CVE-2026-34621

Overview

Adobe
Acrobat Reader

11 Apr 2026

Published

12 Apr 2026

Updated

CVSS v3.1

HIGH (8.6)

EPSS

0.04%

MITRE

KEV

Description

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Statistics

12 Posts
1 Interaction

Last activity: Last hour

Bluesky

mrbyte @mrbyte.bsky.social

Adobe: Rilevato sfruttamento in rete della CVE-2026-34621 #infosec www.acn.gov.it/portale/w/ad...

0
1
0
8h ago

r/blueteamsec bot @r-blueteamsec.bsky.social

Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution. Adobe is aware of CVE-2026-34621 being exploited in the wild.

0
0
0
23h ago

Undercode Testing @undercode.bsky.social

Adobe Acrobat Zero-Day Under Attack: CVE-2026-34621 Prototype Pollution Leads to RCE – Patch Now! + Video Introduction: A prototype pollution vulnerability in Adobe Acrobat and Reader (CVE-2026-34621, CVSS 9.6) is being actively exploited in the wild, allowing attackers to execute arbitrary code…

0
0
1
17h ago

Philippe Vynckier @pvynckier.bsky.social

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 thehackernews.com/2026/04/adob...

0
0
2
16h ago

Techpresso @techpresso.bsky.social

The flaw, tracked as CVE-2026-34621, carries a CVSS severity score of 9.6 and affects both Windows and Mac users, with Adobe urging updates within 72 hours. Source: SecurityWeek

0
0
0
13h ago

nilab (in Bluesky) @nilab.bsky.social

怖い((((;ﾟДﾟ))) 最近はPDFは他のアプリで表示することが多いから影響あるのかどうか。「アドビ（Adobe）は、WindowsおよびmacOSの両プラットフォームでAdobe AcrobatおよびReaderを使用しているユーザーに影響を与える深刻な脆弱性「CVE-2026-34621」が、すでに攻撃者に悪用されていることを正式に認めた（APSB26-43）」 72時間以内の更新を推奨──「PDFを開くだけで乗っ取られる」アドビリーダーのゼロデイ攻撃が進行（Forbes JAPAN） - Yahoo!ニュース news.yahoo.co.jp/articles/6b7...

0
0
0
11h ago

Undercode Testing @undercode.bsky.social

Zero-Day Alert: CVE-2026-34621 Adobe Acrobat Reader Exploit – Patch NOW or Get Hacked! + Video Introduction: Adobe recently patched CVE-2026-34621, a zero-day vulnerability in Acrobat Reader that has been actively exploited in the wild for at least four months. This flaw allows attackers to…

0
0
0
10h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Adobe releases emergency patch for critical zero-day CVE-2026-34621 in Acrobat and Reader, exploited since Nov. Allows arbitrary code execution via prototype attribute manipulation on Windows and macOS. #AdobePatch #ZeroDay #USA

0
0
0
6h ago

セキュリティ対策Lab @securitylab-jp.bsky.social

【要警戒】 Adobe、Acrobat／Readerのゼロデイ脆弱性(CVE-2026-34621)を緊急修正 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews

0
0
0
Last hour

CVE-2026-39987

Overview

marimo-team
marimo

09 Apr 2026

Published

09 Apr 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

2.70%

MITRE

KEV

Description

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

Statistics

4 Posts
2 Interactions

Last activity: 2 hours ago

Fediverse

Rishi @rxerium

🚨 Pre-Auth RCE vuln tagged as CVE-2026-39987 (CVSS 9.3) seeing active exploitation in the wild as reported by Vulncheck and Bleeping Computer.

Passively scan infrastructure to find potentially vulnerable instances:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-39987.yaml

An unauthenticated attacker can obtain a full interactive root shell on the server via a single WebSocket connection. No user interaction or authentication token is required, even when authentication is enabled on the marimo instance
https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc

0
0
0
5h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

A critical RCE vulnerability (CVE-2026-39987) in Marimo’s /terminal/ws endpoint allowed unauthenticated shell access. Exploitation began 10 hours after disclosure, with 125 IPs scanning within 12 hours. #Marimo #RemoteCodeExecution #Python

0
2
0
4h ago

Philippe Vynckier @pvynckier.bsky.social

Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure thehackernews.com/2026/04/mari...

0
0
0
16h ago

キタきつね @kitafox.bsky.social

CVE-2026-39987：Marimo RCEが公開後数時間で悪用される CVE-2026-39987: Marimo RCE exploited in hours after disclosure #SecurityAffairs (Apr 11) securityaffairs.com/190623/hacki...

0
0
0
2h ago

CVE-2026-34197

Overview

Apache Software Foundation
Apache ActiveMQ Broker
org.apache.activemq:activemq-broker

07 Apr 2026

Published

08 Apr 2026

Updated

CVSS

Pending

EPSS

5.60%

MITRE

KEV

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Statistics

2 Posts

Last activity: 5 hours ago

Bluesky

Philippe Vynckier @pvynckier.bsky.social

Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) - Help Net Security www.helpnetsecurity.com/2026/04/09/a...

0
0
0
16h ago

今日視界 @g0rosato.bsky.social

與Claude共度的 10 分鐘：CVE-2026-34197 的遠程代碼執行

0
0
0
5h ago

CVE-2026-5281

Overview

Google
Chrome

01 Apr 2026

Published

02 Apr 2026

Updated

CVSS

Pending

EPSS

3.28%

MITRE

KEV

Description

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Statistics

1 Post
4 Interactions

Last activity: 13 hours ago

Fediverse

N_{Dario Fadda} @nuke

Google Patches Actively Exploited Chrome Zero-Day CVE-2026-5281 — Update Now
#CyberSecurity
https://securebulletin.com/google-patches-actively-exploited-chrome-zero-day-cve-2026-5281-update-now/

4
0
0
13h ago

CVE-2026-40175

Overview

axios
axios

10 Apr 2026

Published

10 Apr 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

0.24%

MITRE

KEV

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0.

Statistics

1 Post
1 Interaction

Last activity: 15 hours ago

Bluesky

azu @azu.bsky.social

これがCVSS 10になってしまうのか。EPSSだとだいぶ低くそう "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain · CVE-2026-40175 · GitHub Advisory Database" https://github.com/advisories/GHSA-fvcv-3m26-pcqx

0
1
0
15h ago

CVE-2026-6112

Overview

Totolink
A7100RU

12 Apr 2026

Published

12 Apr 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.89%

MITRE

KEV

Description

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument maxRtrAdvInterval causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Statistics

1 Post

Last activity: 12 hours ago

Fediverse

OffSequence @offseq

🚨 CVE-2026-6112 (CRITICAL, CVSS 9.3): Totolink A7100RU (fw 7.4cu.2313_b20191024) is vulnerable to unauthenticated OS command injection via /cgi-bin/cstecgi.cgi. No patch yet — restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-6112-os-command-injection-in-totolink-a71-83c5f182 #OffSeq #Vuln #Infosec #CVE20266112

0
0
0
12h ago

CVE-2026-6106

Overview

1Panel-dev
MaxKB

11 Apr 2026

Published

11 Apr 2026

Updated

CVSS v4.0

MEDIUM (5.1)

EPSS

0.03%

MITRE

KEV

Description

A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/static_headers_middleware.py of the component Public Chat Interface. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 2.8.0 is able to resolve this issue. The patch is identified as 026a2d623e2aa5efa67c4834651e79d5d7cab1da. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Statistics

1 Post

Last activity: 21 hours ago

Fediverse

OffSequence @offseq

🔎 CVE-2026-6106: 1Panel-dev MaxKB v2.2.0/2.2.1 impacted by MEDIUM XSS via Public Chat Interface (Name arg). Patch to v2.8.0 to mitigate. No in-the-wild exploits yet. Full details: https://radar.offseq.com/threat/cve-2026-6106-cross-site-scripting-in-1panel-dev-m-cd592a06 #OffSeq #XSS #Vuln

0
0
0
21h ago

CVE-2019-1367

Overview

Microsoft
Internet Explorer 9

23 Sep 2019

Published

21 Oct 2025

Updated

CVSS

Pending

EPSS

89.25%

MITRE

KEV

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.

Statistics

1 Post

Last activity: 12 hours ago

Fediverse

Anthony Powell @ajguides

Microsoft Update causing Print Spooler Problems - CVE-2019-1367 | https://techygeekshome.info/cve-2019-1367/?fsp_sid=27678 | #Guide #Microsoft #News #security #Updates #Windows
https://techygeekshome.info/cve-2019-1367/?fsp_sid=27678

0
0
0
12h ago

CVE-2026-6113

Overview

Totolink
A7100RU

12 Apr 2026

Published

12 Apr 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.89%

MITRE

KEV

Description

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTtyServiceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument ttyEnable leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Statistics

1 Post

Last activity: 14 hours ago

Fediverse

OffSequence @offseq

Totolink A7100RU (7.4cu.2313_b20191024) hit by CRITICAL OS command injection (CVE-2026-6113) — remote, unauthenticated attackers could execute commands. No patch yet; restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-6113-os-command-injection-in-totolink-a71-16ad03cb #OffSeq #Vulnerability #RouterSecurity

0
0
0
14h ago

CVE-2026-5217

Overview

optimole
Optimole – Optimize Images in Real Time

11 Apr 2026

Published

11 Apr 2026

Updated

CVSS v3.1

HIGH (7.2)

EPSS

0.08%

MITRE

KEV

Description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the user-supplied 's' parameter (srcset descriptor) in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint. The endpoint validates requests using an HMAC signature and timestamp, but these values are exposed directly in the frontend HTML making them accessible to any visitor. The plugin uses sanitize_text_field() on the descriptor value of rest.php, which strips HTML tags but does not escape double quotes. The poisoned descriptor is then stored via transients (backed by the WordPress options table) and later retrieved and injected verbatim into the srcset attribute of tag_replacer.php without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.

Statistics

1 Post

Last activity: 23 hours ago

Fediverse

OffSequence @offseq

🚨 HIGH risk: Optimole WordPress plugin (≤4.2.2) vulnerable to unauthenticated stored XSS via /wp-json/optimole/v1/optimizations. HMAC bypassed. Disable plugin until patch. CVE-2026-5217 https://radar.offseq.com/threat/cve-2026-5217-cwe-79-improper-neutralization-of-in-49825cdd #OffSeq #WordPress #XSS #infosec

0
0
0
23h ago