MINI-Q649-54VJ-88M4

Bulletin has no description...

MINI-JR2W-W2PF-86M3

Bulletin has no description...

MINI-PFR4-MFPM-27H2

Bulletin has no description...

GHSA-C3H3-89QF-JQM5

creationtimestamp| type| source ---|---|--- 2026-04-09 11:16:38+00:00| seen| Telegram/nE1gVyn8jRxbZ-OhSUewb4fvVZDT-qjlGTvhk8YiMctdMk...

CVE-2026-4436

creationtimestamp| type| source ---|---|--- 2026-04-09 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-02 2026-04-09 21:22:41+00:00| published-proof-of-concept| Telegram/3Mh7UNYEFXpMlnqwZliCqvVomRJKwd1lMrCq1dUb7HxJoTM 2026-04-09 21:37:12+00:00| seen|...

CVE-2026-3568

The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validatio...

CVE-2026-5832

creationtimestamp| type| source ---|---|--- 2026-04-09 03:18:04+00:00| published-proof-of-concept| Telegram/k6H1jBRyYuwqPn43znhK7mg4465TougGvrd7kOsXjIgmqE 2026-04-09 04:44:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizypx5iqv2j...

CVE-2026-3568 MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update

The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validatio...

CVE-2026-3568 MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update

The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validatio...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.22 contained security vulnerabilities. These vulnerabilities stemmed from the execution of reference extensions before channel and DM authorization checks, which could allow...

PT-2026-31567

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress versions up to and including 4.18.3 Description The MStore API plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This stems from the update user profile function within...

CVE-2026-33350

creationtimestamp| type| source ---|---|--- 2026-04-08 23:33:06+00:00| seen| Telegram/nb1jq11aD1wlJ1YglJrLy9zN5IvfOUCCPtd3YJ7-KFKCMzY 2026-04-09 07:16:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj2b6vhc752s 2026-04-19 04:07:06+00:00| seen|...

Server-side Request Forgery (SSRF)

Overview @frontmcp/sdk is a FrontMCP SDK Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the initialize process. An attacker can access internal network resources or sensitive local files by submitting a crafted OpenAPI specification containing malicious $r...

CVE-2026-35169

creationtimestamp| type| source ---|---|--- 2026-04-08 21:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizbr4qwcu2i 2026-04-09 01:26:43+00:00| published-proof-of-concept| Telegram/LyxiOFuM6k6JRrVhGkcWrU8R1Vj8dluNTy4xGDA54CBUTMw 2026-04-09 07:15:44+00:00| seen|...

CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to rea...

CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to rea...

kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM subsystem. An authenticated local attacker could exploit a Use-After-Free UAF vulnerability in the /proc/net/atm/lec handling. This flaw occurs due to improper devput calls without prior devhold calls, leading to an imbalance i...

EUVD-2026-20469

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigdsend Reproducer available at 1. The ATM send path sendmsg - vccsendmsg - sigdsend reads the vcc pointer from msg-vcc and uses it directly without any validation. This...

EUVD-2026-20472

Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the itemid parameter lacks proper authorization checks. Attackers can enumerate sequential itemid values to access and retrieve image previews from other...

CVE-2026-31411 net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigdsend Reproducer available at 1. The ATM send path sendmsg - vccsendmsg - sigdsend reads the vcc pointer from msg-vcc and uses it directly without any validation. This...