CVE-2026-6796

creationtimestamp| type| source ---|---|--- 2026-04-21 22:22:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjzzhfawbn2k...

CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

CVE-2026-40905

creationtimestamp| type| source ---|---|--- 2026-04-21 22:01:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjzyc6yddp2g 2026-04-21 22:37:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk22bozmx72o 2026-04-21 23:30:36+00:00| published-proof-of-concept|...

CVE-2026-40925

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...

CVE-2026-40372

creationtimestamp| type| source ---|---|--- 2026-04-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1835 2026-04-21 21:26:25+00:00| seen| Telegram/zADwex3kLz9IaLHwxMwQfRAPY0yfg2SR1HrZ5uE72Qmc 2026-04-22 02:29:17+00:00| seen|...

CVE-2026-6770

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:24+00:00| seen| https://bsky.app/profile/slackers.it/post/3mk2fodnoop2i 2026-04-23 13:42:32+00:00| seen|...

CVE-2026-6772

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-21 21:26:08+00:00| published-proof-of-concept| Telegram/Sh-VDLwDsigv2TtmIHQb5bM9xL-0-hntwqefkM3TigDwq8o 2026-04-22...

CVE-2026-6763

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:23+00:00| seen| https://bsky.app/profile/slackers.it/post/3mk2focmgie2i...

CVE-2026-6762

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:22+00:00| seen| https://bsky.app/profile/slackers.it/post/3mk2fobkx3t2w...

CVE-2026-6785

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:26+00:00| seen| https://bsky.app/profile/slackers.it/post/3mk2foep2552a 2026-04-26 20:07:11+00:00| seen|...

CVE-2026-6761

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-21 23:29:27+00:00| seen| Telegram/da4bvWuFIBZ1xbJCq39UTLrDihlERi1UO8pjihG32T1Z-BM 2026-04-22 02:01:22+00:00| seen|...

CVE-2026-6771

creationtimestamp| type| source ---|---|--- 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-21 21:26:08+00:00| published-proof-of-concept| Telegram/Sh-VDLwDsigv2TtmIHQb5bM9xL-0-hntwqefkM3TigDwq8o 2026-04-22...

CVE-2026-40161

creationtimestamp| type| source ---|---|--- 2026-04-21 19:25:31+00:00| published-proof-of-concept| Telegram/ul8xPPBt1TpPWUc6F08s489cG5Kpdb6-6jXrljeUyK6zBrY 2026-04-23 02:40:07+00:00| seen| https://bsky.app/profile/releaseport.com/post/3mk4yciurl22j...

CVE-2026-40050

creationtimestamp| type| source ---|---|--- 2026-04-21 19:25:24+00:00| seen| Telegram/IV3XUTumqBvhxDGxYKmJv890gnK1hu13PgwZ6nuJXKkSo 2026-04-21 19:25:31+00:00| published-proof-of-concept| Telegram/ul8xPPBt1TpPWUc6F08s489cG5Kpdb6-6jXrljeUyK6zBrY 2026-04-22 10:03:50+00:00| seen|...

CVE-2026-6766

creationtimestamp| type| source ---|---|--- 2026-04-21 19:25:08+00:00| seen| Telegram/sOCPjtJD4k5MvWwp6dRuETsdkHJ60TzeO4tn1nY4b7uMQ 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:23+00:00| seen|...

CVE-2026-6746

creationtimestamp| type| source ---|---|--- 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:18+00:00| seen|...

EUVD-2026-24555

free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation...

free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation

Summary A fail-open request handling flaw in the UDR service causes the /nudr-dr/v2/policy-data/subs-to-notify POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions wit...

CVE-2026-40608

Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers /api/state, /api/restore, and /api/history-svg that process incoming requests by accumulating the entire request body into a...

CVE-2026-40608 Next AI Draw.io: Unbounded HTTP Body — Denial of Service

Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers /api/state, /api/restore, and /api/history-svg that process incoming requests by accumulating the entire request body into a...