24376 matches found
CVE-2026-24506
creationtimestamp| type| source ---|---|--- 2026-04-20 21:21:58+00:00| seen| Telegram/itZIvBa41gHmxLOZ4e3ooVdAvJm4yIE4KZd9P4HVJMq4o...
kernel: ALSA: aloop: Fix racy access at PCM trigger
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are...
CVE-2026-39109
creationtimestamp| type| source ---|---|--- 2026-04-20 20:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxb2tnbmy2r...
GHSA-W73R-2449-QWGH
creationtimestamp| type| source ---|---|--- 2026-04-20 17:21:45+00:00| seen| Telegram/7kKxZY5KjVtNNq82uAZn6qPfMFkWsKJQXsAec31tFmY88...
CVE-2026-6625
creationtimestamp| type| source ---|---|--- 2026-04-20 11:16:38+00:00| seen| Telegram/dHFBNa6z0pCHPScrBZS6WnqsKmYP7k1ORYb9rRTMhJ2WJuM 2026-04-20 12:20:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwhd2vsya2i...
CVE-2026-6643
creationtimestamp| type| source ---|---|--- 2026-04-20 07:50:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvybbngej2h 2026-04-20 09:17:22+00:00| seen| Telegram/Lm9dzPhVRFRRMgyzsUGG1X5A2Qj2Q71JCDe8XQUe2-0mpLw 2026-04-28 09:00:05+00:00| seen|...
FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...
GHSA-5H65-JX66-J7P5 FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...
CVE-2026-6591
creationtimestamp| type| source ---|---|--- 2026-04-20 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjvczbzwd32f 2026-04-20 04:28:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvmxmb3x72i...
Cross-site Scripting (XSS)
Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS leading to cross-site scripting, via custom elements. When CUSTOMELEMENTHANDLING is not enabled, and an attacker has already polluted the prototype...
CVE-2026-6518
creationtimestamp| type| source ---|---|--- 2026-04-18 06:48:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqtueebpf26 2026-04-18 07:01:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjqukpruc52v 2026-04-18 07:16:24+00:00| seen|...
October CMS Has Stored XSS In Event Log Mail Preview
A stored cross-site scripting XSS vulnerability was identified in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. Impact - Stored XSS via mail...
GHSA-3P24-9X7V-7789
creationtimestamp| type| source ---|---|--- 2026-04-18 03:16:49+00:00| seen| Telegram/pg0pMMwJv5FTHbXxc3MO00N2B5ehQq9biiv2KNNNK0Va5Yk...
CVE-2026-40489
creationtimestamp| type| source ---|---|--- 2026-04-18 03:03:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqhbpuspf26 2026-04-18 03:16:49+00:00| seen| Telegram/pg0pMMwJv5FTHbXxc3MO00N2B5ehQq9biiv2KNNNK0Va5Yk...
CVE-2026-40483
creationtimestamp| type| source ---|---|--- 2026-04-18 02:28:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqfcaa6a62f...
GHSA-C9H3-5P7R-MRJH OpenClaw: Discord event cover images bypassed sandbox media normalization
Summary Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound...
Directory Traversal
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal in the handling of Discord event cover image parameters, which could bypass the intended media normalization. An attacker can access host-local media references by...
OpenClaw: Discord event cover images bypassed sandbox media normalization
Summary Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound...
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input
Summary Agent hook events could enqueue trusted system events from unsanitized external input. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 Impact Agent hook dispatch could turn externally supplied hook metadata into trusted system events,...