CVE-2026-5851

creationtimestamp| type| source ---|---|--- 2026-04-09 06:38:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj273lf3db2m 2026-04-09 07:17:34+00:00| published-proof-of-concept| Telegram/fyBywdxAu4ZMlnyvWwQViOBAirlCdh6Q7LJYaOOUwcD3D30 2026-04-09 07:30:29+00:00| seen|...

oma 注入漏洞

Oma is an AOSC-Dev open-source package manager for AOSC OS. Versions of Oma prior to 1.25.2 had a injection vulnerability. This vulnerability stemmed from Oma-topics not checking the transliterated value of the name field in metadata, which could allow malicious APT source entries to be added to...

PT-2026-31657

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

CVE-2026-1830

creationtimestamp| type| source ---|---|--- 2026-04-08 20:16:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1830 2026-04-09 04:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mizxwyinu42y 2026-04-09 04:30:30+00:00| seen|...

CVE-2026-5859

creationtimestamp| type| source ---|---|--- 2026-04-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260409 2026-04-09 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116372513097075341 2026-04-09 03:00:33+00:00| seen|...

CVE-2026-39983

creationtimestamp| type| source ---|---|--- 2026-04-08 16:36:30+00:00| published-proof-of-concept| https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q 2026-04-09 19:23:08+00:00| seen| Telegram/opWNLDaOjT2KiHYbiGpHGLhTmz3SmMLK1wCf8I-JAwAiArQ 2026-04-09 20:07:31+00:00...

CVE-2026-39981

creationtimestamp| type| source ---|---|--- 2026-04-08 13:35:21+00:00| published-proof-of-concept| https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw 2026-04-09 19:23:08+00:00| seen| Telegram/opWNLDaOjT2KiHYbiGpHGLhTmz3SmMLK1wCf8I-JAwAiArQ 2026-04-09 20:26:56+00:00| seen|...

CVE-2026-28390

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

CVE-2026-3296

creationtimestamp| type| source ---|---|--- 2026-04-08 03:16:41+00:00| seen| Telegram/dROJOrCDMnkwqXhb9-Y-ghLBhlUA50W24DQUefxFEp990g8 2026-04-08 04:23:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixh4aj6sf25 2026-04-08 04:53:37+00:00| seen|...

CVE-2026-39847

creationtimestamp| type| source ---|---|--- 2026-04-07 23:21:25+00:00| seen| Telegram/ob3ye0FCdfhceb6CimILWC3jRIWmZERTbGMc-OQRsW6HR0 2026-04-08 00:00:38+00:00| seen| https://infosec.exchange/users/offseq/statuses/116366143495848270 2026-04-08 00:00:42+00:00| seen|...

CVE-2026-39307

Summary of CVE-2026-39307 PraisonAI templates installation uses Python’s zipfile.extractall() without validating that archive entries stay within the target extraction directory. This Zip Slip flaw existed prior to version 1.5.113 and could allow arbitrary file writes (potentially to system locat...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-35515

NestJS/core (@nestjs/core) contains a vulnerability in SseStream._transform() where un sanitized interpolation of upstream data into SSE output allows an attacker to inject arbitrary SSE events, spoof event types, and corrupt reconnection state. The issue arises from inserting message.type and me...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-24660

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:23+00:00| seen| https://infosec.place/objects/a2376c08-1874-41bc-927d-b5b917cc6297 2026-04-07 15:29:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3sfcjxx2p 2026-04-07 17:28:45+00:00|...

CVE-2026-5627

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:18+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mivyjoek5x26 2026-04-07 14:30:22+00:00| seen| https://infosec.exchange/users/offseq/statuses/116363900721699665 2026-04-07 14:44:48+00:00| seen|...

CVE-2024-43028

creationtimestamp| type| source ---|---|--- 2026-04-07 09:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mivicunecn2a 2026-04-07 10:00:56+00:00| seen| https://bsky.app/profile/potato.software/post/3mivjhz5lhn2n...

CVE-2026-5465

creationtimestamp| type| source ---|---|--- 2026-04-07 08:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mivcqtypg327 2026-04-07 09:15:25+00:00| seen| Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94 2026-04-07 09:37:20+00:00| seen|...

CVE-2026-1114

creationtimestamp| type| source ---|---|--- 2026-04-07 07:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116362132042797237 2026-04-07 09:15:25+00:00| seen| Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94 2026-04-07 09:32:19+00:00| seen|...

CVE-2025-54328

creationtimestamp| type| source ---|---|--- 2026-04-07 06:02:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miv45ttzr425 2026-04-07 08:06:44+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mivd3t5d2m2o 2026-04-08 08:07:19+00:00| seen|...