Discourse Access Control Error Vulnerability (CNVD-2026-17476)

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from an Access Control Error vulnerability that can be exploited by an attacker to retrieve the content of posts, threa...

PT-2026-31876

A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely...

PT-2026-31976

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending...

📄 Microsoft MMC MSC EvilTwin Local Admin Creation

Microsoft MMC MSC EvilTwin local admin creation exploit. !/usr/bin/env python3 Exploit Title: Microsoft MMC MSC EvilTwin - Local Admin Creation Date: 2025-11-22 Author: Mohammed Idrees Banyamer Author Country: Jordan GitHub: https://github.com/mbanyamer Vendor Homepage: https://www.microsoft.com...

wolfSSL（CyaSSL） 安全漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the US company wolfSSL, designed for developers working with embedded systems. wolfSSL CyaSSL contains a security vulnerability that stems from the handling of mixed key sharing in TLS 1.3 and post-quantum...

CVE-2026-34500

creationtimestamp| type| source ---|---|--- 2026-04-09 23:43:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj3yf6hqm226 2026-04-10 00:22:52+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mj42l3ynn223 2026-04-10 12:50:14+00:00| seen|...

CVE-2026-5264

creationtimestamp| type| source ---|---|--- 2026-04-09 23:30:50+00:00| seen| Telegram/aaKaZzhZCQTbBESVtGmK3HO5aOAiXiyEGsKbx2XTc93AVKM 2026-04-10 00:56:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj44ghlwjv24...

CVE-2026-5460

Vulnerability summary (CVE-2026-5460) : A heap use-after-free exists in wolfSSL’s TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error path of TLSX_KeyShare_ProcessPqcHybridClient() (src/tls.c), TLSX_KeyShare_ProcessPqcClient_ex() frees a KyberKey object on error. The ...

CVE-2026-5460

A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography PQC hybrid KeyShare processing. In the error handling path of TLSXKeyShareProcessPqcHybridClient in src/tls.c, the inner function TLSXKeyShareProcessPqcClientex frees a KyberKey object upon encountering an error. The call...

CVE-2026-5460 Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3

A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography PQC hybrid KeyShare processing. In the error handling path of TLSXKeyShareProcessPqcHybridClient in src/tls.c, the inner function TLSXKeyShareProcessPqcClientex frees a KyberKey object upon encountering an error. The call...

CVE-2026-5460 Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3

A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography PQC hybrid KeyShare processing. In the error handling path of TLSXKeyShareProcessPqcHybridClient in src/tls.c, the inner function TLSXKeyShareProcessPqcClientex frees a KyberKey object upon encountering an error. The call...

CVE-2026-5978

creationtimestamp| type| source ---|---|--- 2026-04-09 23:29:26+00:00| published-proof-of-concept| Telegram/RnbO6h7rE-8F1e1uXIlS73R4kRuAIo63byQ11pUP09Fz6LA 2026-04-10 08:00:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4u4ocww72x...

CVE-2026-5979

creationtimestamp| type| source ---|---|--- 2026-04-09 23:29:26+00:00| published-proof-of-concept| Telegram/RnbO6h7rE-8F1e1uXIlS73R4kRuAIo63byQ11pUP09Fz6LA 2026-04-10 08:00:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4u4vgkp72r 2026-05-26 03:37:06+00:00| seen|...

CVE-2026-35638

creationtimestamp| type| source ---|---|--- 2026-04-09 23:01:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3w2dyxwk23 2026-04-09 23:30:34+00:00| seen| Telegram/G3Fi-nNLRGY8ZLcJORLcPgOLisPY2kSgZDawKJf-COsCMo 2026-04-10 07:08:59+00:00| seen|...

CVE-2026-32990

creationtimestamp| type| source ---|---|--- 2026-04-09 22:58:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj3vunc2a325 2026-04-10 00:22:52+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mj42l3ynn223 2026-04-10 12:50:14+00:00| seen|...

CVE-2026-35642

creationtimestamp| type| source ---|---|--- 2026-04-09 22:46:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3v7ihs7n2z...

CVE-2026-35637

creationtimestamp| type| source ---|---|--- 2026-04-09 22:29:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3uatzhgb2j 2026-04-09 23:30:23+00:00| published-proof-of-concept| Telegram/n2dd6XRjJv9G8jt1S2EaZawu98TdZ3-sGq35ZGwXZFcMAwI 2026-04-09 23:30:34+00:00| seen|...

CVE-2026-35640

creationtimestamp| type| source ---|---|--- 2026-04-09 22:17:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3tkahnne2i...

CVE-2026-40115

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe registry server server.py reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default no token...

CVE-2026-5984

CVE-2026-5984 affects the D-Link DIR-605L (firmware 2.13B01). The vulnerable component is the POST Request Handler, specifically the function formSetLog in /goform/formSetLog. Manipulating the argument curTime can cause a buffer overflow, enabling a remote attack. Public exploit is referenced, an...