PT-2026-30014

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.8 Description Ech0, a self-hosted publishing platform, has an unsafe link preview feature. The GET /api/website/title endpoint is unauthenticated and accepts attacker-controlled URLs. It performs a server-side GET...

SUSE CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

CVE-2026-35464

creationtimestamp| type| source ---|---|--- 2026-04-02 21:50:29+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j 2026-04-07 15:27:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3q27o3k2h 2026-04-07...

EUVD-2026-18550

Multiple reflected cross-site scripting XSS vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codiceazienda and redurl parameters...

CVE-2024-14034

creationtimestamp| type| source ---|---|--- 2026-04-02 21:30:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik5ocm6yt2i...

CVE-2026-34735

creationtimestamp| type| source ---|---|--- 2026-04-02 21:12:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik4nv6ywt2q 2026-04-02 22:22:27+00:00| published-proof-of-concept| Telegram/LEqzgESE2wGHUVmUGbeDXDuSp8F8SqNkH2O3nuA9SKVO2A...

CVE-2026-34834

creationtimestamp| type| source ---|---|--- 2026-04-02 21:03:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik45nplvv2s 2026-04-02 22:23:12+00:00| published-proof-of-concept| Telegram/qg3HF91OLRRzWQbI7Pfv-fl8vLkHd7iL-mBbLD40slyOww...

GHSA-7GGG-PVRF-458V OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

CVE-2024-44250

creationtimestamp| type| source ---|---|--- 2026-04-02 20:47:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik3baewxf2i 2026-04-03 19:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mimhy2eask27...

GHSA-6QXF-7JX6-86FH

creationtimestamp| type| source ---|---|--- 2026-04-02 20:13:40+00:00| seen| https://bsky.app/profile/timb.me.uk/post/3mijzewh7atc2...

CVE-2026-35405

creationtimestamp| type| source ---|---|--- 2026-04-02 19:44:52+00:00| published-proof-of-concept| https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 2026-04-02 19:44:52+00:00| published-proof-of-concept|...

CVE-2026-5360

creationtimestamp| type| source ---|---|--- 2026-04-02 18:55:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijuyuvacp2d...

Incorrect Behavior Order: Validate Before Canonicalize

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

CVE-2026-34524

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read...

CVE-2026-5349

creationtimestamp| type| source ---|---|--- 2026-04-02 17:38:06+00:00| published-proof-of-concept| Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwamg57gds1UAnW3xco8kE 2026-04-02 17:38:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijqpw5x4f2j 2026-04-03 07:00:46+00:00| seen|...

CVE-2026-34598

Summary: CVE-2026-34598 affects YesWiki (PHP) prior to version 4.6.0, which contains a stored and blind XSS vulnerability in the form title field. An unauthenticated attacker can inject JavaScript via a saved form title, causing the payload to execute in any user’s browser when the affected page ...

CVE-2026-5350

creationtimestamp| type| source ---|---|--- 2026-04-02 17:33:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijqgxo7wm2i 2026-04-02 17:38:06+00:00| published-proof-of-concept| Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwamg57gds1UAnW3xco8kE 2026-04-03 07:00:53+00:00| seen|...

CVE-2026-34590

Postiz (AI social media scheduling tool) contains a vulnerability in the POST /webhooks/ endpoint prior to v2.21.4, where WebhooksDto validates the url with only @IsUrl() (format check) and lacks @IsSafeWebhookUrl, allowing blind SSRF because the orchestrator fetches the stored webhook URL withou...

EUVD-2026-18452

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl format check, missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The updat...