP proxy and caching server developed by the Apache Foundation in the United States. Versions of Apache Traffic Server 10.1.1 and earlier, as well as 9.2.12 and earlier versions, have security vulnerabilities. These vulnerabilities stem from defects in PO...

TP-Link Tapo C520WS 安全漏洞

The TP-Link Tapo C520WS is a WiFi camera produced by TP-Link Corporation. The TP-Link Tapo C520WS v2.6 version contains a security vulnerability. This vulnerability stems from a lack of verification for the remaining buffer capacity after dynamic allocation in the HTTP POST body parsing logic. Th...

PT-2026-29846

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C520WS version 2.6 Description A heap-based buffer overflow exists in the HTTP POST body parsing logic due to insufficient boundary validation and missing validation of remaining buffer capacity after dynamic allocation when...

CVE-2026-34746

creationtimestamp| type| source ---|---|--- 2026-04-01 23:27:18+00:00| seen| Telegram/bl6LC3S0UxxO5vDfC3lE4LaBC6ObKrhuhRcx8XqwmK5Cxg 2026-04-02 04:02:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miid4l3hhc2s 2026-04-14 01:37:07+00:00| seen|...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of menu item fields such as icon classes, URLs, and text labels without proper output encoding in the TopMenu plugin. An...

CVE-2026-34572

creationtimestamp| type| source ---|---|--- 2026-04-01 23:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihsa6zpxm2t 2026-04-01 23:28:03+00:00| seen| Telegram/9GieXm2mvI1hTc72mHyuKx2RXs9Lk1GMse1mK9qILNsF30 2026-04-02 03:00:54+00:00| seen|...

CVE-2026-34570

creationtimestamp| type| source ---|---|--- 2026-04-01 22:55:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihrxal2x72t 2026-04-01 23:28:03+00:00| seen| Telegram/9GieXm2mvI1hTc72mHyuKx2RXs9Lk1GMse1mK9qILNsF30 2026-04-02 01:30:30+00:00| seen|...

CVE-2026-3987

creationtimestamp| type| source ---|---|--- 2026-04-01 22:45:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihrfdqeim25 2026-04-01 23:28:03+00:00| seen| Telegram/9GieXm2mvI1hTc72mHyuKx2RXs9Lk1GMse1mK9qILNsF30 2026-04-01 23:28:25+00:00| seen|...

CVE-2025-58669

creationtimestamp| type| source ---|---|--- 2026-04-01 22:28:06+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mihqgjumqp2c...

CVE-2026-34568

creationtimestamp| type| source ---|---|--- 2026-04-01 22:07:13+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-x7wh-g25g-53vg 2026-04-01 22:27:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihqezueu32j 2026-04-01 23:27:52+00:00| seen|...

GHSA-R33W-C82V-X5V7 CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Summary Vulnerability: Blogs Posts Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Stored Cross-Site Scripting via Unsanitized Blog Post Content in Blog Management Categories Description The application fails to properly sanitize user-controlled input wh...

CVE-2026-34567

creationtimestamp| type| source ---|---|--- 2026-04-01 22:05:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihp67z6nt2s 2026-04-01 22:06:50+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-r33w-c82v-x5v7 2026-04-01 23:27:52+00:00| seen|...

CVE-2026-34564

creationtimestamp| type| source ---|---|--- 2026-04-01 22:02:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihoyfna3k2i 2026-04-01 22:04:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-g4pp-fhgf-8653 2026-04-01 23:27:43+00:00| seen|...

CVE-2024-43253

creationtimestamp| type| source ---|---|--- 2026-04-01 22:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mihouqxrhn2f...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Request.post function. An attacker can cause excessive memory allocation by sending a specially crafted multipart request containing large non-file fields. Remediation Upgrade...