31170 matches found
CVE-2026-35402
creationtimestamp| type| source ---|---|--- 2026-04-17 22:26:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpxscq4l32f...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the authentication process. An attacker can gain unauthorized access to multiple authenticated...
CVE-2026-6451
creationtimestamp| type| source ---|---|--- 2026-04-17 10:27:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjopm4miod2k 2026-04-17 12:32:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjowljd7yw2n...
CVE-2026-30457
creationtimestamp| type| source ---|---|--- 2026-04-17 06:35:41+00:00| seen| https://bsky.app/profile/breachandbuild.bsky.social/post/3mjocnufyha26...
Note Mark 安全漏洞
Note Mark is a web-based Markdown note-taking application developed by Leo Spratt. Versions of Note Mark prior to 0.19.1 contained a security vulnerability. This vulnerability stemmed from the login endpoint only performing bcrypt password verification when a username was provided. This allowed...
CVE-2026-40262
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an...
[SECURITY] Fedora 44 Update: spacebar-6.6.4-1.fc44
Spacebar is a telepathy-qt based SMS application that primarily targets Plasm a Mobile...
[SECURITY] Fedora 44 Update: kf6-kuserfeedback-6.25.0-1.fc44
Framework for collecting user feedback for apps via telemetry and surveys...
SQL Injection
Overview @saltcorn/mobile-app is a Saltcorn mobile app for Android and iOS Affected versions of this package are vulnerable to SQL Injection via the getSyncRows and getDelRows functions. An attacker can execute arbitrary SQL commands, exfiltrate sensitive data, modify or delete database contents,...
GHSA-533Q-W4G6-5586 PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Summary The upload PATCH flow under /files/:uploadId validates the mounted request path using the still-encoded req.path, but the downstream tus handler later writes using the decoded req.params.uploadId. In deployments that use a supported custom PSITRANSFERUPLOADDIR whose basename prefixes a...
CVE-2026-33083
creationtimestamp| type| source ---|---|--- 2026-04-16 20:58:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjncfmmcg22r 2026-04-17 05:18:08+00:00| published-proof-of-concept| Telegram/MfRD7ll8pGcGi3RGemlsgII30sQ-Y2l5bpdSqMK2BdYlKE 2026-04-20 22:00:28+00:00| seen|...
Europe’s Online Age Verification App Is Here
Available for free to any company that wants to use it, the “completely anonymous” app puts the pressure on porn sites and social media platforms to start blocking access by minors...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoriong operands are vulnerable to cross-site scripting (GHSA-h8r8-wccr-v5f2, GHSA-cjmm-f4jc-qw8r) and prototype polution (GHSA-cj63-jhhr-wcxv)
Summary Node.js module dompurify is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to cross-site scripting GHSA-h8r8-wccr-v5f2, GHSA-cjmm-f4jc-qw8r and prototype polution GHSA-cj63-jhhr-wcxv. This...
EUVD-2026-23196
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs, potentially causing the iOS device to become temporarily inoperable...
CVE-2026-1620
creationtimestamp| type| source ---|---|--- 2026-04-16 09:16:03+00:00| seen| Telegram/yXoKEH-Nbvx8vVZVETbcb5fnBU2DfxjhcC8NzdaVOFnAe1M 2026-04-16 11:08:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmbhxfs342q...
CVE-2026-3861
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...
CVE-2026-3861
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...
CVE-2026-3861
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...
CVE-2026-3861
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...