CVE-2026-22664: Server-Side Request Forgery (SSRF)

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter. Attackers can exploit the lack ...

Fixed in Apache Tomcat 9.0.117

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used. This was fixed with commit ff589ab2. This issue was reported to the Tomcat security...

Linux Distros Unpatched Vulnerability : CVE-2026-23408

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of nsname in aareplaceprofiles if nsname is NULL after 1071 error...

Incorrect Authorization

Overview @openclaw/matrix is an OpenClaw Matrix channel plugin Affected versions of this package are vulnerable to Incorrect Authorization in the process that fetches thread root and reply context, which bypasses the sender allowlist. An attacker can gain unauthorized access to message threads by...

CVE-2026-34838

creationtimestamp| type| source ---|---|--- 2026-04-02 20:56:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik3r6ye3j2j 2026-04-02 22:23:12+00:00| published-proof-of-concept| Telegram/qg3HF91OLRRzWQbI7Pfv-fl8vLkHd7iL-mBbLD40slyOww 2026-04-03 02:22:10+00:00| seen|...

CVE-2026-34759

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. Thes...

CVE-2026-34759 OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. Thes...

CVE-2026-34759

Affected software: OneUptime Open Source platform (prior to v10.0.42). Vulnerability: Multiple notification API endpoints were registered without authentication middleware, exposing /notification/ and enabling an unauthenticated attacker to exploit a projectId leak from the public Status Page API...

EUVD-2026-18513

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. Thes...

GHSA-HR89-H2PP-F3C8

creationtimestamp| type| source ---|---|--- 2026-04-02 17:37:03+00:00| seen| Telegram/37miVMXR04DKfwyt7TTlg-rZzunXudUntV94ZrNBpzOyTo...

CVE-2026-23350

creationtimestamp| type| source ---|---|--- 2026-04-02 17:35:48+00:00| seen| Telegram/I2UJQxU-SmNvnxMbt-Q1U93mxcnPYzu5qIdHwXgobLGoKA...

CVE-2026-35385

creationtimestamp| type| source ---|---|--- 2026-04-02 17:18:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116336249196256275 2026-04-02 18:09:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijsgdr42e2t 2026-04-02 18:24:22+00:00| seen|...

CVE-2025-40035

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

CVE-2025-40112

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

CVE-2025-40301

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

CVE-2018-20852

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

GHSA-GR22-4784-XVW3

creationtimestamp| type| source ---|---|--- 2026-04-02 15:21:32+00:00| seen| Telegram/2ZRPJX-1sLKzKjRuu5udQKo36EYUbcyEMGSCPR0-mfcyWco...

CVE-2026-4634

creationtimestamp| type| source ---|---|--- 2026-04-02 14:45:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijgzxjx4y2s 2026-04-02 15:20:57+00:00| seen| Telegram/1FZmwvj65iY9NiI7VGWCBujhZKTilfhPPvdqi0EqVANQnis 2026-04-17 02:07:07+00:00| seen|...

CVE-2026-4282

creationtimestamp| type| source ---|---|--- 2026-04-02 14:18:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijfkqcg5o2q 2026-04-02 15:20:57+00:00| seen| Telegram/1FZmwvj65iY9NiI7VGWCBujhZKTilfhPPvdqi0EqVANQnis 2026-04-02 16:00:18+00:00| seen|...

CVE-2026-23415

creationtimestamp| type| source ---|---|--- 2026-04-02 13:01:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116335238494662786 2026-04-02 14:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijf3yjfqh2s 2026-04-24 17:19:23+00:00| published-proof-of-concept|...