CVE-2026-41705

creationtimestamp| type| source ---|---|--- 2026-05-09 04:30:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlffwxr3u52o 2026-05-09 18:44:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgvnclkqn2g 2026-05-11 09:04:11+00:00| seen|...

CVE-2026-42560 auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. ...

CVE-2026-42560

The CVE describes a vulnerability in the Patreon OAuth provider used by github.com/go-pkgz/auth, where the mapUser logic computes a local user ID from an uninitialized field, causing every Patreon-authenticated user to share the same local identity. The GHSA advisory details show the code path wh...

CVE-2026-41163

bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitraril...

CVE-2026-44313

creationtimestamp| type| source ---|---|--- 2026-05-09 02:54:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfallignb2e 2026-05-09 18:44:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgvnqcqgb2w 2026-09-12 10:00:11+00:00| seen|...

SUSE CVE-2025-14576

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of...

SUSE CVE-2026-43208

In the Linux kernel, the following vulnerability has been resolved: net: do not pass flowid to setrpscpu Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flowid in setrpscpu, do not assume we can use the...

GHSA-3V2C-X6Q9-F697 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, argo-workflows, terraform-provider-tls, zarf, kubernetes-csi-driver-nfs, containerd, libnvidia-container, falco-no-driver, vault-secrets-webhook, authservice, jitsucom-bulker, minio-object-browser, cert-manager, amazon-cloudwatch-agent-operator,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTMLRenderer heading rendering path in the HTML renderer. An attacker can inject arbitrary HTML by supplying a heading id attribute value that contains quotes and markup. The rendered output can be alter...

GHSA-V87V-83H2-53W7 Mistune Heading ID Attribute has Injection XSS

Summary HTMLRenderer.heading builds the opening tag by string-concatenating the id attribute value directly into the HTML — with no call to escape, safeentity, or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject...

Mistune Heading ID Attribute has Injection XSS

Summary HTMLRenderer.heading builds the opening tag by string-concatenating the id attribute value directly into the HTML — with no call to escape, safeentity, or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: golang (UTSA-2026-016821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016821 advisory. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to...

PT-2026-39417

Name of the Vulnerable Software and Affected Versions Next.js versions 12.2.0 through 15.5.15 Next.js versions 16.0.0 through 16.2.4 Description An external client can send an x-nextjs-data header on a request to a path handled by middleware that returns a redirect. This causes the middleware or...

VMware Spring AI 安全漏洞

VMware Spring AI is a development framework from VMware that integrates artificial intelligence and big language modeling capabilities in the Spring ecosystem. A security vulnerability exists in VMware Spring AI versions 1.0.0 through 1.0.7 prior and 1.1.0 through 1.1.6 prior, which stems from...

PT-2026-39330

Name of the Vulnerable Software and Affected Versions mistune versions prior to 3.2.1 Description In the HTMLRenderer.heading function within src/mistune/renderers/html.py, the id attribute of heading tags is constructed by directly concatenating the value into the HTML without sanitization. When...

Unity Linux 20.1050e / 20.1070e Security Update: golang (UTSA-2026-017392)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017392 advisory. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates...

CVE-2026-43417

A flaw was found in the Linux kernel. The logic for handling tasks created using vfork a system call that creates a new process contains an error. This can cause a task to enter an endless loop when attempting to acquire a Context ID CID during scheduling. A local user could exploit this...

CVE-2026-43418

A flaw was found in the Linux kernel's sched/mmcid component. When new tasks are created concurrently, a race condition can occur where a task is accounted as a Memory Management Context ID MMCID user before it is fully registered in the system's task lists. This can lead to an incorrect allocati...

CVE-2026-42456 AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the text-to-speech audio for another user's chat response within the same workspace...

CVE-2026-44326

creationtimestamp| type| source ---|---|--- 2026-05-08 22:58:59+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-3p28-73q7-45xp 2026-05-27 18:01:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmu3n244p52s 2026-05-28 18:37:07+00:00| seen|...