CVE-2026-3570

creationtimestamp| type| source ---|---|--- 2026-03-31 20:56:04+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mif2szu53t2h...

CVE-2026-34384 Admidio: Missing CSRF Protection on Registration Approval Actions

Admidio is an open-source user management solution. Prior to version 5.0.8, the createuser, assignmember, and assignuser action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the deleteuser mode in the same file which...

CVE-2025-38180

creationtimestamp| type| source ---|---|--- 2026-03-31 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260401 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0396/ 2026-04-03 13:40:17+00:00| seen|...

CVE-2026-34504

creationtimestamp| type| source ---|---|--- 2026-03-31 19:20:10+00:00| seen| Telegram/kcbrs7WWw-nIPeTyrZTDg68aatJd3a7QKUME-vVoB020PA 2026-03-31 19:20:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mievhsgcv722 2026-04-01 06:26:34+00:00| seen|...

EUVD-2026-17532

A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched...

CVE-2026-5087

creationtimestamp| type| source ---|---|--- 2026-03-31 17:51:54+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mieqjpuhg62p 2026-04-03 21:17:42+00:00| published-proof-of-concept| Telegram/qTocgF1bA6EikMAxrpKqC2AQPtdVVaE6KTy64KQmK5LJ1E...

CVE-2026-32113 Discourse: Open redirect via `sso_destination_url` cookie in `enter`

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the ssodestinationurl cookie and redirects to it with allowotherhost: true...

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...

CVE-2026-34728

creationtimestamp| type| source ---|---|--- 2026-03-31 17:23:35+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x 2026-04-02 16:51:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijo3vyh242t 2026-04-02 17:37:38+00:00|...

CVE-2026-34360

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname,...

CVE-2026-26060

creationtimestamp| type| source ---|---|--- 2026-03-31 17:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mienop6vtc27 2026-03-31 17:24:25+00:00| published-proof-of-concept| Telegram/WxHgPFElWYDoFBGl3K0BVKfspuGbiR8geCdPJnxqtoWdxxM...

CVE-2026-5274

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/ 2026-04-01 15:25:32+00:00| seen| Telegram/4zYpYE5e92FkC7Z53Af8gCedtL6FpkxFD5yjbQn9BVECOM 2026-04-01 17:01:18+00:00| seen|...

CVE-2026-5291

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/ 2026-04-01 08:04:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miga5twbwl25 2026-04-01 18:00:00+00:00| seen|...

CVE-2026-5292

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/ 2026-04-01 08:35:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migbw5btls23 2026-04-01 15:23:03+00:00| seen|...

CVE-2026-3470

creationtimestamp| type| source ---|---|--- 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0383/ 2026-03-31 22:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifbiabm572n 2026-04-01 12:20:24+00:00| seen|...

CVE-2026-34361

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith...

CVE-2026-34361 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith...

CVE-2026-34359 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer uses String.startsWith to match request URLs against configured server URLs for authentication credential dispatch. Because configured...

CVE-2026-34359

Summary: CVE-2026-34359 affects HAPI FHIR Core prior to 6.9.4, where ManagedWebAccessUtils.getServer() used String.startsWith() to map request URLs to configured servers. This enables credential leakage via HTTP redirects to attacker-controlled domains that prefix-match configured URLs (e.g., htt...

CVE-2026-34359 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer uses String.startsWith to match request URLs against configured server URLs for authentication credential dispatch. Because configured...