CVE-2026-34352

creationtimestamp| type| source ---|---|--- 2026-03-26 23:18:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyqgw7v2y2h 2026-03-27 00:21:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhytyc2um322 2026-03-27 01:18:44+00:00| published-proof-of-concept|...

CVE-2026-33711

creationtimestamp| type| source ---|---|--- 2026-03-26 22:08:26+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-q9vp-3wcg-8p4x 2026-03-27 00:26:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyu7xmsjz2d 2026-03-30 19:00:23+00:00| seen|...

CVE-2026-33743

creationtimestamp| type| source ---|---|--- 2026-03-26 22:08:22+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3 2026-03-27 00:11:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhytg7w7d32z...

CVE-2026-33896

creationtimestamp| type| source ---|---|--- 2026-03-26 22:05:43+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2328-f5f3-gj25 2026-03-27 23:27:55+00:00| seen| Telegram/9UoOcMml4hO1LPqEQWig8KjS1ZNRBXJeCq-u3-UaU0LNh0 2026-04-14 10:07:07+00:00| seen|...

UNIX Symbolic Link (Symlink) Following

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the agents.create and agents.update processes. An attacker can append arbitrary content to files outside the intended workspace by planting a...

CVE-2026-32516

creationtimestamp| type| source ---|---|--- 2026-03-26 21:36:23+00:00| seen| Telegram/qpJXIfLucPvhQtEDSHE7IdszXR3MHRZbZWkV9-ESfqWxnI 2026-04-08 08:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mixuul2dxp2e...

CVE-2026-32485

creationtimestamp| type| source ---|---|--- 2026-03-26 21:35:36+00:00| seen| Telegram/jNlDBTackbRa-OzLBD4eltRa4dE7lS0-uVg4cHfoz-Hg 2026-04-07 05:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miv2dr5xbv2w...

CVE-2026-24993

creationtimestamp| type| source ---|---|--- 2026-03-26 21:34:32+00:00| seen| Telegram/jvhOKmzqiPeYBdBxVFESt3SUAdqySxNGUXLiFxkgoqjLWk 2026-04-09 03:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mizukzu6di2t...

CVE-2026-3622

The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-bounds read, potentially causing a crash of the UPnP service. Successful exploitation can cause the UPnP service to crash, resulting in a Denial-of-Service condition. This...

CVE-2026-33537

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v SSRF via Photo::fromUrl contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach...

GHSA-CPGW-WGF3-XC6V

creationtimestamp| type| source ---|---|--- 2026-03-26 21:03:16+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mhyivdkgzk2t...

CVE-2026-33153

creationtimestamp| type| source ---|---|--- 2026-03-26 20:39:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyhkiv4tf23 2026-03-26 21:36:40+00:00| seen| Telegram/gdbQBvnuOgX0zlyJL9kfjxoCoTp9WBTGn5-zeTA4spKkwcA...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via disclosure of the link share hash combined with an insecure direct object reference in attachment handling. An attacker can access sensitive data across the entire instance by chainin...

GO-2026-4855 Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...

GO-2026-4850 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-4848 Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

CVE-2021-4474

creationtimestamp| type| source ---|---|--- 2026-03-26 20:25:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhygqwfvmb2s...

CVE-2026-33505

creationtimestamp| type| source ---|---|--- 2026-03-26 20:14:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyg6ucvzd2z 2026-03-26 21:36:40+00:00| seen| Telegram/gdbQBvnuOgX0zlyJL9kfjxoCoTp9WBTGn5-zeTA4spKkwcA 2026-04-18 09:37:07+00:00| seen|...

CVE-2026-3190

creationtimestamp| type| source ---|---|--- 2026-03-26 20:07:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyfre7bhx22...

CVE-2026-33537 Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v SSRF via Photo::fromUrl contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach...