CVE-2026-21997

creationtimestamp| type| source ---|---|--- 2026-04-21 23:29:27+00:00| seen| Telegram/da4bvWuFIBZ1xbJCq39UTLrDihlERi1UO8pjihG32T1Z-BM...

CVE-2026-6829

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update,...

CVE-2026-40928

WWBN AVideo (versions ≤ 29.0) exposes state-changing JSON endpoints under objects/ without CSRF protection or origin/referer checks. A logged-in user can be coerced to perform actions via attacker-controlled HTML: like/dislike comments (objects/comments_like.json.php), post comments with attacker...

CVE-2026-40928 AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

CVE-2026-40928 AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

EUVD-2026-24341

Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft component: Absence Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-40879

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:12+00:00| seen| Telegram/F2G63fMNgyZcc0oNt6XGHExAkvTr9kUyS9C9Ki-AIDnnQ5g...

CVE-2026-40880

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:12+00:00| seen| Telegram/F2G63fMNgyZcc0oNt6XGHExAkvTr9kUyS9C9Ki-AIDnnQ5g...

GHSA-C29W-QQ4M-2GCV

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:12+00:00| seen| Telegram/F2G63fMNgyZcc0oNt6XGHExAkvTr9kUyS9C9Ki-AIDnnQ5g...

GHSA-7H3J-592V-JCRP

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:12+00:00| seen| Telegram/F2G63fMNgyZcc0oNt6XGHExAkvTr9kUyS9C9Ki-AIDnnQ5g...

CVE-2026-40872

creationtimestamp| type| source ---|---|--- 2026-04-21 21:26:51+00:00| seen| Telegram/FmTSSVQ1J3rSbvAltEePP9EbJsBmWNaUcXM1uvMHIpeiAtQ...

CVE-2026-40873

creationtimestamp| type| source ---|---|--- 2026-04-21 21:26:51+00:00| seen| Telegram/FmTSSVQ1J3rSbvAltEePP9EbJsBmWNaUcXM1uvMHIpeiAtQ...

DEBIAN-CVE-2026-40892

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsipauthcreatedigest2 in PJSIP when using pre-computed digest credentials PJSIPCREDDATADIGEST. The function copies credential data using credinfo-data.slen as the...

CVE-2026-34294

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Microsoft Active Directory. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Orac...

CVE-2026-34266

Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft component: Absence Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-6753

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3mk2foafsn62i 2026-04-22 17:24:29+00:00| seen|...

CVE-2026-6771

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-21 21:26:08+00:00| published-proof-of-concept| Telegram/Sh-VDLwDsigv2TtmIHQb5bM9xL-0-hntwqefkM3TigDwq8o 2026-04-22...

CVE-2026-6767

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:23+00:00| seen| https://bsky.app/profile/slackers.it/post/3mk2focmgie2i 2026-05-28 12:01:16+00:00| seen|...

CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsipauthcreatedigest2 in PJSIP when using pre-computed digest credentials PJSIPCREDDATADIGEST. The function copies credential data using credinfo-data.slen as the...

CVE-2026-40883 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because...