CVE-2026-41900

creationtimestamp| type| source ---|---|--- 2026-05-06 23:00:13+00:00| seen| Telegram/msQTanSLkX-OxkjOrr400lcWfFt4y0eZWCcTmXgDmxd3Ek4 2026-05-07 03:00:06+00:00| seen| Telegram/N1Jo8qZWaWReiLt-N5l6uzcgIVKcO6O8PdoiYgN9aP0HPY 2026-05-08 04:36:45+00:00| seen|...

CVE-2026-43243

A flaw was found in the drm/amd/display component of the Linux kernel. A missing signal type check in the dcn401 getphyd32clksrc function, when attempting to access link encoder link enc on a DisplayPort Interoperability and Compliance Association DPIA link, can lead to a system crash. This...

CVE-2026-8033

creationtimestamp| type| source ---|---|--- 2026-05-06 22:35:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7r64psdp2p...

CVE-2026-8032

creationtimestamp| type| source ---|---|--- 2026-05-06 22:29:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7qtcljw22r...

CVE-2026-44113

creationtimestamp| type| source ---|---|--- 2026-05-06 21:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7octvlei2p 2026-05-19 18:30:06+00:00| seen| https://t.me/truesecator/8221...

CVE-2026-43582

creationtimestamp| type| source ---|---|--- 2026-05-06 21:36:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7ntpxucl2e...

CVE-2026-40281

Gotenberg 8.x (

CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate...

CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate...

CVE-2026-43576

creationtimestamp| type| source ---|---|--- 2026-05-06 20:45:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kyox52426...

CVE-2026-46366

creationtimestamp| type| source ---|---|--- 2026-05-06 20:45:01+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-99qv-g4x9-mgc3 2026-05-15 21:44:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlwcjmu7ci2n 2026-05-16 15:00:22+00:00| seen|...

CVE-2026-44110

creationtimestamp| type| source ---|---|--- 2026-05-06 20:43:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kuxuy7f2k 2026-05-06 22:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7pyc3rbz2c 2026-05-08 10:07:08+00:00| seen|...

CVE-2026-44109

creationtimestamp| type| source ---|---|--- 2026-05-06 20:42:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kuqcrbd2r 2026-05-06 22:19:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7qbd6xes2c 2026-05-07 03:00:12+00:00| seen|...

CVE-2026-7854

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function urlruleasp of the file /urlrule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploi...

GHSA-WHQH-9PQ5-C7R3 phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Summary The SvgSanitizer::decodeAllEntities method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities e.g., amp;amp;amp;106; for j, an attacker can bypass both isSafe...

phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Summary The SvgSanitizer::decodeAllEntities method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities e.g., amp;amp;amp;106; for j, an attacker can bypass both isSafe...

CVE-2026-46362

creationtimestamp| type| source ---|---|--- 2026-05-06 20:11:52+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-hpgw-ww76-c68r...

CVE-2025-63705

creationtimestamp| type| source ---|---|--- 2026-05-06 19:56:42+00:00| seen| https://gist.github.com/6en6ar/a2ac44da0f4e580190be3e66cfbb9a4a...

CVE-2025-63704

creationtimestamp| type| source ---|---|--- 2026-05-06 19:53:03+00:00| seen| https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b...

CVE-2026-44117 OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests...