CVE-2026-35196

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the exportallcertificates action, where the course code retrieved from the session variable $SESSION'cid'...

CVE-2026-5756

creationtimestamp| type| source ---|---|--- 2026-04-14 20:17:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mji76e35s22o 2026-04-16 15:19:33+00:00| seen| Telegram/xaMuklUmIhmgdshubo3uV9apJJHbiRRivMdJ18LxU3A0Q4Q...

CVE-2026-26291

creationtimestamp| type| source ---|---|--- 2026-04-14 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN62079296 2026-04-15 08:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjikmbqs623...

CVE-2026-36232

A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'classId' parameter from $GET'classId' is directly concatenated into the SQL query without any sanitization or validation...

CVE-2026-27283

creationtimestamp| type| source ---|---|--- 2026-04-14 17:58:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhxgns26s2e 2026-04-14 20:03:31+00:00| seen| Telegram/BoOqWaO3KXSkNoeZKG9-5DucbPr6wdRjfTcRW39IR2MuNQ 2026-04-16 18:37:08+00:00| seen|...

CVE-2026-39538

creationtimestamp| type| source ---|---|--- 2026-04-14 17:27:59+00:00| seen| Telegram/ylyKsnGn7IUGtPSjSQJxYkLCLx52u0woajEqQVy7zzhnhE...

CVE-2026-39815

creationtimestamp| type| source ---|---|--- 2026-04-14 16:34:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhspovl5m2k 2026-04-14 17:27:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhvps2k352o 2026-04-14 17:28:30+00:00| seen|...

CVE-2026-32074

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:10:49+00:00| seen| Telegram/Ms21XGSiFH8l9m-UBaczlbYymgDr8KZJGW6Umjgd2osc 2026-04-15 06:53:38+00:00| seen|...

CVE-2026-32090

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:12:09+00:00| seen| Telegram/oEQn8vGzt9amdZwPj0LpHOqAegFTLvvnHRc5FBkCf3mZpAs 2026-04-14 20:12:17+00:00| seen|...

CVE-2026-27907

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:07:55+00:00| seen| Telegram/b-0H5pCtilxNZxS-gRRPsAWUA3zqxMoGzwWTkVBCMIvH7s 2026-04-15 06:53:38+00:00| seen|...

GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes

CVE-2026-32631 is regarding a vulnerability where it is possible to obtain a user's NTLM hash by tricking them into cloning a malicious repository, or checking out a malicious branch that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction...

Revive Adserver: Session ID reuse allowing XML‑RPC API authentication bypass

Vulnerability description not provided...

CVE-2026-2449

creationtimestamp| type| source ---|---|--- 2026-04-14 12:48:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhg3rxp4d2m 2026-04-14 13:15:45+00:00| published-proof-of-concept| Telegram/cLVBfu0wN-KDy7vSZP2Uw7mBDsIGZ8mzZODmv4ph0BNeQs...

GHSA-VC46-VW85-3WVM

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:42+00:00| seen| Telegram/EXit4BCARRaTXD4SBLqO-yd3UPNB5jBijYowsPR2aTE5HY...

GHSA-R2PG-R6H7-CRF3

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:21+00:00| seen| Telegram/VN5qpdZvC1XQa0kocwrxs34zDP5KgO9HhvqtOghSHVfgqA...

CVE-2026-25654

creationtimestamp| type| source ---|---|--- 2026-04-14 03:04:52+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-prodotti-siemens-20 2026-04-14 09:51:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjh46vwdxg2s 2026-04-14 10:16:11+00:00| seen|...

CVE-2026-5810

A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: loki-fips, tempo, opentelemetry-collector-k8s, keda-fips, elastic-agent-fips, grafana-fips, mc, opentelemetry-collector-k8s-fips, telegraf, prometheus-pushgateway, tempo-fips, minio-object-browser-fips, minio-operator-fips, aws-otel-collector-fips, datadog-agent,...

CVE-2026-39979

creationtimestamp| type| source ---|---|--- 2026-04-14 01:10:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjg73rsmom2m 2026-07-02 06:57:02+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260702 2026-07-10 15:54:18+00:00| seen...

Authorization Bypass Through User-Controlled Key

Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the destroy action in app/controllers/emailscontroller.rb. An attacker can delete another user’s email record by sending...