CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-35515

NestJS/core (@nestjs/core) contains a vulnerability in SseStream._transform() where un sanitized interpolation of upstream data into SSE output allows an attacker to inject arbitrary SSE events, spoof event types, and corrupt reconnection state. The issue arises from inserting message.type and me...

CVE-2026-24660

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:23+00:00| seen| https://infosec.place/objects/a2376c08-1874-41bc-927d-b5b917cc6297 2026-04-07 15:29:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3sfcjxx2p 2026-04-07 17:28:45+00:00|...

CVE-2026-5627

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:18+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mivyjoek5x26 2026-04-07 14:30:22+00:00| seen| https://infosec.exchange/users/offseq/statuses/116363900721699665 2026-04-07 14:44:48+00:00| seen|...

CVE-2024-43028

creationtimestamp| type| source ---|---|--- 2026-04-07 09:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mivicunecn2a 2026-04-07 10:00:56+00:00| seen| https://bsky.app/profile/potato.software/post/3mivjhz5lhn2n...

CVE-2026-5465

creationtimestamp| type| source ---|---|--- 2026-04-07 08:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mivcqtypg327 2026-04-07 09:15:25+00:00| seen| Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94 2026-04-07 09:37:20+00:00| seen|...

CVE-2026-1114

creationtimestamp| type| source ---|---|--- 2026-04-07 07:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116362132042797237 2026-04-07 09:15:25+00:00| seen| Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94 2026-04-07 09:32:19+00:00| seen|...

data-generation-tool (>=1.0.1, <=1.1.1), openrlhf (>=0.4.0, <=0.4.2) +2 more potentially affected by CVE-2026-1839 via transformers (4.43.3)

transformers PYPI version 4.43.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - data-generation-tool =1.0.1, =0.4.0, =0.0.1, =0.1.1, =0.2.1 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

CVE-2025-54328

creationtimestamp| type| source ---|---|--- 2026-04-07 06:02:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miv45ttzr425 2026-04-07 08:06:44+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mivd3t5d2m2o 2026-04-08 08:07:19+00:00| seen|...

CVE-2026-35022

creationtimestamp| type| source ---|---|--- 2026-04-06 21:20:59+00:00| seen| Telegram/8Tvza3k4qy2IjH2O3f59isxEIVitW69EvgGBkLG1GZexI3E 2026-04-07 04:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116361542195290387 2026-04-07 04:30:30+00:00| seen|...

CVE-2026-35470

creationtimestamp| type| source ---|---|--- 2026-04-06 18:24:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitv4qwen22t 2026-04-06 18:24:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitv5jd3vu2j 2026-04-06 19:20:37+00:00| seen|...

CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

RHSA-2025:7458

creationtimestamp| type| source ---|---|--- 2026-04-06 15:19:47+00:00| seen| Telegram/zfToAAWf8eWnJ7ba07A0EZZiZLhP55gYdeGjYzJA6KMcCw 2026-04-06 15:20:12+00:00| seen| Telegram/0sUuWW8J84hCZb1n0MF5lAvDyk6dii4XfiqOlA0c3Bj-PlY 2026-04-06 15:20:35+00:00| seen|...

CVE-2026-5704

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload. An attacker can introduce unauthorized files with arbitrary content by providing a specially crafted archive that bypasses pre-extraction inspection mechanisms. Workaround This vulnerability can be mitigated by...

CVE-2026-5611

creationtimestamp| type| source ---|---|--- 2026-04-06 04:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misevgz2sn2t 2026-04-06 05:16:26+00:00| published-proof-of-concept| Telegram/kWexhLh74l4dPPtnd5KMBhXNW8mWfIV9fawO6hseg4Rc4 2026-04-06 05:20:04+00:00| seen|...

CVE-2026-5605

creationtimestamp| type| source ---|---|--- 2026-04-06 00:00:38+00:00| seen| https://infosec.exchange/users/offseq/statuses/116354818818250445 2026-04-06 00:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mirxhp6vtu2f 2026-04-06 01:15:46+00:00| published-proof-of-concept|...

CVE-2026-4272

creationtimestamp| type| source ---|---|--- 2026-04-05 22:16:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mirro4yfa32c 2026-04-05 23:15:15+00:00| seen| Telegram/IfrlHOuFgZassia96sKylyqySIrKIXh5iSll0o84ef6g8E 2026-04-05 23:47:48+00:00| seen|...

CVE-2026-5548

creationtimestamp| type| source ---|---|--- 2026-04-05 09:01:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miqfa6kvi42g 2026-04-05 09:15:46+00:00| published-proof-of-concept| Telegram/DODGRJWtrApuUPCkLVkjLM9fRARhGaclk9hZ8B80y7duydc 2026-04-05 09:33:07+00:00| seen|...