CVE-2026-5237

creationtimestamp| type| source ---|---|--- 2026-04-01 01:15:30+00:00| published-proof-of-concept| Telegram/I7gM78d3mp9wugorspZkHmlDKuo-8DymFEq-4a44ip7mrow 2026-04-01 02:53:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifosvbro624...

[SECURITY] Fedora 43 Update: gstreamer1-vaapi-1.26.11-1.fc43

A collection of GStreamer plugins to let you make use of VA API video acceleration from GStreamer applications. Includes elements for video decoding, display, encoding and post-processing using VA API subject to hardware limitations...

PT-2026-29430

XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting XSS related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox...

PT-2026-29521

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific penalty rates for overdue payments. While the frontend interface prevents users from entering...

Quantum-Safe Code Auditing: LLM-Assisted Static Analysis and Quantum-Aware Risk Scoring for Post-Quantum Cryptography Migration

The impending arrival of cryptographically relevant quantum computers CRQCs threatens the security foundations of modern software: Shor's algorithm breaks RSA, ECDSA, ECDH, and Diffie-Hellman, while Grover's algorithm reduces the effective security of symmetric and hash-based schemes. Despite NIS...

The vulnerability of the qtrr_endpoint_post() function in the net/qrtr/af_qrtr.c module allows for exploitation by attackers, enabling them to cause service interruptions on Qualcomm IPC-based Linux operating system kernels.

The vulnerability of the qrtrendpointpost function in the net/qrtr/afqrtr.c module, which is part of the Qualcomm IPC kernel for Linux operating systems, is related to the use of an uninitialized variable. Exploiting this vulnerability could allow a attacker to cause a service failure...

Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-1522)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1522 advisory. Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword...

WordPress User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field vulnerability

WordPress User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor plugin = 3.15.5 - Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Post Author Reassignment via Avatar Field vulnerability discovered by type5afe in WordPress Plugin Profile...

CVE-2026-34980

creationtimestamp| type| source ---|---|--- 2026-03-31 23:29:02+00:00| published-proof-of-concept| https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf 2026-04-08 06:58:20+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3mixpqgctwh2s 2026-04-08...

CVE-2026-34367

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01 05:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifvvyxjwx2x...

CVE-2026-35056

creationtimestamp| type| source ---|---|--- 2026-03-31 23:16:41+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-35056 2026-04-01 02:01:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miflutj6hx2d 2026-04-01 03:18:10+00:00| seen|...

CVE-2025-71279

creationtimestamp| type| source ---|---|--- 2026-03-31 23:16:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-71279 2026-04-01 02:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miflvbmlj72r 2026-04-01 03:09:55+00:00| seen|...

CVE-2025-71278

creationtimestamp| type| source ---|---|--- 2026-03-31 23:16:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-71278 2026-04-01 02:01:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miflv35vio25 2026-04-01 03:17:49+00:00|...

GHSA-4RWM-C5MJ-WH7X Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter

Summary The inventory module's itemsave endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data...

CVE-2026-5213

creationtimestamp| type| source ---|---|--- 2026-03-31 22:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifb7btvxu24 2026-03-31 23:20:32+00:00| published-proof-of-concept| Telegram/fnqeA0DSzUxsfUgrLtw39NRieZko7R6ZhEkNfy6t9mpSrc 2026-04-01 03:49:16+00:00| seen|...

CVE-2026-34586

creationtimestamp| type| source ---|---|--- 2026-03-31 22:12:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mif737tl5y2q...

CVE-2026-34441

creationtimestamp| type| source ---|---|--- 2026-03-31 22:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mif6pjyp7v22...

CVE-2026-34956

creationtimestamp| type| source ---|---|--- 2026-03-31 21:34:34+00:00| seen| https://bsky.app/profile/shindo.bsky.social/post/3mif4xv3rhs2q 2026-05-05 17:13:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml4op447mx2p 2026-05-20 14:10:07+00:00| seen|...

EUVD-2026-17595

An arbitrary file overwrite vulnerability in Zora: Post, Trade, Earn Crypto v2.60.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

EUVD-2026-17583

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific interest rates. While the frontend interface prevents users from entering negative numbers, this...