CVE-2026-5694

creationtimestamp| type| source ---|---|--- 2026-04-22 21:20:45+00:00| seen| Telegram/cDitVeBI8oWCcnnyaubtTUI3HbowCaMK9JXw2ugv50fhLs...

CVE-2026-40937

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any...

CVE-2009-1285

creationtimestamp| type| source ---|---|--- 2026-04-22 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk4fgsuhew2t...

locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

Summary Versions of the locize client SDK the browser module that wires up the locize InContext translation editor prior to 4.0.21 register a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled,...

CVE-2026-40937 RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any...

CVE-2026-40937

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any...

CVE-2026-40937

Summary: RustFS prior to 1.0.0-alpha.94 exposes a critical admin-authorization flaw in the notification target endpoints. The four endpoints in rustfs/src/admin/handlers/event.rs call a check_permissions (auth only) instead of validate_admin_request with a specific AdminAction, unlike other admin...

RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

Missing Admin Auth on Notification Target Endpoints in RustFS Finding Summary All four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any admin-action...

CVE-2025-9611

creationtimestamp| type| source ---|---|--- 2026-04-22 18:52:48+00:00| seen| https://gist.github.com/zachsmith1/a3c31a2b8e89ae1c6c771034a97ffd67...

CVE-2026-31443

A flaw was found in the Linux kernel's dmaengine: idxd driver. When hardware does not support event logging and an error triggers a Function Level Reset FLR, the driver attempts to restore or free an event log that was never allocated. This improper handling can lead to a system crash, resulting ...

CVE-2018-25262

creationtimestamp| type| source ---|---|--- 2026-04-22 16:22:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3vrxujzu2i...

CVE-2026-6862

creationtimestamp| type| source ---|---|--- 2026-04-22 16:20:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3voy6zmc2r...

CVE-2018-25272

creationtimestamp| type| source ---|---|--- 2026-04-22 16:19:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3vm5jpdp2n...

EUVD-2026-24827

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotpsendmsg isotpsendmsg uses only cmpxchg on so-tx.state to serialize access to so-tx.buf. isotprelease waits for ISOTPIDLE via waiteventinterruptible and then calls kfreeso-tx.buf. If a...

EUVD-2026-24768

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix leaking event log memory During the device remove process, the device is reset, causing the configuration registers to go back to their default state, which is zero. As the driver is checking if the event log...

EUVD-2026-24775

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix crash when the event log is disabled If reporting errors to the event log is not supported by the hardware, and an error that causes Function Level Reset FLR is received, the driver will try to restore the...

CVE-2026-0539

creationtimestamp| type| source ---|---|--- 2026-04-22 14:19:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3ovh3ntp2h 2026-04-22 15:17:53+00:00| seen| Telegram/QeC7MO7ScSSiOVGXLKN0WnA843zzLxkQwsFJUKCqjpspjuY...

CVE-2026-31440

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix leaking event log memory During the device remove process, the device is reset, causing the configuration registers to go back to their default state, which is zero. As the driver is checking if the event log...

CVE-2026-31443

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix crash when the event log is disabled If reporting errors to the event log is not supported by the hardware, and an error that causes Function Level Reset FLR is received, the driver will try to restore the...

CVE-2026-31474 can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotpsendmsg isotpsendmsg uses only cmpxchg on so-tx.state to serialize access to so-tx.buf. isotprelease waits for ISOTPIDLE via waiteventinterruptible and then calls kfreeso-tx.buf. If a...