Grinex crypto exchange shuts down, blames Western agencies for $13.7M breach

Grinex exchange collapses after $13.7M breach, blames Western spies as Chainalysis flags possible exit scam and sanctions evasion network links claims...

Debian dsa-6204 : openssh-client - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6204 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6204-1 [email protected]...

SUSE CVE-2026-33516

xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerabilit...

CVE-2026-40948

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2026-33516

A flaw was found in xrdp, an open-source Remote Desktop Protocol RDP server. A remote, unauthenticated attacker can exploit an out-of-bounds read vulnerability by sending a specially crafted Confirm Active PDU during the RDP capability exchange. This issue occurs when memory is accessed without...

Debian dla-4535 : openssh-client - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4535 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4535-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-6632

creationtimestamp| type| source ---|---|--- 2026-04-19 17:12:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116432485170650400 2026-04-20 11:48:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwfjkabca2o 2026-04-20 13:16:52+00:00| published-proof-of-concept|...

CVE-2026-6568

creationtimestamp| type| source ---|---|--- 2026-04-19 10:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116430905514240860 2026-04-19 10:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjtqpwdi6k2y 2026-04-19 11:15:54+00:00| published-proof-of-concept|...

CVE-2026-6563

creationtimestamp| type| source ---|---|--- 2026-04-19 09:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116430551736901385 2026-04-19 09:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjtlp2da3t22 2026-04-19 09:34:22+00:00| seen|...

CVE-2026-6560

creationtimestamp| type| source ---|---|--- 2026-04-19 07:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116430197752959009 2026-04-19 07:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjtgo3375c22 2026-04-19 08:00:23+00:00| seen|...

CVE-2026-0868

creationtimestamp| type| source ---|---|--- 2026-04-19 04:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116429489966778498 2026-04-19 04:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjt4m7gd5s2j 2026-04-19 06:09:10+00:00| seen|...

CVE-2026-2505

creationtimestamp| type| source ---|---|--- 2026-04-19 00:09:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116428462595537812 2026-04-19 03:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116429136061434312 2026-04-19 03:00:31+00:00| seen|...

PT-2026-33646

Name of the Vulnerable Software and Affected Versions Okta Identity Cloud affected versions not specified Description A critical authentication bypass exists in workforce and customer identity flows. This issue was actively exploited between April 18 and April 19, 2026. Recommendations Patch all...

CVE-2026-2986

creationtimestamp| type| source ---|---|--- 2026-04-18 22:15:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116428013886069984 2026-04-19 01:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116428782134450850 2026-04-19 01:30:30+00:00| seen|...

CVE-2026-0894

creationtimestamp| type| source ---|---|--- 2026-04-18 21:18:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116427790167391020 2026-04-20 06:28:01+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mjvtn7c7pf2a...

apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

Cross-site Request Forgery (CSRF)

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the login authentication process due to missing generation and validation of the OAuth 2.0...

GHSA-5W6H-PJW6-WVC6 apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2026-40948

The CVE-2026-40948 entry concerns the Keycloak authentication manager in apache-airflow-providers-keycloak. It describes missing OAuth 2.0 state validation and PKCE usage during login/login-callback, enabling a potential login-CSRF/session-fixation attack where a victim may be seduced into an att...

CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...