NGINX: NGINX: Certificate revocation bypass when OCSP is enabled

A flaw was found in NGINX, specifically within its ngxstreamsslmodule. When NGINX is configured to verify client certificates and use the Online Certificate Status Protocol OCSP for revocation checks, it fails to properly enforce the revocation status. This allows a Transport Layer Security TLS...

CVE-2026-33708

Chamilo LMS is a learning management system. Prior to 1.11.38, the getuserinfofromusername REST API endpoint returns personal information email, first name, last name, user ID, active status of any user to any authenticated user, including students. There is no authorization check. This...

GHSA-78X4-6X83-JX75

creationtimestamp| type| source ---|---|--- 2026-04-15 19:21:23+00:00| seen| Telegram/7Ck-SXA1c6Vf9FqVW81avKVix-fYO39OzelndhESQPxXBQ...

CVE-2026-6310

creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 21:12:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjksqevtfj2z 2026-04-15 23:26:54+00:00|...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

CVE-2026-23772

creationtimestamp| type| source ---|---|--- 2026-04-15 17:14:00+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116409843068495690 2026-04-16 11:16:12+00:00| seen| Telegram/j-zpZhFSipqPFVaOoufvpDRNhg2whahduAHfYT4AdF4gH4...

CVE-2026-27769

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

CVE-2026-27769

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

CVE-2026-27769

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

CVE-2026-27769

Mattermost CVE-2026-27769 affects Mattermost 10.11.x up to 10.11.12 where the Connected Workspaces feature does not validate that users are correctly owned by the target Connected Workspace. This allows a malicious remote server connected via the Connected Workspaces API to change the displayed s...

CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Mattermost versions 10.11.x = 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API...

SUSE CVE-2026-3842

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpuphysicalmemorymap returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in...

CVE-2026-40090

creationtimestamp| type| source ---|---|--- 2026-04-15 04:31:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjj2rvphkr2z 2026-04-17 17:30:37+00:00| published-proof-of-concept| Telegram/99IlCPIS9qBv42yzAhiUHqlKgiNRb4WP8dx5pH1uskzhuw...

WordPress Nexi XPay plugin <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification vulnerability

Missing Authorization to Unauthenticated Order Status Modification vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Nexi XPay versions = 8.3.0...

GSD-2020-2021

creationtimestamp| type| source ---|---|--- 2026-04-15 02:43:43+00:00| seen| https://bsky.app/profile/installbasebot.bsky.social/post/3mjiurlrfns2k...

GHSA-J2HF-X4Q5-47J3

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:29+00:00| seen| Telegram/4QaIVP4Z6j7I04jn6w3qCKrQ76Fz4EXtpUCBPkRfgX1dqr4...

CVE-2026-27295

creationtimestamp| type| source ---|---|--- 2026-04-15 01:19:06+00:00| seen| Telegram/dGt1m22sw1SGsA9Eug0OSHT5OJOK3joaNLENVhZetMIBpOs 2026-04-15 11:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjqka4vjs2u 2026-04-15 23:07:07+00:00| seen|...

CVE-2026-35032

creationtimestamp| type| source ---|---|--- 2026-04-15 00:49:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjiofpiwpc2a 2026-04-15 01:19:29+00:00| seen| Telegram/4QaIVP4Z6j7I04jn6w3qCKrQ76Fz4EXtpUCBPkRfgX1dqr4...