CVE-2026-41471

creationtimestamp| type| source ---|---|--- 2026-05-04 18:24:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2c6cl7wd2e 2026-05-04 18:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2dzsfn3q2t 2026-05-17 11:10:09+00:00| seen|...

CVE-2026-42087

creationtimestamp| type| source ---|---|--- 2026-05-04 18:23:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2c63yso62r 2026-05-04 18:28:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2cgemy2x2v 2026-05-08 23:07:07+00:00| seen|...

CVE-2026-42088

creationtimestamp| type| source ---|---|--- 2026-05-04 18:19:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2bwjcjwo2n 2026-05-04 18:37:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2cwddwoq2v 2026-09-12 10:00:17+00:00| seen|...

CVE-2026-42140

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery SSRF. The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does...

UBUNTU-CVE-2026-42052

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...

CVE-2026-26332

creationtimestamp| type| source ---|---|--- 2026-05-04 18:10:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2bgr7zhc2w 2026-05-04 18:11:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2bhswa6s2e 2026-05-25 09:07:07+00:00| seen|...

CVE-2026-42138

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...

Arbitrary Code Injection

Overview org.apache.atlas:atlas-repository is an Apache Atlas Repository Module Affected versions of this package are vulnerable to Arbitrary Code Injection in the DSL search endpoint. An attacker can execute arbitrary code by placing malicious Gremlin traversal logic within grammar-allowed...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

CVE-2026-33006

creationtimestamp| type| source ---|---|--- 2026-05-04 17:18:53+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/116517446102524326 2026-05-04 17:53:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2airgugo2h 2026-05-04 21:11:15+00:00| seen|...

CVE-2026-42052 beets is Vulnerable to XSS

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...

CVE-2026-24118 VM2 Sandbox Breakout Through __lookupGetter__

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0...

CVE-2026-44339

creationtimestamp| type| source ---|---|--- 2026-05-04 16:26:57+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gmjg-hv98-qggq 2026-05-08 17:07:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mle7rnihnv2h 2026-05-08...

EUVD-2026-27023

D-Link DIR-605L Hardware Revision B2 End-of-Life, EOL contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn76dlwbrdir605L" read from /etc/alphaconfig/imagesign. The custom telnetd binary...

CVE-2026-29169

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than...

CVE-2026-34059

creationtimestamp| type| source ---|---|--- 2026-05-04 14:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkzwbqp6w52h 2026-05-04 15:31:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzyjg7ozk2z 2026-05-04 17:46:26+00:00| seen|...

CVE-2026-23918

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue...

CVE-2025-70067

Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy without runtime length validation...

CVE-2026-7482

creationtimestamp| type| source ---|---|--- 2026-05-04 14:15:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzuc7suqr2k 2026-05-04 14:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkzwkpa3ak2k 2026-05-04 21:09:36+00:00| seen|...

CVE-2026-6266 Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...