CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Unknown threat actors compromised CPUID "cpuid.com", a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT. The incident...

CVE-2026-35537

creationtimestamp| type| source ---|---|--- 2026-04-11 13:05:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj7vmva5fe2e 2026-04-11 13:50:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj7y5gquzy2a...

CVE-2026-5809

creationtimestamp| type| source ---|---|--- 2026-04-11 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116385253239941232 2026-04-11 09:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj7hxoc4mn2o 2026-04-11 09:15:27+00:00| published-proof-of-concept|...

CVE-2026-4153

creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:08+00:00| published-proof-of-concept| Telegram/jQJESTxAnDJkcV3IOr4zcsYk9e3AhwwItG0ad6oUuWk-UR8 2026-04-11 03:21:29+00:00| seen| Telegram/9p2zwy9MZzhVwoc6VK1G-jeZ0lfiSFc0xC5yOTrHz-Zg8Sw 2026-04-11 06:11:06+00:00| seen|...

CVE-2026-4149

creationtimestamp| type| source ---|---|--- 2026-04-11 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116383483774809251 2026-04-11 01:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj6osz6g672t 2026-04-11 03:06:41+00:00| seen|...

Server-side Request Forgery (SSRF)

Overview rembg is a Remove image background Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /api/remove endpoint, which accepts a URL parameter and fetches external resources. An attacker can access internal network resources and retrieve sensitive ima...

CVE-2026-33118

creationtimestamp| type| source ---|---|--- 2026-04-10 21:40:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116382579785054238 2026-04-10 22:07:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6dhiejdz2z 2026-04-12 20:00:00+00:00| seen|...

CVE-2026-33618

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-10 21:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mj6bgva46m22 2026-04-11 07:03:47+00:00| seen|...

glib: Buffer Under-read on GLib through glib/gfileutils.c via get_tmp_file()

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback

| Field | Value | |---|---| | Severity | High | | Type | SSRF -- unvalidated URL in webcrawl httpx fallback allows internal network access | | Affected | src/praisonai-agents/praisonaiagents/tools/webcrawltools.py:133-180 | Summary webcrawl's httpx fallback path passes user-supplied URLs directly...

CVE-2026-32892

creationtimestamp| type| source ---|---|--- 2026-04-10 19:07:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5zgsraew2g 2026-04-10 19:31:17+00:00| published-proof-of-concept| Telegram/5BYtFCja3ItyUAudrFtyDv4j4kJF13U-uq-WjYMkVFgHgE 2026-04-11 06:00:28+00:00| seen|...

CVE-2026-5483

creationtimestamp| type| source ---|---|--- 2026-04-10 18:18:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116381783943440087 2026-04-10 19:17:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5zypohjg2o 2026-04-10 19:31:23+00:00| published-proof-of-concept|...

CVE-2026-35600

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags,...

CVE-2026-41679

creationtimestamp| type| source ---|---|--- 2026-04-10 16:50:27+00:00| published-proof-of-concept| https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 2026-04-23 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116451431450772018 2026-04-23...

CVE-2026-35600 Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags,...

CVE-2026-35600 Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the email notification rendering process. An attacker can inject arbitrary HTML content, such as phishing links or tracking images, by crafting malicious task titles that are embedded in notification emails...

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Summary Task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags, injected Markdown constructs produce phishing links and tracking pixels in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the email notification rendering process. An attacker can inject arbitrary HTML content, such as phishing links or tracking images, by crafting malicious task titles that are embedded in notification emails...

GHSA-45Q4-X4R9-8FQJ Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Summary Task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags, injected Markdown constructs produce phishing links and tracking pixels in...