CVE-2026-3643

The Accessibly WordPress plugin (versions ≤ 3.0.3) is vulnerable to an unauthenticated Stored XSS via REST API endpoints /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config. These endpoints have permission_callback set to __return_true, so no auth checks occur. updateWidgetOptions()...

CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API

The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...

MAL-2026-2916 Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 457170b51d87c7f84644a72a71a9979508a99061e7e8fdee3aa8c2e170493b12 The package @jesusvizcaino2021/com.baogong.app-push-permission was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-6293

creationtimestamp| type| source ---|---|--- 2026-04-15 08:17:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjhgs6p7x2m 2026-04-15 15:24:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116409411290435695...

CVE-2026-40688

creationtimestamp| type| source ---|---|--- 2026-04-15 01:07:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjipfz5xkn2a 2026-04-15 01:19:46+00:00| published-proof-of-concept| Telegram/beRkyaQYF6-HbSXwJObWqlvUpmDUmKmHxxmaYmzALf1MGQ...

CVE-2026-40385

creationtimestamp| type| source ---|---|--- 2026-04-15 00:01:50+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjilq3xxjt2u...

(0Day) Docker Desktop credentialHelper Directory Traversal Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to escape the container and execute high-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The specific flaw...

CVE-2026-27304

creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 01:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116406132959257406 2026-04-15 01:30:31+00:00| seen|...

Malicious code in ant-mcp-proxy-for-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564 During use of the package, it silently downloads and executes remote executables or scripts. During analysis, the remote resources were no longer available. Th...

MAL-2026-2669 Malicious code in ant-mcp-proxy-for-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564 During use of the package, it silently downloads and executes remote executables or scripts. During analysis, the remote resources were no longer available. Th...

CVE-2026-34614

creationtimestamp| type| source ---|---|--- 2026-04-14 20:21:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mji7frytpy23...

CVE-2026-27245

creationtimestamp| type| source ---|---|--- 2026-04-14 20:07:48+00:00| seen| Telegram/vjfxnNTg64imjnjxPGtl8BfvNjTDmt0KKDhXRC5WEaV7Sg 2026-04-15 09:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116407902478004814 2026-04-15 09:00:32+00:00| seen|...

CVE-2026-37596

creationtimestamp| type| source ---|---|--- 2026-04-14 17:34:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhw2rqxqm2m...

CVE-2026-4369 Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant Name

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to...

CVE-2020-26141

creationtimestamp| type| source ---|---|--- 2026-04-14 13:10:22+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjhhd6zgtz2a 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-07...

Malicious Package

Overview pt-sc-demo-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-39419

creationtimestamp| type| source ---|---|--- 2026-04-14 05:10:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjgmiziyzj2x...

Vulnerable-Web-App-Scanner

Vulnerable-Web-App-Scanner Pent...

CVE-2026-27672

The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system...

Microsoft Windows App < 2.0.1070.0 RCE (April 2026)

The Windows App Client for Windows Desktop formerly known as Remote Desktop Client installed on the remote host is prior to 2.0.1070.0. It is, therefore, affected by a remote code execution vulnerability: - Use after free in Remote Desktop Client allows an unauthorized attacker to execute code ov...