CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...

CVE-2026-6911

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk 2026-04-25 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116464171469215765 2026-04-25 07:30:28+00:00| seen|...

GHSA-8C75-8MHR-P7R9

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

CVE-2026-6912

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

GHSA-VFMQ-68HX-4JFW

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

GHSA-V5VR-8W3C-37X2

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

CVE-2026-40897

creationtimestamp| type| source ---|---|--- 2026-04-24 19:22:45+00:00| seen| Telegram/6Kzjgs5Jm1YsIV5W18stSaCNyR3ZbpfLU45htDdv-YDitI 2026-04-29 05:40:29+00:00| seen| https://gist.github.com/alon710/25629451db7d7ca933d6d9a4e21d4536 2026-05-07 09:00:04+00:00| seen|...

CVE-2026-23344

creationtimestamp| type| source ---|---|--- 2026-04-24 19:22:15+00:00| seen| Telegram/QClwe-Hyi-f9OAkRKp4TGZeua-ugJd0Tlr7uuGoxl9Cbid8...

CVE-2026-23361

creationtimestamp| type| source ---|---|--- 2026-04-24 19:22:15+00:00| seen| Telegram/QClwe-Hyi-f9OAkRKp4TGZeua-ugJd0Tlr7uuGoxl9Cbid8 2026-06-29 20:05:14+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mphbwyjmmv2o 2026-06-29 20:05:19+00:00| seen|...

CVE-2026-41907

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

CVE-2026-41907

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

CVE-2026-41907

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

EUVD-2026-25600

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

CVE-2026-31665

creationtimestamp| type| source ---|---|--- 2026-04-24 18:07:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116461014638911540 2026-04-27 20:00:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkiuc3bley2w 2026-05-05 20:00:00+00:00| seen|...

CVE-2026-23422

creationtimestamp| type| source ---|---|--- 2026-04-24 17:19:23+00:00| published-proof-of-concept| Telegram/izuLnFsi0kO0A2H5Dx71PRMcc4LiTVfuRwLjXwzmOGc60yQ 2026-05-05 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260506 2026-07-28...

GHSA-3JVJ-V6W2-H948 Lemmy has SSRF in /api/v3/post via Webmention dispatch

Summary Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but th...

Lemmy has SSRF in /api/v3/post via Webmention dispatch

Summary Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but th...

CVE-2026-31670

In the Linux kernel, the following vulnerability has been resolved: net: rfkill: prevent unlimited numbers of rfkill events from being created Userspace can create an unlimited number of rfkill events if the system is so configured, while not consuming them from the rfkill file descriptor, causin...

DEBIAN-CVE-2026-31567

In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Drop spurious WARNON from pmrestoregfpmask Commit 35e4a69b2003f "PM: sleep: Allow pmrestrictgfpmask stacking" introduced refcount-based GFP mask management that warns when pmrestoregfpmask is called with savedgfpcount ...

CVE-2026-31670 net: rfkill: prevent unlimited numbers of rfkill events from being created

In the Linux kernel, the following vulnerability has been resolved: net: rfkill: prevent unlimited numbers of rfkill events from being created Userspace can create an unlimited number of rfkill events if the system is so configured, while not consuming them from the rfkill file descriptor, causin...