Amazon Linux 2 : xorg-x11-server, --advisory ALAS2-2026-3268 (ALAS-2026-3268)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3268 advisory. XKB Integer Underflow in XkbSetCompatMap CVE-2026-33999 XSYNC Use-after-free in miSyncTriggerFence CVE-2026-34001 XKB Out-of-bounds read in CheckModifierMap CVE-2026-34002 XKB Buffer overflow in...

Amazon Linux 2 : python-pip, --advisory ALAS2-2026-3256 (ALAS-2026-3256)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3256 advisory. When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation director...

Amazon Linux 2 : gstreamer-plugins-good, --advisory ALAS2-2026-3250 (ALAS-2026-3250)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3250 advisory. An out-of-bounds read in the WAV parser that can cause crashes for certain input files. CVE-2026-1940 Tenable has...

Amazon Linux 2 : libpng, --advisory ALAS2-2026-3266 (ALAS-2026-3266)

The version of libpng installed on the remote host is prior to 1.5.13-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3266 advisory. Use-after-free in pngsetPLTE, pngsettRNS and pngsethIST in libpng before 1.6.57. Passing a pointer returned by the corresponding...

PT-2026-36193

Name of the Vulnerable Software and Affected Versions IBM watsonx.data intelligence versions 5.2.0 through 5.2.1 IBM watsonx.data intelligence versions 5.3.0 through 5.3.1 Description User credentials are stored in plain text, allowing a local user to read them. Recommendations At the moment, the...

CVE-2026-36957

creationtimestamp| type| source ---|---|--- 2026-04-29 23:00:12+00:00| seen| Telegram/KspXoTAZwNnyoY0fEBjlny6gTq9EiPaKDTUOSCE94iY-U 2026-04-30 16:51:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkq35fnbit2e 2026-04-30 18:00:52+00:00| seen|...

CVE-2026-36958

creationtimestamp| type| source ---|---|--- 2026-04-29 23:00:12+00:00| seen| Telegram/KspXoTAZwNnyoY0fEBjlny6gTq9EiPaKDTUOSCE94iY-U 2026-04-30 17:01:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkq3pi2a7l2i 2026-04-30 18:01:00+00:00| seen|...

GHSA-C7XM-R6VJ-8VG6 Admidio Missing Minimum Administrator Check in Role Membership Removal

Summary Role::stopMembership does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other...

Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP

Summary A logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip th...

Incorrect Authorization

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Incorrect Authorization due to an inverted authorization check in the twofactorauthentication.php process. An attacker can remove...

GHSA-RH3W-4CCX-PRF9 Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP

Summary A logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip th...

GHSA-537J-GQPC-P7FQ n8n Vulnerable to XSS via MCP OAuth client

Impact An unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that access, a toast notification would render the injected script. Clicking the link would execute...

n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

Impact The dynamic-node-parameters endpoints did not verify whether the authenticated caller was authorized to use a supplied credential reference. An authenticated user with access to a shared workflow could supply a foreign credential ID in the request body, causing the backend to decrypt and u...

CVE-2026-32688

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plugcowboy allows unauthenticated remote denial of service via atom table exhaustion. Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.toatom/1 on the value returned by :cowboyreq.scheme/1. For HTTP/2...

CVE-2026-34965

creationtimestamp| type| source ---|---|--- 2026-04-29 20:45:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknxrf2bsf2v 2026-04-29 21:19:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknzoer7es2k 2026-04-29 23:01:55+00:00| seen|...

CVE-2018-25308

creationtimestamp| type| source ---|---|--- 2026-04-29 20:42:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknxlfyp472h 2026-04-29 20:53:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkny7sdob62p...

CVE-2018-25315

creationtimestamp| type| source ---|---|--- 2026-04-29 20:36:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknxb5lkax2p 2026-04-29 21:08:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknz2nt7n42i...

GHSA-MPFM-FPGX-647Q CKAN has no certificate validation on STMP connection

Impact Configured SMTP server may be spoofed with any certificate e.g. self-signed, leaving credentials and all emails sent open to MITM attacks. Patches The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5...

CVE-2018-25317

creationtimestamp| type| source ---|---|--- 2026-04-29 20:31:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknwyjsior2t 2026-04-29 21:03:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknyrpfdyv2n 2026-05-05 04:37:07+00:00| seen|...

CVE-2018-25316

creationtimestamp| type| source ---|---|--- 2026-04-29 20:27:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknwr3n25e2k 2026-04-29 20:58:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknyiqt73m2e 2026-05-04 20:07:07+00:00| seen|...