CVE-2026-42556

creationtimestamp| type| source ---|---|--- 2026-05-08 23:20:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mleultxumj2z 2026-05-09 01:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlf3rb64qt2e...

CVE-2026-42454

creationtimestamp| type| source ---|---|--- 2026-05-08 23:20:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mleulmg5zy2e 2026-05-09 01:08:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlf2nhdgwr2q 2026-05-09 01:30:32+00:00| seen|...

CVE-2026-42556

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/?share=true to another user. The preview page...

CVE-2026-44330

creationtimestamp| type| source ---|---|--- 2026-05-08 23:02:41+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-rwww-x45w-p52w 2026-05-28 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmwaoshibg2p...

CVE-2026-42190

creationtimestamp| type| source ---|---|--- 2026-05-08 22:50:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlesw5ku2r2n...

CVE-2026-25199

creationtimestamp| type| source ---|---|--- 2026-05-08 22:29:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlerqoxyid2w 2026-05-09 05:01:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlfhn5uh3l2v...

CVE-2026-42556

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/?share=true to another user. The preview page...

EUVD-2026-28866

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/?share=true to another user. The preview page...

CVE-2026-45303

creationtimestamp| type| source ---|---|--- 2026-05-08 20:57:40+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-4vrc-m9ch-6m3r 2026-05-16 00:25:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlwljnotjv2n...

CVE-2026-45301

creationtimestamp| type| source ---|---|--- 2026-05-08 20:57:06+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33 2026-05-20 13:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmbxwk4kdn2s 2026-06-15 17:02:28+00:00|...

GHSA-628H-Q48J-JR6Q Phoenix: Long-poll NDJSON body splitting causes large memory allocation

Summary An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of concurrent requests can be sufficient to let the node run out of memory. See also...

CVE-2026-7807

creationtimestamp| type| source ---|---|--- 2026-05-08 20:24:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlekqzgaqt2k 2026-05-08 23:34:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlevg6x6ic2n 2026-06-05 04:37:05+00:00| seen|...

CVE-2026-39918

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in t...

CVE-2026-41924

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the settime or StartSniffer functions. Attackers can...

CVE-2026-37431

creationtimestamp| type| source ---|---|--- 2026-05-08 19:57:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlejbistw72c...

CVE-2026-29975

creationtimestamp| type| source ---|---|--- 2026-05-08 19:57:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlejbb5kei2n...

GHSA-45M8-CPM2-3V65 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL - backend/openwebui/socket/main.py lin...

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL - backend/openwebui/socket/main.py lin...

CVE-2026-42180 Lemmy: SSRF in /api/v3/post via Webmention dispatch

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controll...

CVE-2026-42180 Lemmy: SSRF in /api/v3/post via Webmention dispatch

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controll...