WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Niv Kochan in WordPress Plugin Amelia versions = 2.2...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in once-1.1.2.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in once-1.1.2.tgz Vulnerability Details CVEID:CVE-2026-3449 DESCRIPTION: Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. T...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issue: Update to Firefox Extended Support Release 140.10.0 ESR bsc1262230, MFSA 2026-32: CVE-2026-6746: Use-after-free in the DOM: Core & HTML component. CVE-2026-6747: Use-after-free in the WebRTC component. CVE-2026-6748: Uninitialized memory i...

CVE-2026-41873

creationtimestamp| type| source ---|---|--- 2026-04-28 17:09:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl3a4a57i2q 2026-04-28 17:18:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkl3ppnk6p2b 2026-05-26 15:13:18+00:00| seen|...

CLSA-2026-1777395480 nodejs: Fix of 3 CVEs

CVE-2022-25883: fix ReDoS in bundled npm semver new Range and parseComparator caused by unbounded whitespace expansion in version ranges - CVE-2026-21710: fix HTTP prototype pollution in http.get/request via headersDistinct option by using null-prototype objects for header storage -...

CVE-2026-7288

creationtimestamp| type| source ---|---|--- 2026-04-28 16:47:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkzyjfb672r 2026-04-28 16:56:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl2irbp352e 2026-05-28 10:07:15+00:00| seen|...

CVE-2026-7321

creationtimestamp| type| source ---|---|--- 2026-04-28 16:42:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkzpt3i4w2n 2026-04-28 17:04:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl2x5rxwl2r 2026-04-29 05:55:52+00:00| seen|...

CVE-2026-42167

creationtimestamp| type| source ---|---|--- 2026-04-28 15:00:17+00:00| seen| Telegram/H01iEvXyQvFt3BKrUWEkrM93zs5xMaOZIzFsw2eb4Vo29b0 2026-04-28 21:00:04+00:00| published-proof-of-concept| Telegram/eS6PVxYAnM0JrA3WVLfUd-acXUZbhqPWuOh5cENwecmTOw 2026-04-29 00:02:19+00:00| seen|...

VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi

Threat hunters are warning that the cybercriminal operation known as VECT 2.0 acts more like a wiper than a ransomware due to a critical flaw in its encryption implementation across Windows, Linux, and ESXi variants that renders recovery impossible even for the threat actors. The fact that VECT's...

USN-8136-2 dovecot regression

USN-8136-1 fixed vulnerabilities in Dovecot. The update caused a regression on Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An...

CVE-2026-7243

creationtimestamp| type| source ---|---|--- 2026-04-28 12:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116482338362194303 2026-04-28 12:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkklmuu4fh26...

CVE-2026-7244

creationtimestamp| type| source ---|---|--- 2026-04-28 11:00:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/116481984920066984 2026-04-28 11:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkkgm5kchn2j...

RHSA-2026:11325 Red Hat Security Advisory: gdk-pixbuf2 security update

Bulletin has no description...

CVE-2026-41604

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue...

Integer Overflow or Wraparound

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the TFramedTransport function on 32-bit architectures. An attacker...

CVE-2026-4805 Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block

The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated...

kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

A flaw was found in the Linux kernel's NFSv4.0 server nfsd. A remote, unauthenticated attacker can exploit this heap overflow vulnerability in the NFSv4.0 LOCK replay cache. By using two cooperating NFSv4.0 clients, where one sets a lock with a large owner string and another requests a conflictin...

GHSA-3CH2-JXXC-V4XF

creationtimestamp| type| source ---|---|--- 2026-04-28 04:41:41+00:00| seen| https://gist.github.com/beejak/c190bcb8f8b76e8b2200faef11e807d6 2026-04-28 05:20:25+00:00| seen| https://gist.github.com/beejak/235d9793985eef4870d4d4fe221cc6fe...

CVE-2026-6809 Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated...

avahi: Avahi: Denial of Service via unsolicited CNAME announcements

A flaw was found in Avahi, a system that enables devices to discover services on a local network using the mDNS/DNS-SD Multicast Domain Name System/DNS-based Service Discovery protocols. A remote attacker can exploit this by sending two specific network messages, known as unsolicited announcement...