CVE-2026-40077 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they kno...

CVE-2026-40069

creationtimestamp| type| source ---|---|--- 2026-04-09 19:23:14+00:00| seen| Telegram/Y2UpQC9zCL6PqNfAxsSoQJ7YUumR5oW0JI3RILB7SgtOVH4 2026-04-12 08:45:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjbxku5rs424...

GHSA-2679-6MX9-H9XC

creationtimestamp| type| source ---|---|--- 2026-04-09 19:23:14+00:00| seen| Telegram/Y2UpQC9zCL6PqNfAxsSoQJ7YUumR5oW0JI3RILB7SgtOVH4 2026-04-10 07:00:23+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mj4qrwhxfm2f 2026-04-13 02:18:17+00:00| seen|...

CVE-2026-35486

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access clo...

EUVD-2025-209392

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

CVE-2025-70797

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

CVE-2026-35204

creationtimestamp| type| source ---|---|--- 2026-04-09 17:56:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3ez4ayie2i 2026-07-13 22:00:07+00:00| seen| https://t.me/GithubRedTeam/92498 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92498 2026-07-15 00:00:32+00:00|...

CVE-2026-39853

creationtimestamp| type| source ---|---|--- 2026-04-09 17:23:27+00:00| seen| Telegram/UYy9QXiDWOzFY7CBVA8MS0Xr-No70LVttPhqPBLktKhMGyQ 2026-04-12 11:36:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjcb5bt4ru2w 2026-04-18 03:37:07+00:00| seen|...

CVE-2026-5959

creationtimestamp| type| source ---|---|--- 2026-04-09 17:19:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3cvp2pde2s...

CVE-2026-39974

n8n-MCP is a Model Context Protocol MCP server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTHTOKEN to cause the server to iss...

EUVD-2026-20978

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

CVE-2026-39974

CVE-2026-39974 affects the n8n-mcp component (Model Context Protocol server). In multi-tenant HTTP mode, an authenticated caller with a valid AUTH_TOKEN can trigger SSRF to arbitrary URLs supplied via per-request headers (instance-URL headers). The server reflects HTTP responses back through JSON...

CVE-2025-45806

creationtimestamp| type| source ---|---|--- 2026-04-09 16:12:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj375hm4tz25...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

UBUNTU-CVE-2026-4660

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2026-25446

creationtimestamp| type| source ---|---|--- 2026-04-09 13:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mj2w3wd4cb2o...

Go-getter may allow to arbitrary filesystem reads through git operations

Summary HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and...

CVE-2026-1403

creationtimestamp| type| source ---|---|--- 2026-04-09 12:45:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z 2026-04-09 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260410...

RLSA-2026:6344 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...