Aggregator

CVE-2026-39911 | hashgraph guardian up to 3.5.0 Environment Variable exposure of resource

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability marked as critical has been reported in hashgraph guardian up to 3.5.0. Impacted is an unknown function of the component Environment Variable Handler. This manipulation causes exposure of resource. This vulnerability is tracked as CVE-2026-39911. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.
vuldb.com

CVE-2026-39315 | unjs unhead up to 2.1.12 safe.ts useHeadSafe incomplete blacklist (GHSA-95h2-gj7x-gx9w)

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability labeled as critical has been found in unjs unhead up to 2.1.12. This issue affects the function useHeadSafe of the file packages/unhead/src/plugins/safe.ts. The manipulation results in incomplete blacklist. This vulnerability is identified as CVE-2026-39315. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.
vuldb.com

CVE-2026-5329 | Rapid7 Velociraptor up to 0.74.6/0.75.6/0.76.1 Client Monitoring Message handler input validation

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability identified as critical has been detected in Rapid7 Velociraptor up to 0.74.6/0.75.6/0.76.1. This vulnerability affects unknown code of the component Client Monitoring Message handler. The manipulation leads to improper input validation. This vulnerability is referenced as CVE-2026-5329. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.
vuldb.com

Malicious PDF reveals active Adobe Reader zero-day in the wild

Security Affairs
2 weeks 3 days ago
Hackers used an Adobe Reader zero-day for months. Researcher Haifei Li found a malicious PDF and asks the community to help analyze it. Hackers used an Adobe Reader zero-day for months to deliver a sophisticated PDF exploit. Cybersecurity researcher Haifei Li, founder of Expmon, discovered the malicious file and warned the community. On March 26, […]
Pierluigi Paganini

[un]prompted 2026 – Zeal Of The Convert: Taming Shai-Hulud With AI

Security Boulevard
2 weeks 3 days ago

Author, Creator & Presenter: Rami McCarthy, Principal Security Researcher At Wiz

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations' YouTube Channel.

Permalink

The post [un]prompted 2026 – Zeal Of The Convert: Taming Shai-Hulud With AI appeared first on Security Boulevard.

Marc Handelman

CVE-2026-1491

CVE Trends
2 weeks 3 days ago
Currently trending CVE - Hype Score: 2 - IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 IBM Security Verify could allow a remote attacker to ...

CVE-2026-0049

CVE Trends
2 weeks 3 days ago
Currently trending CVE - Hype Score: 1 - In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48651

CVE Trends
2 weeks 3 days ago
Currently trending CVE - Hype Score: 1 - In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for ...

CVE-2026-40072 | Ethereum web3.py up to 7.14.x/8.0.0b1 Backend Service eth_call/call offchain_lookup_payload["urls"] server-side request forgery

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability categorized as critical has been discovered in Ethereum web3.py up to 7.14.x/8.0.0b1. This affects the function eth_call/call of the component Backend Service. Executing a manipulation of the argument offchain_lookup_payload["urls"] can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-40072. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.
vuldb.com

Managed ad