ALSA-2026:6949 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more...

CVE-2026-28390

creationtimestamp| type| source ---|---|--- 2026-04-07 23:31:27+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o 2026-04-08 12:10:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23 2026-04-09 00:01:15+00:00| seen|...

CVE-2026-34582

creationtimestamp| type| source ---|---|--- 2026-04-07 23:21:25+00:00| seen| Telegram/ob3ye0FCdfhceb6CimILWC3jRIWmZERTbGMc-OQRsW6HR0 2026-04-08 01:26:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mix56pyoi52o...

GHSA-CC2Q-QC34-JPRG

creationtimestamp| type| source ---|---|--- 2026-04-07 23:21:06+00:00| seen| Telegram/WwaVaWmCpWfeYuJ8P8IqcUlHCUAeEgjmrCmKGvAa3A2q2J0 2026-04-09 09:13:05+00:00| seen| https://bsky.app/profile/magnusmanske.wikis.world.ap.brid.gy/post/3mj2hq7bnc7z2 2026-04-09 11:07:13+00:00| seen|...

CVE-2026-34078

creationtimestamp| type| source ---|---|--- 2026-04-07 23:21:06+00:00| seen| Telegram/WwaVaWmCpWfeYuJ8P8IqcUlHCUAeEgjmrCmKGvAa3A2q2J0 2026-04-08 01:36:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mix5qmzuux2i 2026-04-09 11:47:32+00:00| seen|...

CVE-2026-35475

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $GET with no URL validation or whitelist check, then used verbatim in a header"Location: ..." call. This vulnerability is fixed in 3.6.9...

CVE-2026-39322

creationtimestamp| type| source ---|---|--- 2026-04-07 21:22:14+00:00| seen| Telegram/jEWDvJlPAzzCg6Ap5VgqQ5eCzhkM-91ZtlQ3ivnX7ilAAw 2026-04-07 22:45:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwu6qleo22t...

CVE-2026-39347

creationtimestamp| type| source ---|---|--- 2026-04-07 21:12:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwoy7caxq2g...

CVE-2026-39345

creationtimestamp| type| source ---|---|--- 2026-04-07 20:49:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwnou7t2k22...

CVE-2026-39355

creationtimestamp| type| source ---|---|--- 2026-04-07 20:39:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwn6mn47z25 2026-04-07 21:22:07+00:00| seen| Telegram/G7jwG369FM-EA8JMh95pmFocIEiy10HcnXiWAHgS3Vj404 2026-04-08 07:04:11+00:00| seen|...

CVE-2026-39401 Privilege Escalation via update_event Job Output in Cronicle

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privile...

Emissary has Stored XSS via Navigation Template Link Injection

Summary Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting XSS against other...

CVE-2026-39370

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then...

CVE-2026-39368

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

CVE-2026-27787

creationtimestamp| type| source ---|---|--- 2026-04-07 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN33581068/ 2026-04-08 07:51:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixspefv4u2i...

CVE-2026-24913

creationtimestamp| type| source ---|---|--- 2026-04-07 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN33581068/ 2026-04-08 06:19:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixnln6bez2h 2026-04-08 07:15:31+00:00| seen|...

CVE-2026-39341

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:49+00:00| seen| Telegram/KxTaYuDzH0Z1i49WRh0FHus2MwhOECzgEb0vJJCyVaWiEf0 2026-04-07 19:36:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwjnkiisb22 2026-04-08 07:21:32+00:00| seen|...

CVE-2026-39340

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:49+00:00| seen| Telegram/KxTaYuDzH0Z1i49WRh0FHus2MwhOECzgEb0vJJCyVaWiEf0 2026-04-07 20:06:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwlckqos32s 2026-04-08 07:04:18+00:00| seen|...

CVE-2026-39338

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:49+00:00| seen| Telegram/KxTaYuDzH0Z1i49WRh0FHus2MwhOECzgEb0vJJCyVaWiEf0 2026-04-07 19:56:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwkqntz4a2j...

CVE-2026-39343

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:49+00:00| seen| Telegram/KxTaYuDzH0Z1i49WRh0FHus2MwhOECzgEb0vJJCyVaWiEf0 2026-04-13 00:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjdl3qnmlq22...