Wish has SCP Path Traversal that allows arbitrary file read/write

Summary The SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../...

CVE-2026-40350

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints /settings/users and use them to enumerate all users and create a new administrator account. This happens because the route...

CVE-2026-40350 Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints /settings/users and use them to enumerate all users and create a new administrator account. This happens because the route...

CVE-2026-40350 Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints /settings/users and use them to enumerate all users and create a new administrator account. This happens because the route...

CVE-2026-39886

creationtimestamp| type| source ---|---|--- 2026-04-18 00:01:27+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjq547cnbt27 2026-04-21 02:15:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjxvzgfyqp2e...

CVE-2026-39314

creationtimestamp| type| source ---|---|--- 2026-04-18 00:01:24+00:00| seen| https://bsky.app/profile/slackers.it/post/3mjq5442fbv2n...

CVE-2026-40484

creationtimestamp| type| source ---|---|--- 2026-04-18 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116422766909466748 2026-04-18 00:00:45+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjq52w2byf2i 2026-04-18 01:18:19+00:00| published-proof-of-concept|...

PT-2026-33548

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints /settings/users and use them to enumerate all users and create a new administrator account. This happens because the route...

CVE-2026-40352

creationtimestamp| type| source ---|---|--- 2026-04-17 23:11:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjq2cqlx3o2r 2026-04-17 23:20:20+00:00| published-proof-of-concept| Telegram/pKVsSWpOH4ztPjCePA6f2TZasDjFWE2MPBTfIhx3aN4UBbI 2026-04-27 22:07:07+00:00| seen|...

CVE-2026-40948

creationtimestamp| type| source ---|---|--- 2026-04-17 23:07:48+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjq24b6p3e2r...

CVE-2026-33436

creationtimestamp| type| source ---|---|--- 2026-04-17 22:52:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpzbjotyc22...

CVE-2026-40302

creationtimestamp| type| source ---|---|--- 2026-04-17 22:47:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpyyl7z4n2q...

GHSA-7PXC-H3RV-R257

creationtimestamp| type| source ---|---|--- 2026-04-17 21:23:49+00:00| seen| Telegram/7C15iqAEcZ5ODFR22IWkRQCDQTDewcZjz-3MNl57bsxR9g...

CVE-2026-33516

creationtimestamp| type| source ---|---|--- 2026-04-17 21:23:11+00:00| published-proof-of-concept| Telegram/GxkwnkIopWEGLbC11BdcbbYVRqOADIf4t7f5VnXFMKG7Kn8 2026-04-24 11:15:46+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mkaflhxcmk22...

GHSA-J2JM-C596-C5Q3

creationtimestamp| type| source ---|---|--- 2026-04-17 21:22:46+00:00| seen| Telegram/o-uTgZiWLI4DGr-3Qx2v6r5S9u58WJIjtqdTFR62kB0PIWs...

GHSA-MFPR-9886-XJHG

creationtimestamp| type| source ---|---|--- 2026-04-17 21:22:32+00:00| seen| Telegram/1afGr9vW06Zk0J3YeUW4MdlUf8TA53EPyuLeVgpLZqfvxp8...

CVE-2026-40342

creationtimestamp| type| source ---|---|--- 2026-04-17 21:02:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpt3sucas2i 2026-04-17 21:23:49+00:00| seen| Telegram/7C15iqAEcZ5ODFR22IWkRQCDQTDewcZjz-3MNl57bsxR9g 2026-04-17 22:13:44+00:00| seen|...

CVE-2026-35215

creationtimestamp| type| source ---|---|--- 2026-04-17 21:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpsyfwdhs2i 2026-04-17 21:23:35+00:00| seen| Telegram/Q64crjFZRAFhidSIvAgPD7j9KS4Pns0gYZhyfeiZ9MDp9II...

CVE-2026-6437

CVE-2026-6437 concerns the AWS EFS CSI Driver (aws-efs-csi-driver) prior to v3.0.1. The flaw is improper neutralization of argument delimiters in the volume handling component, which allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via...

CVE-2026-6437 AWS EFS CSI Driver Mount Option Injection

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...