UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the WebDAV backend process. An attacker can access and modify files outside the intended directory by exploiting symbolic links that point outside the designated root. This is only exploitable if...

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Summary The zrok WebDAV drive backend davServer.Dir restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without...

CVE-2026-4142

creationtimestamp| type| source ---|---|--- 2026-04-25 19:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdrtpj3at2c...

CVE-2026-4280

creationtimestamp| type| source ---|---|--- 2026-04-25 18:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdoigax452s...

CVE-2026-6041

creationtimestamp| type| source ---|---|--- 2026-04-25 15:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdegkpr5b2x...

CVE-2026-5757

creationtimestamp| type| source ---|---|--- 2026-04-25 14:17:03+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mkda6kaxwz2n 2026-05-07 14:21:50+00:00| seen| https://bsky.app/profile/ai-sight.bsky.social/post/3mlbg25s2eo26 2026-05-18 18:18:06+00:00| seen|...

CVE-2026-5820

creationtimestamp| type| source ---|---|--- 2026-04-25 13:33:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkd5pzeqdv2h...

CVE-2026-41481

creationtimestamp| type| source ---|---|--- 2026-04-25 12:54:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116465444548754974...

GHSA-6FW5-F8R9-FGFM

creationtimestamp| type| source ---|---|--- 2026-04-25 11:36:33+00:00| seen| https://gist.github.com/dims/bd766118ae32d646ea9f127ac51c3054...

CVE-2026-41476

creationtimestamp| type| source ---|---|--- 2026-04-25 10:03:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116464772166042640...

CVE-2026-31650

creationtimestamp| type| source ---|---|--- 2026-04-25 05:23:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116463671145457300...

CVE-2026-41248

creationtimestamp| type| source ---|---|--- 2026-04-24 22:00:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbjlxyitp2w 2026-04-25 00:00:42+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkbqdc3r752v 2026-04-25 00:00:46+00:00| seen|...

CVE-2026-41478

creationtimestamp| type| source ---|---|--- 2026-04-24 22:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbjlqme3z2n 2026-04-28 16:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mkkxq6o5ex2w 2026-04-28 16:07:10+00:00| seen|...

CVE-2026-33662

creationtimestamp| type| source ---|---|--- 2026-04-24 21:46:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkbiu5jbk72o...

CVE-2026-41488

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's urltosize helper used by getnumtokensfrommessages for image token counting validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS...

CVE-2026-31629

A flaw was found in the Linux kernel's Near Field Communication NFC Logical Link Control Protocol LLCP subsystem. Missing return statements after LLCPCLOSED checks in the nfcllcprecvhdlc and nfcllcprecvdisc functions can lead to a use-after-free vulnerability. This occurs because the system...

GHSA-GX2M-MCC2-R4P3 wlc: print_html outputs API data without HTML escaping

Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. Patches https://github.com/WeblateOrg/wlc/pull/1327 Workarounds The only vulnerable code path is HTML output which is opt-in. Reference...

CVE-2026-35359

A Time-of-Check to Time-of-Use TOCTOU vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the ONOFOLLOW flag. An attacker with...

Malicious Package

Overview modern-events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-40690

creationtimestamp| type| source ---|---|--- 2026-04-24 15:32:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkatwrvm6d2u...