CVE-2026-3877

The CVE-2026-3877 issue affects the VertiGIS FM dashboard search. It is a reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality that can be triggered when an authenticated user visits a crafted URL, leading to arbitrary JavaScript execution in the user’s browser...

CVE-2026-23407

creationtimestamp| type| source ---|---|--- 2026-04-01 11:30:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migloiiih42s 2026-04-02 17:36:56+00:00| seen| Telegram/Mrl-2X1DMgxtaU5XSUN4IbsWrdS8894u2WS0LqzSL2HMbhg 2026-04-07 18:00:00+00:00| seen|...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2025-41356

Reflected Cross-Site Scripting XSS vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or ...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by credential disclosure due to Python Requests library

Summary The Python Requests library is used by IBM Cloud Pak for Data System 1.0 to handle HTTP communications. CVE-2024-47081 affects Requests due to a URL parsing issue that may leak .netrc credentials to third parties when processing maliciously-crafted URLs. This vulnerability could result in...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2024-37408

creationtimestamp| type| source ---|---|--- 2026-04-01 09:06:50+00:00| seen| https://bsky.app/profile/0x4d6165.transfem.social.ap.brid.gy/post/3migdninlxo72...

CVE-2026-5258

creationtimestamp| type| source ---|---|--- 2026-04-01 08:45:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migci26j4r2s 2026-04-01 09:15:13+00:00| published-proof-of-concept| Telegram/Z8Avvvay3ok1mF87MeUHRJnFA0IUoCxf5B7S0L87cvtb7Og 2026-04-01 10:05:33+00:00| seen|...

CVE-2026-5249

creationtimestamp| type| source ---|---|--- 2026-04-01 05:11:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifwi2smm22i...

CVE-2026-32928

creationtimestamp| type| source ---|---|--- 2026-04-01 03:30:00+00:00| seen| https://jvn.jp/en/vu/JVNVU90448293/ 2026-04-02 00:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihyfw746325 2026-04-02 01:18:28+00:00| seen| Telegram/7rLczVeBBv6SSIB10Z8cqxb4bee2TcHdurxt5OLTZQuJPU...

CVE-2025-13855

creationtimestamp| type| source ---|---|--- 2026-04-01 03:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifp7aucs22m 2026-04-01 03:17:49+00:00| published-proof-of-concept| Telegram/rQGGJNosiE90GfC4CPODN8OMH2HUk0rxa4zVhsu5hB7e0 2026-04-03 14:40:10+00:00| seen|...

CVE-2026-5236

creationtimestamp| type| source ---|---|--- 2026-04-01 02:43:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifoayfszk2i...

CVE-2026-34553

creationtimestamp| type| source ---|---|--- 2026-04-01 02:16:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifmqhjem52d...

CVE-2026-34825

creationtimestamp| type| source ---|---|--- 2026-04-01 01:33:31+00:00| published-proof-of-concept| https://github.com/nocobase/nocobase/security/advisories/GHSA-vx58-fwwq-5g8j 2026-04-02 20:52:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik3ka64352d 2026-04-02 22:22:55+00:00|...

Payload 路径遍历漏洞

Payload is a headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Versions of Payload prior to 3.78.0 contained a path traversal vulnerability. This vulnerability stemmed from the client-side upload signature URL endpoint not properly cleaning file names,...

PT-2026-29518

A reflected cross-site scripting XSS vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered...

TencentOS Server 3: git-lfs (TSSA-2026:0203)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0203 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Amazon Linux 2023 : golist (ALAS2023-2026-1513)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1513 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

PT-2026-29830

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.95 Description PraisonAI's FileTools.download file function does not validate the url parameter before passing it to httpx.stream with follow redirects=True. This allows an attacker controlling the URL to access...

Medium: golist

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...