sidekiq-cron 安全漏洞

sidekiq-cron is an open-source scheduling plugin for tasks based on Cron expressions. Versions of sidekiq-cron 2.3.1 and earlier contain security vulnerabilities; these vulnerabilities stem from the possibility of cross-site scripting attacks caused by rendering malicious URLs through the cron.er...

CVE-2026-41672

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or...

Fedora 43 : nano (2026-d0a0f1c3d2)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d0a0f1c3d2 advisory. fix CVE-2026-6842 and CVE-29026-6843 Resolves: CVE-2026-6842 Resolves: CVE-2026-6843 Resolves: rhbz2455127 Resolves: rhbz2455314 Tenable has extract...

The vulnerabilities of the functions dissect_smb2_notify_data_out() and dissect_smb2_file_full_ea_info() in the SMB2 protocol analyzer tool Wireshark allow a hacker to cause service failures.

The vulnerabilities of the functions dissectsmb2notifydataout and dissectsmb2filefulleainfo in the SMB2 protocol analyzer tool Wireshark involve executing a loop with an unreachable exit condition. Exploiting these vulnerabilities can allow attackers to cause service failures...

TencentOS Server 2: squid (TSSA-2025:1012)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1012 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

GHSA-9VQF-7F2P-GF9V Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

Summary bodyLimit does not reliably enforce maxSize for requests without a usable Content-Length e.g. Transfer-Encoding: chunked. Oversized requests can reach handlers and return 200 instead of 413. Details For chunked / unknown-length requests, bodyLimit wraps the body in a stream that counts...

Kanidm has non-constant-time comparison of OAuth2 client_secret

Summary The kanidmd OAuth2 token-exchange /oauth2/token and token-introspection /oauth2/token/introspect endpoints compare the supplied clientsecret against the stored secret using Rust's PartialEq on String, which short-circuits on the first mismatching byte. This produces an observable timing...

CLSA-2026-1778107793 qt5-qtbase: Fix of 3 CVEs

CVE-2025-5455: fix qDecodeDataUrl crash on malformed data URL with charset - CVE-2024-25580: fix KTX file reading buffer overflow - CVE-2024-39936: delay HTTP/2 communication until encrypted can be responded to includes prerequisite to emit encrypted on H2 path...

NPM: fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

NPM: fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.3...

CVE-2026-43217

A flaw was found in the Linux kernel's media: iris: gen2 component. When a session is stopped, a memory deallocation occurs. If a subsequent streaming stop operation is initiated without proper validation, it attempts to access already freed memory. This can be triggered by a local attacker or a...

CVE-2026-43581

creationtimestamp| type| source ---|---|--- 2026-05-06 20:45:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kzncyfq2z 2026-05-06 21:34:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7nqjn5bp2t 2026-05-07 16:07:09+00:00| seen|...

CVE-2026-43580

creationtimestamp| type| source ---|---|--- 2026-05-06 20:45:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kz6t5qe2n 2026-05-06 21:38:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7nx6b5ai2n...

CVE-2026-43578

creationtimestamp| type| source ---|---|--- 2026-05-06 20:45:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kywdjit2r 2026-05-06 21:32:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7nnj45ja2e 2026-05-24 19:37:06+00:00| seen|...

Brute Force

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the check process. An attacker can gain unauthorized administrative access by submitting arbitrary user-id and token values to the...

phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

Summary The /admin/check endpoint in AuthenticationController implements SkipsAuthenticationCheck, making it reachable without any prior authentication. An anonymous attacker Bob can POST arbitrary user-id and token values to brute-force any user's 6-digit TOTP code. No rate limiting exists. The...

CVE-2026-43585

creationtimestamp| type| source ---|---|--- 2026-05-06 20:39:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kpcppcg2c 2026-05-06 21:40:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7o2ruudh2o 2026-05-07 02:00:04+00:00| seen|...

CVE-2026-44115

creationtimestamp| type| source ---|---|--- 2026-05-06 20:36:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kisf6b72q 2026-05-06 20:36:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kju767w2c 2026-05-06 21:49:50+00:00| seen|...

CVE-2026-44114

creationtimestamp| type| source ---|---|--- 2026-05-06 20:36:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kikwji62c 2026-05-06 20:36:11+00:00| seen| https://bsky.app/profile/potato.software/post/3ml7kimjqq52w 2026-05-06 20:36:45+00:00| seen|...

CVE-2026-40326

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in csettings.cfc does not properly validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious webpage or link that, when visited by a logged-in...

USN-8239-1 apache2 vulnerabilities

Bartlomiej Dmitruk and Stanislaw Strzalkowski discovered that Apache HTTP Server incorrectly handled certain memory operations when using the HTTP/2 protocol. A remote attacker could use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitra...