24h | 7d | 30d

CVE-2026-40175

Overview

  • axios
  • axios
10 Apr 2026
Published
16 Apr 2026
Updated
CVSS v3.1
MEDIUM (4.8)
EPSS
0.14%
KEV

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.

Statistics

  • 1 Post
Last activity: 5 hours ago

Bluesky

Profile picture fallback
ひよどりBasist @visualbasist.bsky.social
あまりに高すぎたAxiosのCVE-2026-40175 CVSSが4.8に下げられてたv3.1で下げるとしたらACかなと思ってたけど影響も下げられてる
  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-3055

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
31 Mar 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
55.71%
KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
Taggart :ifin: @mttaggart

Useful explainer on the latest Citrix shenanigans, including verifying exposure and hunting/forensics recommendations

picussecurity.com/resource/blo

  • 3
  • 2
  • 0
  • 5h ago

CVE-2026-4368

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
24 Mar 2026
Updated
CVSS v4.0
HIGH (7.7)
EPSS
0.02%
KEV

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
Taggart :ifin: @mttaggart

Useful explainer on the latest Citrix shenanigans, including verifying exposure and hunting/forensics recommendations

picussecurity.com/resource/blo

  • 3
  • 2
  • 0
  • 5h ago

CVE-2026-6042

Overview

  • musl
  • libc
10 Apr 2026
Published
10 Apr 2026
Updated
CVSS v4.0
MEDIUM (4.8)
EPSS
0.01%
KEV

Description

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Fiona @airtower

Does anyone know how to report errors to https://db.gcve.eu/? Just their info@ mail? I looked up CVE-2026-6042 and CVE-2026-40200 there because I was annoyed that the NVD database (which #Buildroot uses for automated vulnerability checks) still didn't have them correctly labeled with the CPE (so automated tools can't identify the package is vulnerable).

Result: CVE-2026-40200 is correctly labeled (good!), while CVE-2026-6042 is not (different vendor/product). Mistakes happen, an organization that's trying to run as serious vulnerability DB really needs to provide an obvious "report errors here" mail address (or other means, but really… mail). ​:neocat_glare:​ #CVE #GCVE

  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-40200

Overview

  • musl-libc
  • musl
10 Apr 2026
Published
14 Apr 2026
Updated
CVSS v3.1
HIGH (8.1)
EPSS
0.02%
KEV

Description

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Fiona @airtower

Does anyone know how to report errors to https://db.gcve.eu/? Just their info@ mail? I looked up CVE-2026-6042 and CVE-2026-40200 there because I was annoyed that the NVD database (which #Buildroot uses for automated vulnerability checks) still didn't have them correctly labeled with the CPE (so automated tools can't identify the package is vulnerable).

Result: CVE-2026-40200 is correctly labeled (good!), while CVE-2026-6042 is not (different vendor/product). Mistakes happen, an organization that's trying to run as serious vulnerability DB really needs to provide an obvious "report errors here" mail address (or other means, but really… mail). ​:neocat_glare:​ #CVE #GCVE

  • 0
  • 0
  • 0
  • 8h ago
Showing 31 to 35 of 35 CVEs