CVE-2026-42180

Lemmy prior to version 0.19.18 is affected by a server-side request forgery: an authenticated low-privilege user can create a link post via POST /api/v3/post, and when posted to public communities Lemmy dispatches a Webmention to the target. The code path only validates the URL’s syntax/scheme (h...

CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP...

CVE-2026-41574

creationtimestamp| type| source ---|---|--- 2026-05-08 19:23:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlehe3i6pe2i...

CVE-2026-44499

creationtimestamp| type| source ---|---|--- 2026-05-08 18:38:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleeu5cpdq2v 2026-05-08 20:10:29+00:00| seen| https://gist.github.com/alon710/b2fb36b6ecfecf3424b0cb12c54264f5...

CVE-2026-41570

creationtimestamp| type| source ---|---|--- 2026-05-08 17:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlecp3w7il2q...

CVE-2026-7864

creationtimestamp| type| source ---|---|--- 2026-05-08 17:48:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlebzycadc2p...

CVE-2026-41524

creationtimestamp| type| source ---|---|--- 2026-05-08 17:44:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlebsllkdo2t 2026-05-08 18:28:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleebyjkhy2q...

CVE-2026-41690

creationtimestamp| type| source ---|---|--- 2026-05-08 17:29:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mleazdfstp2c 2026-05-08 18:36:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleepyw5wy2i...

CVE-2026-41683

creationtimestamp| type| source ---|---|--- 2026-05-08 17:22:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mleam5ppcx2c 2026-05-08 19:13:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlegs6ixd72c...

CVE-2026-42072

creationtimestamp| type| source ---|---|--- 2026-05-08 17:22:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlealona2526 2026-05-08 18:34:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleem5x72k2v 2026-05-09 10:30:28+00:00| seen|...

CVE-2026-43344

creationtimestamp| type| source ---|---|--- 2026-05-08 17:17:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleadq6tbe2i...

Active attack: Dirty Frag Linux vulnerability expands post-compromise risk

In this article 1. Why Dirty Frag matters 2. Technical overview 3. Exploitation scenarios 4. Mitigation guidance 5. Post-mitigation integrity verification 6. References A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged...

Active attack: Dirty Frag Linux vulnerability expands post-compromise risk

In this article 1. Why Dirty Frag matters 2. Technical overview 3. Exploitation scenarios 4. Mitigation guidance 5. Post-mitigation integrity verification 6. References A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged...

CVE-2026-42353

creationtimestamp| type| source ---|---|--- 2026-05-08 17:07:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mle7qq5zuy2z 2026-05-08 18:26:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlee6ysikv2k...

CVE-2026-43348

creationtimestamp| type| source ---|---|--- 2026-05-08 17:00:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mle7dybt7j2p 2026-07-02 06:19:06+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260702...

CVE-2026-42793

creationtimestamp| type| source ---|---|--- 2026-05-08 16:15:00+00:00| published-proof-of-concept| https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-qf4g-9fqq-mmm7 2026-05-08 19:03:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlegaauzd22q...

CVE-2026-41886 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, … without...

CVE-2026-41886 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, … without...

CVE-2026-41886 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, … without...

CVE-2026-41886

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, … without...