CVE-2026-6026

creationtimestamp| type| source ---|---|--- 2026-04-10 07:17:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4rrch34w2m 2026-04-10 08:57:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4xdzoraq2i 2026-04-10 09:17:31+00:00| seen|...

CVE-2026-5997

creationtimestamp| type| source ---|---|--- 2026-04-10 02:40:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4cbcgyht2i 2026-04-10 03:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj4dez4x6f2q 2026-04-10 03:00:32+00:00| seen|...

CVE-2026-5995

creationtimestamp| type| source ---|---|--- 2026-04-10 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116377821414965974 2026-04-10 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj46e3334v2r 2026-04-10 02:55:37+00:00| seen|...

CVE-2026-4057 Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makeMediaPublic and makeMediaPrivate functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for editposts capability...

Anthropic Claude Code < 2.1.7 Permission Deny Bypass Through Symbolic Links (CVE-2026-25724)

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.7. It is, therefore, affected by a permission bypass vulnerability. Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly...

PT-2026-31951

Name of the Vulnerable Software and Affected Versions: Vikunja versions prior to 2.3.0 Description: Vikunja, a self-hosted task management platform, was found to have an issue where task titles were directly embedded into Markdown link syntax in overdue email notifications without proper escaping...

Vikunja 跨站脚本漏洞

Vikunja is an open-source to-do application developed by Vikunja developers. Versions of Vikunja prior to 2.3.0 had a cross-site scripting vulnerability. This vulnerability occurred when Markdown links were embedded in task titles in overdue email notifications without special characters being...

CVE-2026-5983

creationtimestamp| type| source ---|---|--- 2026-04-09 23:30:56+00:00| published-proof-of-concept| Telegram/jvxENlxS5zD0hLDn-51kxH7F1GhkNHxvGXTHS6t1bT7Jtk 2026-04-10 00:59:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj44lwuv2e2i 2026-04-10 06:08:15+00:00| seen|...

CVE-2026-34487

creationtimestamp| type| source ---|---|--- 2026-04-09 23:28:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj3xkeegar2m 2026-04-10 00:22:52+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mj42l3ynn223 2026-04-10 12:50:14+00:00| seen|...

CVE-2019-25669

creationtimestamp| type| source ---|---|--- 2026-04-09 23:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj3wdnyeyi2u 2026-04-10 02:29:15+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mj4bn3n3ux2s...

CVE-2026-35645

creationtimestamp| type| source ---|---|--- 2026-04-09 22:27:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3u4dz3n322 2026-04-09 23:30:34+00:00| seen| Telegram/G3Fi-nNLRGY8ZLcJORLcPgOLisPY2kSgZDawKJf-COsCMo 2026-04-10 07:08:19+00:00| seen|...

CVE-2026-40150

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the webcrawl function in praisonaiagents/tools/webcrawltools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. Thi...

EUVD-2023-60552

Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the reviewid URL parameter. Attackers can craft malicious links containing JavaScript payloads that execute in victims' browsers when clicked, enablin...

CVE-2023-54363

Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating multiple GET parameters including show, reviews, typeid, distance, facilities, categories, prices, location, and Itemid. Attackers can...

CVE-2026-40089

Sonicverse (Self-hosted Docker Compose stack) contains an SSRF in the dashboard API client (apps/dashboard/lib/api.ts). User-controlled URLs are passed from the dashboard to a server-side HTTP client without sufficient validation, allowing an authenticated operator to trigger arbitrary HTTP reque...

CVE-2026-35516

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services AWS IMDSv1, cloud metadata, internal APIs by creating a link with a publ...

CVE-2026-39985

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

CVE-2026-39985 LORIS has an open redirect field on login

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

CVE-2026-34578

creationtimestamp| type| source ---|---|--- 2026-04-09 16:59:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3brukrch2n 2026-04-12 12:00:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjcchlxy3v24 2026-04-14 23:37:07+00:00| seen|...

CVE-2026-40163

creationtimestamp| type| source ---|---|--- 2026-04-09 11:09:20+00:00| published-proof-of-concept| https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292 2026-04-10 19:22:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj62bo53iz2g 2026-04-10 19:31:23+00:00|...