GHSA-VJ45-X3PJ-F4W4 Weblate: Improper access control for pending tasks in API

Impact The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. Patches https://github.com/WeblateOrg/weblate/pull/18515 Workarounds The attacker needs to guess the random UUID of the task, so...

Malicious code in chai-as-optimized (npm)

chai-as-optimized is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint.io/0ac7efbc0b6b1a53b305 and executes it similar to malware in to chai-await-test. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

CVE-2026-5426

creationtimestamp| type| source ---|---|--- 2026-04-16 18:04:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmymffdvg2t 2026-04-17 00:00:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116417104416675988 2026-04-17 00:00:42+00:00| seen|...

CVE-2026-40308

creationtimestamp| type| source ---|---|--- 2026-04-16 17:52:10+00:00| published-proof-of-concept| https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch 2026-04-16 23:18:29+00:00| published-proof-of-concept| Telegram/uUtOgPMgnfpzQaGdgE5uvRP8Wc5QVkmzi4lAg5HL6Ws0-I...

EUVD-2026-23231

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message...

CVE-2026-30459

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message...

CVE-2024-8010

creationtimestamp| type| source ---|---|--- 2026-04-16 14:44:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmnidlf3e26...

CVE-2024-4867

creationtimestamp| type| source ---|---|--- 2026-04-16 14:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmlx47bla2q...

CVE-2026-33804

creationtimestamp| type| source ---|---|--- 2026-04-16 14:02:05+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjml4smbi22n 2026-04-16 17:20:51+00:00| seen| Telegram/s117pb2GT3VwdfXaV13Oi8Gqr-ePRyI5oBJZVU7ek3MbpQ...

CVE-2026-6270

creationtimestamp| type| source ---|---|--- 2026-04-16 13:50:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjmki3smik2n 2026-04-16 15:19:53+00:00| seen| Telegram/5D912vOHN-G66auq1Hho6wwp26h6YJ5ZFpozWyyt1z6weM...

CVE-2026-3489

creationtimestamp| type| source ---|---|--- 2026-04-16 13:05:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmhxikp3s26 2026-04-16 13:15:15+00:00| seen| Telegram/AxxdIKwHC80bdVPCpOjpFf-JZoQD5Wyx830mnikToRUE...

CVE-2026-6367

creationtimestamp| type| source ---|---|--- 2026-04-16 11:30:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjmcoi7iox2s 2026-05-20 02:37:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmaur5rddj2o...

CVE-2026-0718

creationtimestamp| type| source ---|---|--- 2026-04-16 10:03:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjm5t6k5am2f...

CVE-2026-3599

creationtimestamp| type| source ---|---|--- 2026-04-16 07:16:05+00:00| seen| Telegram/CPpzSH5KUbLaIS5NKRf7RUb00cNUuI-gWISSrbtluJWLjQ 2026-04-16 13:15:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmikrdk762i...

CVE-2026-3596

creationtimestamp| type| source ---|---|--- 2026-04-16 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116412856993519542 2026-04-16 07:16:05+00:00| seen| Telegram/CPpzSH5KUbLaIS5NKRf7RUb00cNUuI-gWISSrbtluJWLjQ 2026-04-16 13:15:56+00:00| seen|...

CVE-2026-40502

creationtimestamp| type| source ---|---|--- 2026-04-16 02:42:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjlf6ozotn2t 2026-04-16 05:17:50+00:00| published-proof-of-concept| Telegram/TCjlHJMv9N6S0B2yz3RFhhjLUk96NJtTkRt7NB8H70qfRI 2026-04-16 13:48:31+00:00| seen|...

CVE-2026-40959

creationtimestamp| type| source ---|---|--- 2026-04-16 02:22:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjle2uxpa32g 2026-04-16 05:17:50+00:00| published-proof-of-concept| Telegram/TCjlHJMv9N6S0B2yz3RFhhjLUk96NJtTkRt7NB8H70qfRI 2026-04-16 14:00:41+00:00| seen|...

CVE-2026-4949

creationtimestamp| type| source ---|---|--- 2026-04-16 02:06:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjld5kvghr2t...

CVE-2026-40947

creationtimestamp| type| source ---|---|--- 2026-04-16 02:03:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjlcy6tbfd2w...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the attributionlink property, which constructs HTML by directly interpolating user-controlled fields without escaping. An attacker can execute arbitrary JavaScript in the context of users viewing ingredient o...