24h | 7d | 30d

CVE-2026-41316

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 19 hours ago

Fediverse

Profile picture fallback
Fernando Briano @picandocodigo

Ruby 4.0.3 Released
This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316.

ruby-lang.org/en/news/2026/04/

#Ruby

  • 2
  • 0
  • 0
  • 19h ago

CVE-2026-6299

Overview

  • Google
  • Chrome
15 Apr 2026
Published
16 Apr 2026
Updated
CVSS
Pending
EPSS
0.05%
KEV

Description

Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

Statistics

  • 2 Posts
Last activity: 4 hours ago

Bluesky

Profile picture fallback
ケイ | 副業Webライター📖 @keiwork35.bsky.social
【脆弱性情報】 CVE-2026-6299 chromeの脆弱性について Google Chrome の 147.0.7727.101 より前のバージョンにおいて、Prerender に解放後使用の脆弱性が存在します。細工された HTML ページを介して、遠隔の攻撃者が任意のコードを実行できる可能性があります。
  • 0
  • 0
  • 0
  • 4h ago
Profile picture fallback
セキュリティ対策Lab @securitylab-jp.bsky.social
Google、Chrome 147で31件の脆弱性を修正、Criticalは5件(CVE-2026-6296、CVE-2026-6297、CVE-2026-6298、CVE-2026-6299、CVE-2026-6358を) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews
  • 0
  • 0
  • 0
  • 17h ago

CVE-2026-5752

Overview

  • Cohere
  • cohere-terrarium
14 Apr 2026
Published
21 Apr 2026
Updated
CVSS
Pending
EPSS
0.02%
KEV

Description

Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
DragonJAR @dragonjar

En las últimas 24 horas se reportaron accesos no autorizados al modelo de IA Mythos de Anthropic, una vulnerabilidad crítica en su plataforma que permite ejecución remota de código, ataques simultáneos del ransomware Kyber en Windows y ESXi, brechas en gestión de tokens OAuth en Vercel y un fallo en Cohere AI que da acceso root, todo mientras Mythos ayuda a detectar más de 270 vulnerabilidades en Firefox 150, destacando el doble filo de la inteligencia artificial en ciberseguridad. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/04/26 📆 |====

🔐 ACCESO NO AUTORIZADO AL MODELO DE IA MYTHOS DE ANTHROPIC

Un grupo reducido de usuarios ha logrado ingresar sin permiso al avanzado modelo de inteligencia artificial Mythos desarrollado por Anthropic PBC. Esta tecnología, considerada altamente potente, podría ser utilizada para facilitar ataques cibernéticos de gran impacto, aumentando el riesgo de explotación masiva si no se controlan correctamente sus accesos. Conocer este incidente es clave para entender las amenazas emergentes en IA. Descubre todos los detalles sobre esta brecha en el acceso a Mythos aquí 👉 djar.co/uEVw

⚠️ VULNERABILIDAD CRÍTICA EN MCP DE ANTHROPIC QUE PERMITE EJECUCIÓN REMOTA DE CÓDIGO

Una falla grave en el MCP (Microcontroller Platform) de Anthropic ha sido descubierta, permitiendo a atacantes ejecutar código de forma remota. Este tipo de vulnerabilidad abre la puerta a comprometer sistemas completos desde ubicaciones externas, subrayando la importancia de parches inmediatos y auditorías constantes en infraestructuras críticas. Infórmate sobre cómo proteger tus sistemas frente a esta amenaza aquí 👉 djar.co/ASyow

💀 DOBLE AMENAZA DEL RANSOMWARE KYBER EN WINDOWS Y ESXI

El ransomware Kyber está desplegando ataques simultáneos en sistemas Windows y ESXi, utilizando técnicas avanzadas que complican la recuperación y aumentan el impacto económico. Esta doble vectorialidad hace indispensable revisar las defensas en servidores virtualizados y estaciones de trabajo para minimizar riesgos. Aprende a identificar y mitigar estos ataques con este análisis completo 👉 djar.co/zJlX

🔓 ANÁLISIS DEL INCUMPLIMIENTO DE VERCEL: EL CAMINO DEL ATAQUE A TRAVÉS DE UN TOKEN OAUTH

Un estudio detallado revela cómo una brecha en la gestión de tokens OAuth permitió a atacantes en Vercel iniciar ataques de identidad, comprometiendo credenciales y acceso a recursos críticos. Este caso ejemplifica la necesidad de reforzar la seguridad en flujos de autenticación y gestión de tokens para evitar ataques sofisticados en entornos de desarrollo y nube. Profundiza en esta investigación y fortalece tus medidas aquí 👉 djar.co/4poWFN

🐞 FALLA EN COHERE AI TERRARIUM QUE PERMITE EJECUCIÓN ROOT Y ESCAPE DE CONTENEDOR

Se ha identificado la vulnerabilidad CVE-2026-5752 en la sandbox Terrarium de Cohere AI, que facilita la ejecución de código con privilegios root y la evasión del entorno aislado mediante manipulación del prototipo Pyodide. Este tipo de fallo compromete la integridad del entorno de ejecución y puede derivar en acceso completo al sistema host. Conoce los detalles técnicos y recomendaciones para mitigarla aquí 👉 djar.co/qThy

🕵️ MOZILLA Y EL MODELO DE IA MYTHOS: DETECTAN 271 VULNERABILIDADES DE DÍA CERO EN FIREFOX 150

El CTO de Mozilla ha reportado que el modelo Mythos de Anthropic fue capaz de identificar 271 vulnerabilidades desconocidas en la versión 150 de Firefox, demostrando el poder de la inteligencia artificial aplicada a la seguridad informática. Este avance promete acelerar la detección y resolución de vulnerabilidades críticas de forma automatizada, fortaleciendo la protección de millones de usuarios. Entérate cómo la IA está revolucionando la ciberseguridad aquí 👉 djar.co/GQzTtv

  • 1
  • 1
  • 0
  • 5h ago

CVE-2026-40933

Overview

  • FlowiseAI
  • Flowise
21 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.07%
KEV

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 13 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

🚨 CRITICAL: CVE-2026-40933 in FlowiseAI Flowise (< 3.1.0) allows authenticated OS command injection via unsafe MCP adapter serialization. Upgrade to 3.1.0+ to fully mitigate. CVSS 10 — patch now! radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 13h ago

CVE-2026-40906

Overview

  • electric-sql
  • electric
21 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.03%
KEV

Description

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 10 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

⚠️ CRITICAL: ElectricSQL (v1.1.12 - <1.5.0) has a CVE-2026-40906 SQL injection in /v1/shape API. Authenticated users can fully compromise PostgreSQL DB. Upgrade to 1.5.0+ now! radar.offseq.com/threat/cve-20

  • 0
  • 1
  • 0
  • 10h ago

CVE-2026-21876

Overview

  • coreruleset
  • coreruleset
08 Jan 2026
Published
09 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.3)
EPSS
0.07%
KEV

Description

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.

Statistics

  • 1 Post
Last activity: 4 hours ago

Bluesky

Profile picture fallback
Help Net Security @helpnetsecurity.com
Progress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876) 📖 Read more: www.helpnetsecurity.com/2026/04/22/p... #cybersecurity #cybersecuritynews #firewall #securityupdate #webapplicationsecurity #vulnerability @owasp.org @coreruleset.bsky.social
  • 0
  • 0
  • 0
  • 4h ago

CVE-2026-3308

Overview

  • Artifex Software Inc. *PyMuPDF*
  • MuPDF
31 Mar 2026
Published
21 Apr 2026
Updated
CVSS
Pending
EPSS
0.02%
KEV

Description

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.

Statistics

  • 1 Post
Last activity: 19 hours ago

Bluesky

Profile picture fallback
ferramentaslinux.bsky.social @ferramentaslinux.bsky.social
🔴 CVE-2026-3308 is old news – but heap overflows in PDF parsers never die. Here’s your evergreen fix for MuPDF on #Debian / #Ubuntu. Read more-> tinyurl.com/yc6rcywr
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-4119

Overview

  • jppreus
  • Create DB Tables
22 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.02%
KEV

Description

The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post action hooks for creating tables (admin_post_add_table) and deleting tables (admin_post_delete_db_table) without implementing any capability checks via current_user_can() or nonce verification via wp_verify_nonce()/check_admin_referer(). The admin_post hook only requires the user to be logged in, meaning any authenticated user including Subscribers can access these endpoints. The cdbt_delete_db_table() function takes a user-supplied table name from $_POST['db_table'] and executes a DROP TABLE SQL query, allowing any authenticated attacker to delete any database table including critical WordPress core tables such as wp_users or wp_options. The cdbt_create_new_table() function similarly allows creating arbitrary tables. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary database tables and delete any existing database table, potentially destroying the entire WordPress installation.

Statistics

  • 1 Post
Last activity: 7 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

🚨 CVE-2026-4119: CRITICAL vuln in WordPress Create DB Tables plugin (≤1.2.1). Any authenticated user can create/delete DB tables, risking total site loss. Disable or restrict roles until patched. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 7h ago

CVE-2026-33032

Overview

  • 0xJacky
  • nginx-ui
30 Mar 2026
Published
16 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
7.55%
KEV

Description

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Can Artuc @canartuc

Recorded Future confirmed exploitation of CVE-2026-33032 (MCPwn, per Pluto Security) in nginx-ui on April 13. Flaw sits in the Model Context Protocol integration: the /mcp_message endpoint relies on an IP whitelist that accepts everyone by default. Unauthenticated attackers invoke MCP tools, rewrite Nginx config, reload the server. 2,689 on Shodan. Fix is in 2.3.4 from March 15. Every product shipping MCP this year is shipping a new auth surface.

#CyberSecurity #InfoSec #OpenSource #DevOps

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-41144

Overview

  • nasa
  • fprime
21 Apr 2026
Published
21 Apr 2026
Updated
CVSS v3.1
Pending
EPSS
0.10%
KEV

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize > fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitization on the destination file path. Combined, these allow writing arbitrary data to any file at any offset. The impact is arbitrary file write leading to remote code execution on embedded targets. Note that this is a logic bug. ASAN does not detect it because all memory accesses are within valid buffers — the corruption occurs in file I/O. Version 4.2.0 contains a patch. No known workarounds are available.

Statistics

  • 1 Post
Last activity: 7 hours ago

Bluesky

Profile picture fallback
BaseFortify.eu @basefortify.bsky.social
🚀 A subtle bug in NASA’s F´ (F Prime) framework could have serious impact CVE-2026-41144 allows attackers to bypass file write checks via integer overflow, leading to arbitrary file writes and possible remote code execution ⚠️ 🔗 basefortify.eu/cve_reports/... #CyberSecurity #Infosec #CVE #NASA
  • 0
  • 0
  • 0
  • 7h ago
Showing 11 to 20 of 45 CVEs