CVE-2026-39958 oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

CVE-2026-39958 oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

CVE-2026-39958

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

CVE-2026-39958

The oma package manager for AOSC OS is vulnerable to a CRLF injection flaw prior to version 1.25.2 . The oma-topics component fetches metadata for testing repositories (topics) from remote servers but fails to check the name field in the metadata for transliteration. A malicious party can provide...

CVE-2026-34020

creationtimestamp| type| source ---|---|--- 2026-04-09 14:53:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj32qgmxgz2y 2026-04-10 23:26:51+00:00| seen| Telegram/VmPzW9vK7p7Zve81sAsPaRrRR2EIHLwag0ULU7f22817b0 2026-04-12 11:36:29+00:00| seen|...

CVE-2026-40163

creationtimestamp| type| source ---|---|--- 2026-04-09 11:09:20+00:00| published-proof-of-concept| https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292 2026-04-10 19:22:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj62bo53iz2g 2026-04-10 19:31:23+00:00|...

CVE-2024-1490

creationtimestamp| type| source ---|---|--- 2026-04-09 10:58:21+00:00| seen| https://infosec.exchange/users/certvde/statuses/116374392044690456 2026-04-09 10:58:28+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mj2nmmql3a22 2026-04-09 12:02:42+00:00| seen|...

CVE-2026-34177

creationtimestamp| type| source ---|---|--- 2026-04-09 07:11:55+00:00| published-proof-of-concept| https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f 2026-04-09 10:18:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj2lf2ld5q2m 2026-04-09...

CVE-2026-5851

creationtimestamp| type| source ---|---|--- 2026-04-09 06:38:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj273lf3db2m 2026-04-09 07:17:34+00:00| published-proof-of-concept| Telegram/fyBywdxAu4ZMlnyvWwQViOBAirlCdh6Q7LJYaOOUwcD3D30 2026-04-09 07:30:29+00:00| seen|...

Oma injection vulnerability

Oma is an AOSC-Dev open-source package manager for AOSC OS. Versions of Oma prior to 1.25.2 had a injection vulnerability. This vulnerability stemmed from Oma-topics not checking the transliterated value of the name field in metadata, which could allow malicious APT source entries to be added to...

PT-2026-31657

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

CVE-2026-1830

creationtimestamp| type| source ---|---|--- 2026-04-08 20:16:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1830 2026-04-09 04:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mizxwyinu42y 2026-04-09 04:30:30+00:00| seen|...

CVE-2026-5859

creationtimestamp| type| source ---|---|--- 2026-04-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260409 2026-04-09 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116372513097075341 2026-04-09 03:00:33+00:00| seen|...

CVE-2026-39983

creationtimestamp| type| source ---|---|--- 2026-04-08 16:36:30+00:00| published-proof-of-concept| https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q 2026-04-09 19:23:08+00:00| seen| Telegram/opWNLDaOjT2KiHYbiGpHGLhTmz3SmMLK1wCf8I-JAwAiArQ 2026-04-09 20:07:31+00:00...

CVE-2026-39981

creationtimestamp| type| source ---|---|--- 2026-04-08 13:35:21+00:00| published-proof-of-concept| https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw 2026-04-09 19:23:08+00:00| seen| Telegram/opWNLDaOjT2KiHYbiGpHGLhTmz3SmMLK1wCf8I-JAwAiArQ 2026-04-09 20:26:56+00:00| seen|...

CVE-2026-28390

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

CVE-2026-3296

creationtimestamp| type| source ---|---|--- 2026-04-08 03:16:41+00:00| seen| Telegram/dROJOrCDMnkwqXhb9-Y-ghLBhlUA50W24DQUefxFEp990g8 2026-04-08 04:23:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixh4aj6sf25 2026-04-08 04:53:37+00:00| seen|...

CVE-2026-39847

creationtimestamp| type| source ---|---|--- 2026-04-07 23:21:25+00:00| seen| Telegram/ob3ye0FCdfhceb6CimILWC3jRIWmZERTbGMc-OQRsW6HR0 2026-04-08 00:00:38+00:00| seen| https://infosec.exchange/users/offseq/statuses/116366143495848270 2026-04-08 00:00:42+00:00| seen|...

CVE-2026-39307

Summary of CVE-2026-39307 PraisonAI templates installation uses Python’s zipfile.extractall() without validating that archive entries stay within the target extraction directory. This Zip Slip flaw existed prior to version 1.5.113 and could allow arbitrary file writes (potentially to system locat...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...