CVE-2026-1950

creationtimestamp| type| source ---|---|--- 2026-04-24 08:14:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mka3hjof4t2n 2026-04-24 09:16:19+00:00| published-proof-of-concept| Telegram/X1JyBiiNxoSYu-ldDRrQFjaq89QLca8O12-lN-DTEtiPeU 2026-05-11 19:37:07+00:00| seen|...

CVE-2026-41430

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-41317

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

CVE-2026-41430

Summary: CVE-2026-41430 affects Press, a Frappe custom app running in Frappe Cloud. The issue is a reflected XSS on the login redirect parameter, arising from inadequate validation of redirect URLs. The publicly disclosed fix (commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6) restricts redirects t...

CVE-2026-41430 Press vulnerable to reflected XSS on login redirection

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-41430 Press vulnerable to reflected XSS on login redirection

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-41317

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS.press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit...

CVE-2026-4117

creationtimestamp| type| source ---|---|--- 2026-04-23 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mk76czqxax2s...

CVE-2026-32210

creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:09+00:00| published-proof-of-concept| Telegram/kiTcjsXT1hi2Y3u94e7GhzIuEtNJE-kdjO7sui75MorBPg 2026-04-23 23:27:16+00:00| seen| Telegram/IhrbuMncMOQ2aXKn55DBnsRKZnrdzyQXI4i7tcZ3JysOVtE 2026-04-25 01:01:03+00:00| seen|...

Missing Authorization

Overview @actual-app/sync-server is an actual syncing server Affected versions of this package are vulnerable to Missing Authorization via the change-password endpoint, which lacks proper authorization checks. An attacker can gain administrative privileges by overwriting the password hash for the...

CVE-2026-6550

creationtimestamp| type| source ---|---|--- 2026-04-23 20:20:50+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mk6tla7hwe2h...

CLSA-2026-1776949031 flatpak: Fix of CVE-2026-34079

CVE-2026-34079: restrict cached-file removal to alphanumeric targets in flatpakswitchsymlinkandremove to prevent path-traversal unlink via a sandboxed-app-controlled symlink...

CVE-2026-29198

In Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured...

SUSE SLES15 Security Update : flatpak (SUSE-SU-2026:1541-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1541-1 advisory. - CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox escape, host file access and...

CVE-2026-29198

In Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured...

CVE-2026-29198

In Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured...

CVE-2026-29198

In Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured...

CVE-2026-41586

creationtimestamp| type| source ---|---|--- 2026-04-22 12:54:53+00:00| published-proof-of-concept| https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 2026-04-22 12:54:53+00:00| published-proof-of-concept|...

CVE-2026-1395

creationtimestamp| type| source ---|---|--- 2026-04-22 12:53:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3k4ghwtd2v 2026-04-24 08:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mka4imhovm2h...

CVE-2026-6515

creationtimestamp| type| source ---|---|--- 2026-04-22 12:50:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk3jwdl7pl2u 2026-04-24 07:57:51+00:00| seen| https://ccb.belgium.be/advisories/warning-11-new-vulnerabilities-gitlab-ce-and-ee-editions-patch-immediately...