CVE-2026-42574

The CVE-2026-42574 issue affects apko dirFS used to build/publish OCI images. A crafted APK could place a TypeSymlink tar entry whose target points outside the build root, enabling traversal to host paths via subsequent directory creation or write operations within the same or later archive. Root...

Malicious code in @matjp/dvi-decode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 285904d13f5d698c3c33461fe969265ca73c3041db80eabe5637c1ebd3f3ca9b The package @matjp/dvi-decode was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-8187

creationtimestamp| type| source ---|---|--- 2026-05-09 15:00:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlgj4jqtbz2k...

CVE-2026-8186

creationtimestamp| type| source ---|---|--- 2026-05-09 14:55:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlgitldbrp2p...

Liberapay: another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link

Hello again i discovered that there is another Liberapay profile of Liberapay team member at liberapay.com/mdvhimself contains a link to an expired Twitter account, creating a Broken Link Hijacking BLH vulnerability. An attacker could register the expired handle and control what appears to be an...

CVE-2026-1749

creationtimestamp| type| source ---|---|--- 2026-05-09 12:35:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlgayzl6gq2k...

CVE-2026-32683

creationtimestamp| type| source ---|---|--- 2026-05-09 12:30:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlgaq35vbe2n 2026-05-18 02:00:04+00:00| seen| https://t.me/GithubRedTeam/84618 2026-05-18 03:00:14+00:00| published-proof-of-concept|...

CVE-2026-42310

creationtimestamp| type| source ---|---|--- 2026-05-09 08:34:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlftlkkmrt2t...

GHSA-2F25-PFQ3-C7H8

creationtimestamp| type| source ---|---|--- 2026-05-09 06:10:29+00:00| seen| https://gist.github.com/alon710/5630cef7c3595002259238662d69e7b6...

CVE-2026-42461

creationtimestamp| type| source ---|---|--- 2026-05-09 05:12:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfibxtzg32e...

CVE-2026-6860

creationtimestamp| type| source ---|---|--- 2026-05-09 05:10:28+00:00| seen| https://gist.github.com/alon710/125ca2c976df983809333bd3a8522eed...

CVE-2025-15634 HCL BigFix WebUI is affected by a missing authorization vulnerability

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page...

EUVD-2025-209754

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page...

CVE-2025-66172

creationtimestamp| type| source ---|---|--- 2026-05-09 04:51:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlfh3cmokg25...

CVE-2025-66171

creationtimestamp| type| source ---|---|--- 2026-05-09 04:41:05+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlfgjejuxq2i...

CVE-2026-41705

creationtimestamp| type| source ---|---|--- 2026-05-09 04:30:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlffwxr3u52o 2026-05-09 18:44:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgvnclkqn2g 2026-05-11 09:04:11+00:00| seen|...

CVE-2026-6665

creationtimestamp| type| source ---|---|--- 2026-05-09 04:25:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlffnzarsx2i 2026-05-09 17:46:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgsgh3l6j2n 2026-05-27 00:07:11+00:00| seen|...

CVE-2026-32445

creationtimestamp| type| source ---|---|--- 2026-05-09 03:33:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlfcpyizrh24...

SUSE CVE-2026-24767

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery SSRF vulnerability exists in the uploadViaURL functionality due to an unprotected HEAD request. While the subsequent file retrieval logic correctly enforces SSRF protections, t...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...