CVE-2026-28390

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

CVE-2026-3296

creationtimestamp| type| source ---|---|--- 2026-04-08 03:16:41+00:00| seen| Telegram/dROJOrCDMnkwqXhb9-Y-ghLBhlUA50W24DQUefxFEp990g8 2026-04-08 04:23:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixh4aj6sf25 2026-04-08 04:53:37+00:00| seen|...

CVE-2026-39847

creationtimestamp| type| source ---|---|--- 2026-04-07 23:21:25+00:00| seen| Telegram/ob3ye0FCdfhceb6CimILWC3jRIWmZERTbGMc-OQRsW6HR0 2026-04-08 00:00:38+00:00| seen| https://infosec.exchange/users/offseq/statuses/116366143495848270 2026-04-08 00:00:42+00:00| seen|...

CVE-2026-39307

Summary of CVE-2026-39307 PraisonAI templates installation uses Python’s zipfile.extractall() without validating that archive entries stay within the target extraction directory. This Zip Slip flaw existed prior to version 1.5.113 and could allow arbitrary file writes (potentially to system locat...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-35515

NestJS/core (@nestjs/core) contains a vulnerability in SseStream._transform() where un sanitized interpolation of upstream data into SSE output allows an attacker to inject arbitrary SSE events, spoof event types, and corrupt reconnection state. The issue arises from inserting message.type and me...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-24660

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:23+00:00| seen| https://infosec.place/objects/a2376c08-1874-41bc-927d-b5b917cc6297 2026-04-07 15:29:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3sfcjxx2p 2026-04-07 17:28:45+00:00|...

CVE-2026-5627

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:18+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mivyjoek5x26 2026-04-07 14:30:22+00:00| seen| https://infosec.exchange/users/offseq/statuses/116363900721699665 2026-04-07 14:44:48+00:00| seen|...

CVE-2024-43028

creationtimestamp| type| source ---|---|--- 2026-04-07 09:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mivicunecn2a 2026-04-07 10:00:56+00:00| seen| https://bsky.app/profile/potato.software/post/3mivjhz5lhn2n...

CVE-2026-5465

creationtimestamp| type| source ---|---|--- 2026-04-07 08:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mivcqtypg327 2026-04-07 09:15:25+00:00| seen| Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94 2026-04-07 09:37:20+00:00| seen|...

CVE-2026-1114

creationtimestamp| type| source ---|---|--- 2026-04-07 07:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116362132042797237 2026-04-07 09:15:25+00:00| seen| Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94 2026-04-07 09:32:19+00:00| seen|...

CVE-2025-54328

creationtimestamp| type| source ---|---|--- 2026-04-07 06:02:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miv45ttzr425 2026-04-07 08:06:44+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mivd3t5d2m2o 2026-04-08 08:07:19+00:00| seen|...

CVE-2026-35022

creationtimestamp| type| source ---|---|--- 2026-04-06 21:20:59+00:00| seen| Telegram/8Tvza3k4qy2IjH2O3f59isxEIVitW69EvgGBkLG1GZexI3E 2026-04-07 04:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116361542195290387 2026-04-07 04:30:30+00:00| seen|...

CVE-2026-35470

creationtimestamp| type| source ---|---|--- 2026-04-06 18:24:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitv4qwen22t 2026-04-06 18:24:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitv5jd3vu2j 2026-04-06 19:20:37+00:00| seen|...

CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

RHSA-2025:7458

creationtimestamp| type| source ---|---|--- 2026-04-06 15:19:47+00:00| seen| Telegram/zfToAAWf8eWnJ7ba07A0EZZiZLhP55gYdeGjYzJA6KMcCw 2026-04-06 15:20:12+00:00| seen| Telegram/0sUuWW8J84hCZb1n0MF5lAvDyk6dii4XfiqOlA0c3Bj-PlY 2026-04-06 15:20:35+00:00| seen|...

CVE-2026-5704

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload. An attacker can introduce unauthorized files with arbitrary content by providing a specially crafted archive that bypasses pre-extraction inspection mechanisms. Workaround This vulnerability can be mitigated by...