CVE-2026-6835

creationtimestamp| type| source ---|---|--- 2026-04-22 04:12:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk2myiq6ty2p...

Mythos and the Unverified Cage: Z3-Based Pre-Deployment Verification for Frontier-Model Sandbox Infrastructure

The April 2026 Claude Mythos sandbox escape exposed a critical weakness in frontier AI containment: the infrastructure surrounding advanced models remains susceptible to formally characterizable arithmetic vulnerabilities. Anthropic has not publicly characterized the escape vector; some secondary...

PT-2026-34608

Name of the Vulnerable Software and Affected Versions Marko affected versions not specified Description When dynamic text is interpolated into or tags, the runtime fails to prevent tag breakout if the closing tag uses non-lowercase casing. This occurs because the system uses case-sensitive regula...

openSUSE 16 Security Update : Botan (openSUSE-SU-2026:20566-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20566-1 advisory. This update for Botan fixes the following issue: - CVE-2026-32884: Certificate validation bypass due to mixed-case Common Name in X.509 certificates...

CVE-2026-41136 free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer

free5GC AMF provides Access & Mobility Management Function AMF for free5GC, an an open-source project for 5th generation 5G mobile core networks. Prior to version 1.4.3, the HTTPUEContextTransfer handler in internal/sbi/apicommunication.go does not include a default case in the Content-Type switc...

Astro: XSS in define:vars via incomplete </script> tag sanitization

Summary The defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex //g to sanitize values injected into inline tags via the define:vars directive. HTML parsers close elements case-insensitively and also accept whitespace or / before the closing , allowing ...

CVE-2026-34321

...

CVE-2026-34314

Oracle Financial Services Analytical Applications Infrastructure (OFSAAI), specifically the Platform component, is affected in versions 8.0.7.9, 8.0.8.7, and 8.1.2.5. The vulnerability allows a low-privilege, unauthenticated attacker with network access via HTTP to cause unauthorized creation, de...

CVE-2026-34313

CVE-2026-34313 affects Oracle Financial Services Analytical Applications Infrastructure (OFSAAI), Platform component. Affected versions: 8.0.7.9, 8.0.8.7, 8.1.2.5. An attacker with network access via HTTP and low privileges can compromise OFSAAI and gain unauthorized access to critical data or co...

CVE-2026-34312

The CVE-2026-34312 entry concerns Oracle Database Server's RDBMS component with affected versions 19.3–19.30. It describes a vulnerability that an attacker with Row Access Method privilege and network access via multiple protocols can exploit to achieve unauthorized read access to a subset of RDB...

CVE-2026-34282

...

CVE-2026-41297

creationtimestamp| type| source ---|---|--- 2026-04-21 01:07:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxs7kpnuw2k 2026-04-21 01:18:48+00:00| seen| Telegram/wz0kiY1tb5u805P38ZVeawoTKuvhTd24bOWQm-Bt9SZek-4...

PT-2026-34233

Summary The defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex //g to sanitize values injected into inline tags via the define:vars directive. HTML parsers close elements case-insensitively and also accept whitespace or / before the closing , allowing ...

CVE-2026-41389

creationtimestamp| type| source ---|---|--- 2026-04-20 19:43:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjxa3jn3yo2h...

CVE-2026-6650

creationtimestamp| type| source ---|---|--- 2026-04-20 16:12:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwucnz2j62p...

OPENSUSE-SU-2026:20566-1 Security update for Botan

This update for Botan fixes the following issue: - CVE-2026-32884: Certificate validation bypass due to mixed-case Common Name in X.509 certificates bsc1261993...

CVE-2026-32965

creationtimestamp| type| source ---|---|--- 2026-04-19 19:30:00+00:00| seen| https://jvn.jp/en/vu/JVNVU94271449 2026-04-20 05:17:09+00:00| seen| Telegram/oT3io0aR7EQyKUnAhTuUuKTmw-PFwRgwwLAn7oSA51QT1kY 2026-04-20 06:19:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvt67q6qq2k...

SoK: Reshaping Research on Network Intrusion Detection Systems

Network Intrusion Detection Systems NIDS have been studied for decades. Hundreds of papers have, e.g., proposed ways to enhance, harden or bypass NIDS. However, the findings of prior literature are hardly reflected in real-world operational contexts. Such a disconnection is problematic for resear...

PT-2026-33634

Name of the Vulnerable Software and Affected Versions UltraDAG version 0.1 Description A non-council attacker can submit a signed 'SmartOp::Vote' transaction that successfully passes signature, nonce, and balance prechecks. However, the authorization check fails only after state mutation has...

CVE-2026-34164

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data PII, citizen identifier...