PT-2026-46472

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description A use after free issue exists in WebRTC, which allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory...

PT-2026-46477

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description A use after free issue exists in WebRTC, which allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory...

📄 openDCIM 25.01 SQL Injection

openDCIM version 25.01 remote SQL injection exploit that can be leveraged to execute arbitrary code. ================================================================================================================================== | Title : openDCIM 25.01 Python Exploit – Authenticated &...

PT-2026-42231

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.179 Description A use-after-free flaw exists in WebRTC, the component powering in-browser video and voice calls. A use-after-free is a memory corruption issue that occurs when an application continues...

PT-2026-42240

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.179 Description A use after free issue exists in WebRTC, which could allow a remote attacker to execute arbitrary code through a specially crafted HTML page. Use after free is a memory corruption flaw...

ALSA-2026:9135 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: scsi: qla2xxx: Fix improper freeing of purex item CVE-2025-68741 kernel: ALSA: aloop: Fix racy access at PCM trigger CVE-2026-2319...

PT-2026-33863

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypass sandbox restrictions and read arbitrary files...

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: scsi: qla2xxx: Fix improper freeing of purex item CVE-2025-68741 kernel: ALSA: aloop: Fix racy access at PCM trigger CVE-2026-2319...

BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner

This module detects BerriAI LiteLLM proxy servers affected by CVE-2026-42208, an unauthenticated SQL injection. During API-key verification the proxy interpolates the raw Authorization bearer value into a PostgreSQL query WHERE v.token = '' without parameterization. Because LiteLLM only hashes...

Ubuntu Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Real-time) vulnerabilities (USN-8184-1)

"The remote Ubuntu Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8184-1 advisory. Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen...

CVE-2026-32964

creationtimestamp| type| source ---|---|--- 2026-04-19 19:30:00+00:00| seen| https://jvn.jp/en/vu/JVNVU94271449 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-10...

CVE-2026-26399

creationtimestamp| type| source ---|---|--- 2026-04-19 16:00:04+00:00| seen| https://t.me/GithubRedTeam/80975...

CLSA-2026-1776599416 curl: Fix of CVE-2024-7264

CVE-2024-7264: fix ASN.1 GTime2str heap buffer over-read caused by off-by-one in fractional seconds length calculation...

Original Sin of Npm: A Study on Vulnerability Propagation in JavaScript Dependency Networks

Understanding vulnerability propagation is essential for assessing how vulnerabilities spread across components of a software package. This supports more accurate impact analysis and enhances threat detection and mitigation. In this paper, we investigate how a small number of vulnerable JavaScrip...

CVE-2026-5958

When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original...

PT-2026-33646

Name of the Vulnerable Software and Affected Versions Okta Identity Cloud affected versions not specified Description A critical authentication bypass exists in workforce and customer identity flows. This issue was actively exploited between April 18 and April 19, 2026. Recommendations Patch all...

PT-2026-37213

Name of the Vulnerable Software and Affected Versions D-Link DI-8100 version 16.07.26A1 Description A buffer overflow can be triggered remotely in the HTTP Handler component. The issue exists within the sprintf function of the '/auto reboot.asp' endpoint, where manipulation of the enable/time...

CVE-2025-68001

creationtimestamp| type| source ---|---|--- 2026-04-18 23:00:13+00:00| published-proof-of-concept| Telegram/J1TSaArQ0ScFY239N-pEajUhnEKmxSQcewj6uEimw6KDWT0 2026-04-19 03:00:05+00:00| published-proof-of-concept| Telegram/fUN7x3zhWJI41Y9qvAix9-DSuCPZFxW-u6Jn34L6Wbqg7U...

sqli-research

🔬 sqli-research Time-Based Blind SQL Injection — Riset, Po...

CVE-2026-33084

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the...