glib: Buffer Under-read on GLib through glib/gfileutils.c via get_tmp_file()

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

CVE-2026-40189

CVE-2026-40189 affects goshs, a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces per-folder .goshs ACL/basic-auth for directory listings and file reads but does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can perform state-...

CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload...

CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload...

CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload...

CVE-2026-40189

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload...

CVE-2026-32930

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:17+00:00| published-proof-of-concept| Telegram/5BYtFCja3ItyUAudrFtyDv4j4kJF13U-uq-WjYMkVFgHgE...

CVE-2026-31940

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:11+00:00| seen| Telegram/3GtkgxN8M7sGDIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg 2026-04-11 07:05:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bjttqpe2w 2026-04-13 02:56:04+00:00| seen|...

GHSA-8Q8C-V75X-Q2HX

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:11+00:00| seen| Telegram/3GtkgxN8M7sGDIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg...

GHSA-2G3W-CPC4-CHR4

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q...

CVE-2026-33698

Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals...

CVE-2026-33706

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the updateuserfromusername endpoint. A student status=5 can change their status to Teacher/CourseManager status=1, gaining course creation and management...

CVE-2026-32892

creationtimestamp| type| source ---|---|--- 2026-04-10 19:07:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5zgsraew2g 2026-04-10 19:31:17+00:00| published-proof-of-concept| Telegram/5BYtFCja3ItyUAudrFtyDv4j4kJF13U-uq-WjYMkVFgHgE 2026-04-11 06:00:28+00:00| seen|...

CVE-2026-35669

creationtimestamp| type| source ---|---|--- 2026-04-10 19:01:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5z42kgrc2w 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q 2026-04-11 08:00:49+00:00| seen|...

CVE-2026-35667

creationtimestamp| type| source ---|---|--- 2026-04-10 18:33:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5xju2hzy2o...

EUVD-2026-21384

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the fklevelslist parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass...

CVE-2012-2459

creationtimestamp| type| source ---|---|--- 2026-04-10 18:26:02+00:00| seen| https://gist.github.com/motolese/14f6c5a8151e9fb449829e58444e63c4 2026-04-10 23:21:37+00:00| seen| https://gist.github.com/motolese/79baccbf5bcc258810124ab8d463e52a 2026-06-12 17:01:32+00:00| seen|...

CVE-2026-35664

creationtimestamp| type| source ---|---|--- 2026-04-10 18:19:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5wqyntnc2z...

CVE-2026-41679

creationtimestamp| type| source ---|---|--- 2026-04-10 16:50:27+00:00| published-proof-of-concept| https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 2026-04-23 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116451431450772018 2026-04-23...

CVE-2026-40217

creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:37+00:00| seen| Telegram/BHjpIBo0iRlJvCTjCc1tWATK3ONpTPYFFDHwGYF-bIOT41U 2026-04-10 15:37:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5nnyqjgd2j 2026-04-11 10:00:21+00:00| seen|...