CVE-2026-4138

creationtimestamp| type| source ---|---|--- 2026-04-25 21:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdykbgp6c2g...

CVE-2026-23541

creationtimestamp| type| source ---|---|--- 2026-04-25 21:03:15+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkdwukrhzx2t...

CVE-2026-4074

creationtimestamp| type| source ---|---|--- 2026-04-25 17:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdl55axg22x...

CVE-2026-6041

creationtimestamp| type| source ---|---|--- 2026-04-25 15:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdegkpr5b2x...

CVE-2026-6236

creationtimestamp| type| source ---|---|--- 2026-04-25 14:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkdb3b2soi2s...

CVE-2026-6977

creationtimestamp| type| source ---|---|--- 2026-04-25 12:48:39+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkd3aiptsl2t...

CVE-2026-31676

The CVE-2026-31676 issue concerns the Linux kernel’s rxrpc subsystem. A flaw allowed duplicate or late RESPONSE packets to be processed outside the intended RXRPC_CONN_SERVICE_CHALLENGING state. The fix enforces state-checking under a state_lock before performing response verification and securit...

CVE-2026-28525

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

[SECURITY] Fedora 44 Update: libmicrohttpd-1.0.5-1.fc44

GNU libmicrohttpd is a small C library that is supposed to make it easy to run an HTTP server as part of another application. Key features that distinguish libmicrohttpd from other projects are: C library: fast and small API is simple, expressive and fully reentrant Implementation is http 1.1...

SUSE CVE-2026-31609

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbdfreesendio after smbdsendbatchflush smbdsendbatchflush already calls smbdfreesendio, so we should not call it again after smbdpostsend moved it to the batch list...

SUSE CVE-2026-31668

In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dstcache per encap route, shared between seg6inputcore and seg6outputcore. These two paths can perform the post-encap SID lookup ...

CVE-2026-32936

creationtimestamp| type| source ---|---|--- 2026-04-25 01:02:18+00:00| published-proof-of-concept| https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwr 2026-05-05 21:56:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml56jp3x6v2e...

CVE-2026-43873

creationtimestamp| type| source ---|---|--- 2026-04-25 00:46:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2 2026-05-12 05:38:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mln34ysrfi2t...

CVE-2026-41478

creationtimestamp| type| source ---|---|--- 2026-04-24 22:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbjlqme3z2n 2026-04-28 16:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mkkxq6o5ex2w 2026-04-28 16:07:10+00:00| seen|...

CVE-2026-41472 CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findingsjson field of...

CVE-2026-41328

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack require...

CVE-2026-41328

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack require...

FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

The U.S. Cybersecurity and Infrastructure Security Agency CISA has revealed that an unnamed federal civilian agency's Cisco Firepower device running Adaptive Security Appliance ASA software was compromised in September 2025 with a new malware called FIRESTARTER. FIRESTARTER, per CISA and the U.K....

GHSA-3JVJ-V6W2-H948 Lemmy has SSRF in /api/v3/post via Webmention dispatch

Summary Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but th...

Lemmy has SSRF in /api/v3/post via Webmention dispatch

Summary Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but th...