CVE-2026-39538

creationtimestamp| type| source ---|---|--- 2026-04-14 17:27:59+00:00| seen| Telegram/ylyKsnGn7IUGtPSjSQJxYkLCLx52u0woajEqQVy7zzhnhE...

CVE-2026-39815

creationtimestamp| type| source ---|---|--- 2026-04-14 16:34:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhspovl5m2k 2026-04-14 17:27:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhvps2k352o 2026-04-14 17:28:30+00:00| seen|...

CVE-2026-32090

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:12:09+00:00| seen| Telegram/oEQn8vGzt9amdZwPj0LpHOqAegFTLvvnHRc5FBkCf3mZpAs 2026-04-14 20:12:17+00:00| seen|...

CVE-2026-32074

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:10:49+00:00| seen| Telegram/Ms21XGSiFH8l9m-UBaczlbYymgDr8KZJGW6Umjgd2osc 2026-04-15 06:53:38+00:00| seen|...

CVE-2026-27907

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:07:55+00:00| seen| Telegram/b-0H5pCtilxNZxS-gRRPsAWUA3zqxMoGzwWTkVBCMIvH7s 2026-04-15 06:53:38+00:00| seen|...

GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes

CVE-2026-32631 is regarding a vulnerability where it is possible to obtain a user's NTLM hash by tricking them into cloning a malicious repository, or checking out a malicious branch that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction...

Revive Adserver: Session ID reuse allowing XML‑RPC API authentication bypass

Vulnerability description not provided...

CVE-2026-2449

creationtimestamp| type| source ---|---|--- 2026-04-14 12:48:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhg3rxp4d2m 2026-04-14 13:15:45+00:00| published-proof-of-concept| Telegram/cLVBfu0wN-KDy7vSZP2Uw7mBDsIGZ8mzZODmv4ph0BNeQs...

GHSA-VC46-VW85-3WVM

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:42+00:00| seen| Telegram/EXit4BCARRaTXD4SBLqO-yd3UPNB5jBijYowsPR2aTE5HY...

GHSA-R2PG-R6H7-CRF3

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:21+00:00| seen| Telegram/VN5qpdZvC1XQa0kocwrxs34zDP5KgO9HhvqtOghSHVfgqA...

CVE-2026-25654

creationtimestamp| type| source ---|---|--- 2026-04-14 03:04:52+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-prodotti-siemens-20 2026-04-14 09:51:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjh46vwdxg2s 2026-04-14 10:16:11+00:00| seen|...

CVE-2026-5810

A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: trillian-fips, keda-fips, wavefront-collector-for-kubernetes, keda, certificate-transparency-fips, mcp-grafana-fips, minio-fips, mcp-grafana, opentelemetry-collector-k8s, aws-otel-collector-fips, aws-otel-collector, grafana-fips, grafana-pyroscope, karma, loki-fips,...

CVE-2026-39979

creationtimestamp| type| source ---|---|--- 2026-04-14 01:10:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjg73rsmom2m 2026-07-02 06:57:02+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260702 2026-07-10 15:54:18+00:00| seen...

Authorization Bypass Through User-Controlled Key

Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the destroy action in app/controllers/emailscontroller.rb. An attacker can delete another user’s email record by sending...

Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

Impact Authenticated users can delete emails imported into the system assigned to another user; where the Email Dropbox is in use. Patches Fixed in v0.26.0 Workarounds Disable use of email dropbox...

CVE-2025-65132

alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting XSS in /public/admin/editroom.php which allows an attacker to inject and execute arbitrary JavaScript via the roomid GET parameter...

PT-2026-32656

alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting XSS in /public/admin/edit room.php which allows an attacker to inject and execute arbitrary JavaScript via the room id GET parameter...

Moderate: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-31958 For more details about the security issues, including the impact, a CVSS score,...

Chamilo LMS 安全漏洞

Chamilo LMS is an open-source online learning and collaboration system developed by Chamilo. This system supports the creation of teaching content, remote training, and online quizzes. Versions of Chamilo LMS prior to 2.0.0-RC.3 contained security vulnerabilities. These vulnerabilities stemmed fr...