CVE-2026-39368

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

CVE-2026-29181

creationtimestamp| type| source ---|---|--- 2026-04-07 18:34:27+00:00| published-proof-of-concept| https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475 2026-04-07 23:20:49+00:00| published-proof-of-concept|...

Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags

Summary The fix for ExifTool arbitrary file write commit 043b158, released in v8.29.0 uses a case-sensitive blocklist to filter dangerous pseudo-tags. ExifTool processes tag names case-insensitively, so alternate casings bypass the filter. The blocklist also omits the HardLink and SymLink...

GHSA-QMWH-9M9C-H36M Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags

Summary The fix for ExifTool arbitrary file write commit 043b158, released in v8.29.0 uses a case-sensitive blocklist to filter dangerous pseudo-tags. ExifTool processes tag names case-insensitively, so alternate casings bypass the filter. The blocklist also omits the HardLink and SymLink...

CVE-2026-35534

creationtimestamp| type| source ---|---|--- 2026-04-07 17:29:48+00:00| seen| Telegram/t7opZ3s7Nl85xZs745vJOFh0FG2Whznv9BGbk6FzHivbIC0 2026-04-11 03:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj6vvfabd62n...

Russia Hacked Routers to Steal Microsoft Office Tokens

Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens...

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

The Russia-linked threat actor known as APT28 aka Forest Blizzard has been linked to a new campaign that has compromised insecure MikroTik and TP-Link routers and modified their settings to turn them into malicious infrastructure under their control as part of a cyber espionage campaign since at...

CVE-2021-4473

creationtimestamp| type| source ---|---|--- 2026-04-07 15:58:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw5gorvxq22 2026-04-08 21:03:01+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3miz6wtjcpe2p 2026-04-26 22:07:07+00:00| seen|...

EUVD-2026-19726

ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For...

CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...

CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...

CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...

CVE-2026-35571

CVE-2026-35571 affects Emissary prior to 8.39.0. Mustache navigation templates interpolated config-controlled link values directly into href attributes without URL scheme validation, allowing an administrator with navItems access to inject javascript: URIs and trigger stored XSS against other aut...

CVE-2026-3466

creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:30+00:00| published-proof-of-concept| Telegram/OQovZCNyncHtmKsEQoVAn9WglYI3Qk-HPEu8DU-i8r2-BaQ 2026-04-07 15:38:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw4crqhwx2n...

CVE-2026-28808

creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:06+00:00| published-proof-of-concept| Telegram/QBh1FHyWJUCKYAyST3Bw6jIrLbUdJEHanO8DcWQylla0 2026-04-07 15:48:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw4uon3zm24...

CVE-2025-39666

creationtimestamp| type| source ---|---|--- 2026-04-07 15:20:46+00:00| seen| Telegram/ubthoF1g8rbiNT2f93TzwsoAmJLY2ZrVE2ygc3thq3uaBv8 2026-04-07 15:28:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw3s5p3cv2i...

CVE-2026-4401

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4401 2026-04-08 00:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwytkwmbm2z 2026-04-20 15:37:06+00:00| seen|...

CVE-2026-2263

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:04+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2263 2026-04-08 00:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwyqus2xm2o 2026-04-20 13:37:06+00:00| seen|...

CVE-2026-35516 LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services AWS IMDSv1, cloud metadata, internal APIs by creating a link with a publ...

CERTFR-2026-ACT-015

creationtimestamp| type| source ---|---|--- 2026-04-07 14:41:37+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mivz5ulz6q2n 2026-04-12 02:57:19+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mjbe4yzibh2t...