CVE-2026-41177

creationtimestamp| type| source ---|---|--- 2026-04-25 21:02:32+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/81660 2026-04-25 23:00:15+00:00| published-proof-of-concept| Telegram/LSdGKxP2miqFlHNpxxgJAVXofgySUEN1UvPjtEQ3z8Pk2CQ 2026-04-26 03:00:05+00:00| published-proof-of-concept...

CVE-2026-6043

P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the...

CVE-2026-5767

creationtimestamp| type| source ---|---|--- 2026-04-25 12:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkd2eoas5o2l...

CVE-2026-31674

creationtimestamp| type| source ---|---|--- 2026-04-25 10:20:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116464839048739557 2026-04-25 22:24:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116467685885034222 2026-05-05 20:00:00+00:00| seen|...

CVE-2026-31682

creationtimestamp| type| source ---|---|--- 2026-04-25 10:06:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116464783504751353 2026-04-25 20:30:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116467237575005440 2026-05-05 20:00:00+00:00| seen|...

CVE-2026-41277

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key id and internal state fields of DocumentStore entities. Because the...

CVE-2026-31650

creationtimestamp| type| source ---|---|--- 2026-04-25 05:23:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116463671145457300...

[SECURITY] Fedora 44 Update: buildah-1.43.1-1.fc44

The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...

SUSE CVE-2026-31646

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix pagepool error handling in lan966xfdmarxallocpagepool pagepoolcreate can return an ERRPTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through...

GHSA-PMWG-CVHR-8VH7

creationtimestamp| type| source ---|---|--- 2026-04-24 22:53:42+00:00| seen| Telegram/Vx6nINpqXkyN9lWmYzg7wzzb7SobZ66OCYhgiINimz-nM3E 2026-05-05 05:40:29+00:00| seen| https://gist.github.com/alon710/1fe74fd0f0234822bdcb48ade706690f 2026-07-21 12:51:15+00:00| seen|...

CVE-2026-41653

creationtimestamp| type| source ---|---|--- 2026-04-24 21:00:04+00:00| published-proof-of-concept| Telegram/OlSx-i4MOnRiLD9w2NsovYSChfTHJAiqMYmGpteGinUk6Zg...

GHSA-6GQR-MX34-WH8R Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to create pages, files or users pages.create, files.create or users.create permission is disabled. This can be due to configuration in the user blueprints, via options in the model blueprints or v...

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to create pages, files or users pages.create, files.create or users.create permission is disabled. This can be due to configuration in the user blueprints, via options in the model blueprints or v...

CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...

CVE-2026-41328

creationtimestamp| type| source ---|---|--- 2026-04-24 19:42:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbbw67je32f 2026-04-25 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116463463879285208 2026-04-25 04:30:31+00:00| seen|...

EUVD-2026-25620

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is...

CVE-2026-41433

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is...

GHSA-6V9C-7CG6-27Q7

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:26+00:00| seen| Telegram/FGivxNz61ghqDj4ER4orUo942MC3d41x9N89ngSi7socZnE 2026-04-30 02:10:29+00:00| seen| https://gist.github.com/alon710/e87f10931158991f62fe5f3be1e4d663...

GHSA-PF86-5X62-JRWF

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:26+00:00| seen| Telegram/FGivxNz61ghqDj4ER4orUo942MC3d41x9N89ngSi7socZnE 2026-05-05 03:10:29+00:00| seen| https://gist.github.com/alon710/207351104330f20458b16ad3e50712e0...

CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...