CVE-2026-4073

creationtimestamp| type| source ---|---|--- 2026-04-08 10:07:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy2c5dltc2g 2026-05-08 06:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mld4cwqyga2h...

EUVD-2026-20104

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the DSGVOGWPdownloadGoogleFonts function in all versions up to, and including, 1.1. The function is exposed via a wpajaxnopriv hook, requiring no authentication. It...

CVE-2026-4483

creationtimestamp| type| source ---|---|--- 2026-04-08 09:15:53+00:00| seen| Telegram/2us3LfI3-3LhgNH-mQsCI8ayQxKx-qgKTK1cQJ8QYqIxeY 2026-04-08 12:10:10+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb5zmpp72v...

CVE-2025-54602

creationtimestamp| type| source ---|---|--- 2026-04-08 08:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mixucqeml42f 2026-05-10 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities20260511...

CVE-2026-3535

creationtimestamp| type| source ---|---|--- 2026-04-08 07:21:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixqznlj4n27 2026-04-08 08:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116368148251522229 2026-04-08 08:30:30+00:00| seen|...

RLSA-2026:6949 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more...

CVE-2026-32288

creationtimestamp| type| source ---|---|--- 2026-04-08 05:03:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixjddeica22 2026-04-17 12:01:43+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mjouv3tjup2j 2026-05-06 14:30:23+00:00| seen|...

CVE-2026-5600

creationtimestamp| type| source ---|---|--- 2026-04-08 04:16:43+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5600 2026-04-08 15:12:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyldoqosd2g...

CVE-2026-24511

creationtimestamp| type| source ---|---|--- 2026-04-08 04:16:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-24511 2026-04-08 15:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miylmna5ef2i...

CVE-2026-32281

creationtimestamp| type| source ---|---|--- 2026-04-08 04:16:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixgpcc6rm2g 2026-04-13 21:22:02+00:00| seen| Telegram/LHQfgYAbtuG7CogYZyWoKm7-py5GuHojGsIqn2GfOFcZFnQ 2026-04-17 12:01:33+00:00| seen|...

CVE-2026-33810

creationtimestamp| type| source ---|---|--- 2026-04-08 04:08:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixgbdohyb2z 2026-04-13 21:22:20+00:00| seen| Telegram/xEAlzuvdoDbl3-4UvjRUOPM0QQ9w8kB8O-gQzs6j3EZAGw 2026-05-06 14:30:24+00:00| seen|...

CVE-2026-3499

creationtimestamp| type| source ---|---|--- 2026-04-08 03:17:02+00:00| seen| Telegram/OIususpWixIDiQQq7x0EEBhUibUD-5oYLPzoeXaqET3sKo 2026-04-08 04:24:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixh4hu6j22s 2026-04-21 06:44:07+00:00| seen|...

CVE-2026-39885

creationtimestamp| type| source ---|---|--- 2026-04-08 02:35:34+00:00| published-proof-of-concept| https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj 2026-04-08 02:35:34+00:00| published-proof-of-concept|...

CVE-2026-39411

creationtimestamp| type| source ---|---|--- 2026-04-08 02:20:20+00:00| published-proof-of-concept| https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97 2026-04-08 22:21:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizddehwyw2t...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-31920

creationtimestamp| type| source ---|---|--- 2026-04-08 00:30:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mix22atrfi2t 2026-05-01 03:01:53+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mkr5asb5fc2u...

Server-side Request Forgery (SSRF)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the downloadURL parameter processing in objects/aVideoEncoder.json.php. An attacker can access internal resources and exfiltrat...

EUVD-2026-19886

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration Incomplete fix for CVE-2026-27732...

EUVD-2026-19883

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs...

GHSA-F4F9-627C-JH33 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

Summary objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local...