CVE-2026-40077

Summary: CVE-2026-40077 describes an IDOR in Beszel’s hub API endpoints that read a system ID from URL parameters. Prior to version 0.18.7, an authenticated user could access routes for any system if they knew the system ID, with system IDs being 15-character alphanumeric tokens and container IDs...

CVE-2026-39670

Server-Side Request Forgery SSRF vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual Link Preview: from n/a through = 2.3.0...

CVE-2026-35578

ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For...

CVE-2026-5962

creationtimestamp| type| source ---|---|--- 2026-04-09 19:22:59+00:00| published-proof-of-concept| Telegram/k5gHuzl44UiSjs6WvJKw2ZASZi-uE6KFE3zi6HenZzrhwHY 2026-04-09 20:17:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3mumbkgo27...

CVE-2026-39912

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the loginwithmaillinkenable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receiv...

CVE-2026-40190

creationtimestamp| type| source ---|---|--- 2026-04-09 18:42:43+00:00| published-proof-of-concept| https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252 2026-04-10 22:10:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6dnzceml2x...

CVE-2026-39912

The CVE-2026-39912 entry describes a token exposure in the loginWithMailLink flow affecting V2Board (1.6.1–1.7.4) and Xboard (up to 0.1.9). When login_with_mail_link_enable is active, the HTTP response body reveals the full authentication URL, allowing an unauthenticated attacker to POST to login...

CVE-2026-39912 v2board / Xboard Authentication Token Exposure via loginWithMailLink

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the loginwithmaillinkenable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receiv...

Exploit for CVE-2026-39912

CVE-2026-39912 - Xboard / V2Board Unauth Account Takeover M...

EUVD-2026-20932

A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable...

CVE-2026-30478

A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable...

CVE-2026-40071

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/packageorder, /json/linkorder, and /json/abortlink WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execut...

UBUNTU-CVE-2026-30479

A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable...

CVE-2026-5440

creationtimestamp| type| source ---|---|--- 2026-04-09 17:14:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3cmqgvs622 2026-04-14 20:03:14+00:00| published-proof-of-concept| Telegram/P20Htht508gPcGtfhYsw3BkHMYZAVXCzBRlMvbh3o3mGtY...

CVE-2026-5439

creationtimestamp| type| source ---|---|--- 2026-04-09 16:46:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3b2jklkn25 2026-04-14 20:03:14+00:00| published-proof-of-concept| Telegram/P20Htht508gPcGtfhYsw3BkHMYZAVXCzBRlMvbh3o3mGtY...

CVE-2026-5442

creationtimestamp| type| source ---|---|--- 2026-04-09 16:30:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3a5t24yy2j 2026-04-14 20:03:31+00:00| seen| Telegram/BoOqWaO3KXSkNoeZKG9-5DucbPr6wdRjfTcRW39IR2MuNQ...

CVE-2026-39843

Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address ...

CVE-2026-33266

creationtimestamp| type| source ---|---|--- 2026-04-09 15:03:13+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj33cf7s6b2p 2026-04-10 21:23:28+00:00| seen| Telegram/OQKBgo-nZL6sXwBX9bmjZlSNqFSsDAVUFOIG0ZNThQ0ug 2026-04-12 11:59:55+00:00| seen|...

CLSA-2026-1775722568 binutils: Fix of 4 CVEs

CVE-2025-5244: fix NULL pointer dereference in elfgcsweep for empty section groups - CVE-2025-5245: fix memory corruption in debugtypesamep incorrect NULL check - CVE-2026-3441: fix out-of-bounds read in xcofflinkaddsymbols xscnlen bounds check - CVE-2026-3442: fix out-of-bounds read in...

CVE-2026-4660

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package...