24h | 7d | 30d

CVE-2026-45064

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Symfony @symfony

🔐 CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
➡️ symfony.com/blog/cve-2026-4506

  • 1
  • 1
  • 1
  • 11h ago

CVE-2026-45075

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Symfony @symfony

🔐 CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
➡️ symfony.com/blog/cve-2026-4507

  • 1
  • 1
  • 1
  • 11h ago

CVE-2026-46349

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Hubzilla Support Forum @adminsforum
[🖼 Harald Eilertsen]Harald Eilertsen wrote the following post Wed, 20 May 2026 19:56:18 +0200 @!Hubzilla Support Forum @!Hubzilla Community Forum

[🖼 Harald Eilertsen]Harald Eilertsen wrote the following post Wed, 20 May 2026 19:52:37 +0200 Hubzilla version 11.2.1 contains an important fix for a security issue that would in some cases allow a malicious actor to alter an activity (such as a Like or Announce/Repeat, etc) without affecting the cryptographic signature of the activity. This could caue potential unauthenticated activities to be injected into the system.

Only activities coming from other fediverse software relying on LD-Signatures are affected. Hubzilla defaults to using the more robust Data Integrity Proofs where available, such as between Hubzilla instances. In addition, the way Hubzilla normalizes the incoming messages before validating the signature mitigated most of the attack vectors, while some would still affect us.

In version 11.2.1 further mitigations has been implemented, so that we will reject activities containing any of the potentially dangerous keywords before even trying to validate the signature.

Thanks to the Mastodon security team for reporting this issue, and helping us understand how the attack work. See also their announcement about the issue.

  • CVE: CVE-2026-46349
  • Severity: 5.3 (Medium)
  • Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
  • Vulnerable component: PubCrawl (ActivityPub addon)
  • Vulnerable version: Up to and including 11.2
  • Fixed in: 11.2.1

  • 1
  • 0
  • 0
  • 4h ago

CVE-2022-38392

Overview

  • Pending
17 Aug 2022
Published
03 Aug 2024
Updated
CVSS v3.1
MEDIUM (5.3)
EPSS
0.07%
KEV

Description

Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447.

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
ShadSterling @ShadSterling

@anomalocarididae disproportionately many fedizens a have read some version of nvd.nist.gov/vuln/detail/CVE-2 .

What I want to know is how loud do you have to play it?

  • 0
  • 3
  • 0
  • 17h ago

CVE-2026-20223

Overview

  • Cisco
  • Cisco Secure Workload
20 May 2026
Published
20 May 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user. 

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Davi Ottenheimer @flyingpenguin

deep narrator voice "it was a segmentation product that cannot segment"

cve.org/CVERecord?id=CVE-2026-

  • 0
  • 2
  • 0
  • 4h ago

CVE-2026-45073

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 11 hours ago

Bluesky

Profile picture fallback
Symfony @symfony.com
🔐 CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix ➡️ https://symfony.com/blog/cve-2026-45073-sql-injection-in-pdoadapter-doclear-via-unsanitized-prefix
  • 0
  • 1
  • 1
  • 11h ago

CVE-2026-46634

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 12 hours ago

Bluesky

Profile picture fallback
Symfony @symfony.com
🔐 CVE-2026-46634: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name ➡️ https://symfony.com/blog/cve-2026-46634-template-from-string-escapes-a-sourcepolicy-driven-sandbox-via-synthesized-template-name
  • 0
  • 1
  • 1
  • 12h ago

CVE-2026-45074

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 11 hours ago

Bluesky

Profile picture fallback
Symfony @symfony.com
🔐 CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay ➡️ https://symfony.com/blog/cve-2026-45074-cas2handler-derives-cas-service-url-from-client-host-header-cross-service-ticket-replay
  • 0
  • 1
  • 1
  • 11h ago

CVE-2026-24425

Overview

  • twigphp
  • Twig
20 May 2026
Published
20 May 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 12 hours ago

Bluesky

Profile picture fallback
Symfony @symfony.com
🔐 CVE-2026-24425: Possible sandbox bypass when using a source policy ➡️ https://symfony.com/blog/cve-2026-24425-possible-sandbox-bypass-when-using-a-source-policy
  • 0
  • 1
  • 1
  • 12h ago

CVE-2026-46635

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 12 hours ago

Bluesky

Profile picture fallback
Symfony @symfony.com
🔐 CVE-2026-46635: Sandbox property allowlist bypass via the `column` filter (array_column on objects) ➡️ https://symfony.com/blog/cve-2026-46635-sandbox-property-allowlist-bypass-via-the-column-filter-array-column-on-objects
  • 0
  • 1
  • 1
  • 12h ago
Showing 41 to 50 of 105 CVEs