CVE-2026-35520

Pi-hole FTLDNS (pihole-FTL) versions 6.0 through

CVE-2026-35520 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DHCP lease time configuration parameter dhcp.leaseTime. This vulnerability allows an...

CVE-2026-35520 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DHCP lease time configuration parameter dhcp.leaseTime. This vulnerability allows an...

CVE-2026-35520

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DHCP lease time configuration parameter dhcp.leaseTime. This vulnerability allows an...

CVE-2026-35520 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DHCP lease time configuration parameter dhcp.leaseTime. This vulnerability allows an...

CVE-2026-35462

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expire...

CVE-2026-35462

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expire...

CVE-2026-20911

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:05+00:00| seen| https://infosec.place/objects/8d7948f0-fd3d-4ef0-a9b2-0e673f03b577 2026-04-07 17:28:45+00:00| published-proof-of-concept| Telegram/Gs14uYrPx8dSRKbcySFOH0HeB-4fySLVXH6YHMHvpJUT40 2026-04-10 22:37:07+00:00| seen|...

CVE-2026-25376

creationtimestamp| type| source ---|---|--- 2026-04-07 10:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mivl47q4yp2j...

RHSA-2026:6572 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

MAL-2026-2503 Malicious code in genesis-1p-tools-rpm-bundle (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d7a13386739eb38301be183f8fafa0281beef0adc59037619ca870c2b075cd58 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-5719

creationtimestamp| type| source ---|---|--- 2026-04-07 06:30:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miv5paef3u2i...

CVE-2025-57834

creationtimestamp| type| source ---|---|--- 2026-04-07 06:02:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miv462gvya2s 2026-04-08 03:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mixcgodylv2q 2026-05-10 20:00:00+00:00| seen|...

CVE-2026-20432

creationtimestamp| type| source ---|---|--- 2026-04-07 06:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miv44zzap62i 2026-04-07 14:52:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mivzrg66ve2j 2026-04-07 15:20:46+00:00| seen|...

CVE-2026-39324

creationtimestamp| type| source ---|---|--- 2026-04-07 03:00:08+00:00| published-proof-of-concept| Telegram/c-9nM9mslhGNLfW7QsPDgkIMfnwsyr-9epKeORTrIU88Ta0 2026-04-07 03:00:11+00:00| published-proof-of-concept| Telegram/HzOqBhluyLlt9yC4XLrvomtg4oZEtrGKU8ieYWYpvETezc 2026-04-07 19:35:16+00:00| see...

EUVD-2026-19551

A vulnerability was detected in Totolink A7100RU 7.4cu.2313b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument tz results in os command injection. Remote exploitation of the attack is possible. The exploit is now...

Windows Service for User (S4U) Scheduled Task Persistence Schedule Trigger

This Metasploit module creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires...

CVE-2024-36058

The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter biblist in /cgi-bin/koha/opac-sendbasket.pl, allowing library users to read arbitrary data from the database...

PT-2026-30881

Name of the Vulnerable Software and Affected Versions Koha Library versions prior to 23.05.10 Description The Send Basket functionality is susceptible to Time-Based SQL Injection, a technique where an attacker sends a query that forces the database to wait for a specific amount of time before...

Time-Domain Voice Identity Morphing (TD-VIM): A Signal-Level Approach to Morphing Attacks on Speaker Verification Systems

In biometric systems, it is a common practice to associate each sample or template with a specific individual. Nevertheless, recent studies have demonstrated the feasibility of generating "morphed" biometric samples capable of matching multiple identities. These morph attacks have been recognized...