PT-2026-30007

Impact When an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter ...

PT-2026-30226

Name of the Vulnerable Software and Affected Versions prompts.chat versions prior to commit 1464475 Description Authenticated users can exploit a blind server-side request forgery SSRF in the Wiro media generator. This occurs when the application performs server-side fetches of the user-controlle...

AlmaLinux 9 : grafana (ALSA-2026:6382)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:6382 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the AlmaLinux securi...

PT-2026-30014

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.8 Description Ech0, a self-hosted publishing platform, has an unsafe link preview feature. The GET /api/website/title endpoint is unauthenticated and accepts attacker-controlled URLs. It performs a server-side GET...

PT-2026-30015

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.8 Description The GET /api/website/title endpoint is susceptible to Server-Side Request Forgery SSRF. The endpoint accepts an arbitrary URL via the website url query parameter and makes a server-side HTTP request to ...

SUSE CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

CVE-2026-35464

creationtimestamp| type| source ---|---|--- 2026-04-02 21:50:29+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j 2026-04-07 15:27:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3q27o3k2h 2026-04-07...

EUVD-2026-18550

Multiple reflected cross-site scripting XSS vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codiceazienda and redurl parameters...

CVE-2024-14034

creationtimestamp| type| source ---|---|--- 2026-04-02 21:30:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik5ocm6yt2i...

CVE-2026-34735

creationtimestamp| type| source ---|---|--- 2026-04-02 21:12:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik4nv6ywt2q 2026-04-02 22:22:27+00:00| published-proof-of-concept| Telegram/LEqzgESE2wGHUVmUGbeDXDuSp8F8SqNkH2O3nuA9SKVO2A...

CVE-2026-34834

creationtimestamp| type| source ---|---|--- 2026-04-02 21:03:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik45nplvv2s 2026-04-02 22:23:12+00:00| published-proof-of-concept| Telegram/qg3HF91OLRRzWQbI7Pfv-fl8vLkHd7iL-mBbLD40slyOww...

GHSA-7GGG-PVRF-458V OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

CVE-2024-44250

creationtimestamp| type| source ---|---|--- 2026-04-02 20:47:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik3baewxf2i 2026-04-03 19:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mimhy2eask27...

GHSA-6QXF-7JX6-86FH

creationtimestamp| type| source ---|---|--- 2026-04-02 20:13:40+00:00| seen| https://bsky.app/profile/timb.me.uk/post/3mijzewh7atc2...

CVE-2026-35405

creationtimestamp| type| source ---|---|--- 2026-04-02 19:44:52+00:00| published-proof-of-concept| https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 2026-04-02 19:44:52+00:00| published-proof-of-concept|...

CVE-2026-5360

creationtimestamp| type| source ---|---|--- 2026-04-02 18:55:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijuyuvacp2d...

Incorrect Behavior Order: Validate Before Canonicalize

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

CVE-2026-34524

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read...

CVE-2026-5349

creationtimestamp| type| source ---|---|--- 2026-04-02 17:38:06+00:00| published-proof-of-concept| Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwamg57gds1UAnW3xco8kE 2026-04-02 17:38:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijqpw5x4f2j 2026-04-03 07:00:46+00:00| seen|...