Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the saveexternaldata function. An attacker can overwrite arbitrary files or inject data into sensitive locations by exploiting a race...

GHSA-4VXV-4XQ4-P84H

creationtimestamp| type| source ---|---|--- 2026-04-01 23:28:03+00:00| seen| Telegram/9GieXm2mvI1hTc72mHyuKx2RXs9Lk1GMse1mK9qILNsF30...

CVE-2026-25835

creationtimestamp| type| source ---|---|--- 2026-04-01 21:40:00+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mihnqjndcd2l 2026-04-02 05:26:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miihs2siqs2s...

GHSA-3GW8-3MG3-JMPC OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

Description Multiple AJAX select handlers in OpenSTAManager = 2.10.1 are vulnerable to Time-Based Blind SQL Injection through the optionsstato GET parameter. The user-supplied value is read from $superselect'stato' and concatenated directly into SQL WHERE clauses as a bare expression, without any...

OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

Description Multiple AJAX select handlers in OpenSTAManager = 2.10.1 are vulnerable to Time-Based Blind SQL Injection through the optionsstato GET parameter. The user-supplied value is read from $superselect'stato' and concatenated directly into SQL WHERE clauses as a bare expression, without any...

VulnHawk

🛡️ VulnHawk — OWASP Top 10 Web Vulnerability Scanner...

CVE-2026-34224

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple...

CVE-2026-3877

creationtimestamp| type| source ---|---|--- 2026-04-01 15:26:18+00:00| published-proof-of-concept| Telegram/olwODmUlHzKZbEJSW7LVNU33CLgdNztsPJfFMY6W51dkA 2026-04-01 15:48:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mih245az3x23...

CVE-2026-22767

creationtimestamp| type| source ---|---|--- 2026-04-01 15:23:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migypf3ceh2n 2026-04-01 15:25:59+00:00| seen| Telegram/4u6pNJfi3nLv5HBYbkAVRO5hA7CasKnKFj2guWNAP2iZfQ 2026-04-01 16:09:03+00:00| seen|...

CVE-2026-4927

Devolutions Server versions 2026.1.6 through 2026.1.11 are vulnerable to an information disclosure flaw in the multi-factor authentication (MFA) feature. The root cause is the exposure of sensitive information during the processing of authenticated API requests. This allows users possessing user ...

CVE-2026-4927

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11...

CVE-2026-4927

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11...

Why we’re still not doing April Fools’ Day

People lost an estimated $442 billion to scams last year worldwide, according to the Global Anti-Scam Alliance. The scale of that is hard to picture, but people's day-to-day scam experience is easier to recognize: Our research found that 44% of people say they encounter mobile scams every single...

CVE-2026-23406

creationtimestamp| type| source ---|---|--- 2026-04-01 11:46:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migmm4p6aq23 2026-04-02 17:36:35+00:00| seen| Telegram/iLkahKLtHBTXrPbdzPdcuEMJtP6ph5Cfo4EzqcCLMOd2c4 2026-04-07 18:00:00+00:00| seen|...

firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...

firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the WebRTC: Signaling component...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine component...

firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...

CVE-2026-4374

creationtimestamp| type| source ---|---|--- 2026-04-01 03:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifpglohut27 2026-04-01 03:18:36+00:00| seen| Telegram/jyatwHTsuiD0gHBEYEMrZjBra-amFrxPGWmF0zTmxDIL8I...