Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner

Bug reported by 0x0.eth was disclosed at May 8, 2026, 11:08 am   |   Insecure Direct Object Reference (IDOR)

Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner.

View-only guests could see deleted Collectives pages in the trashbin

Bug reported by _dha was disclosed at May 8, 2026, 8:35 am   |   Improper Access Control - Generic

A vulnerability was discovered where view-only guests could see deleted Collectives pages in the trashbin.

CVE-2026-7009: OCSP stapling bypass with Apple SecTrust

Bug reported by Carlos Carrillo Boj was disclosed at April 29, 2026, 7:15 am   |   Improper Certificate Validation

CVE-2026-6253: proxy credentials leak over redirect-to proxy

Bug reported by Dwij Mehta was disclosed at April 29, 2026, 7:15 am   |  

CVE-2026-5545: wrong reuse of HTTP Negotiate connection

Bug reported by quaccws was disclosed at April 29, 2026, 7:15 am   |   Authentication Bypass by Primary Weakness

CVE-2026-6276: stale custom cookie host causes cookie leak

Bug reported by areksa was disclosed at April 29, 2026, 7:14 am   |   Exposure of Data Element to Wrong Session

CVE-2026-6429: netrc credential leak with reused proxy connection

Bug reported by pesudonmy was disclosed at April 29, 2026, 7:14 am   |   Information Exposure Through Sent Data

CVE-2026-4873: connection reuse ignores TLS requirement

Bug reported by Arkadi Vainbrand was disclosed at April 29, 2026, 6:47 am   |   Cleartext Transmission of Sensitive Information

A vulnerability was discovered in libcurl's connection reuse for cleartext-upgrade mail protocols. The vulnerability was that the later transfer's CURLOPT_USE_SSL option was not properly included if a plaintext connection was already open and reusable. This affected the smtp://, pop3://, and imap:// protocols. The vulnerability could allow a later TLS-required mail transfer to be sent over a previously established plaintext connection, contrary to expectation.

CVE-2026-5773: wrong reuse of SMB connection

Bug reported by Osama Hamad was disclosed at April 29, 2026, 6:11 am   |  

A vulnerability was discovered in curl version 8.19.0 and earlier versions that support SMB. The vulnerability was due to the incorrect reuse of SMB connections across different shares on the same server. This led to data spoofing and access control bypass. The issue was caused by the lack of verification of the target share name when reusing an existing connection. As a result, the application could silently fetch data from an unintended share.

PS4 BD-J privilege escalation using nested JAR

Bug reported by was disclosed at April 29, 2026, 5:09 am   |   Privilege Escalation

A PS4 vulnerability was discovered in the Blu-ray Disc Java (BD-J) privilege escalation using nested JAR files. The vulnerability was found in the PS4 system software versions 13.00 to the latest version 13.02. The vulnerability was caused by a discrepancy between the security policy's path canonicalization and the actual class loading path. The security policy granted AllPermission to code that appeared to be loaded from a trusted directory, while the actual code was loaded from an untrusted nested JAR on the Blu-ray disc. This resulted in a Time-of-Check/Time-of-Use (TOCTOU) vulnerability that allowed untrusted code to obtain AllPermission.

CVE-2026-5773: wrong reuse of SMB connection

Bug reported by Osama Hamad was disclosed at April 29, 2026, 6:11 am   |  

A vulnerability was discovered in curl version 8.19.0 and earlier versions that support SMB. The vulnerability was due to the incorrect reuse of SMB connections across different shares on the same server. This led to data spoofing and access control bypass. The issue was caused by the lack of verification of the target share name when reusing an existing connection. As a result, the application could silently fetch data from an unintended share.

PS4 BD-J privilege escalation using nested JAR

Bug reported by was disclosed at April 29, 2026, 5:09 am   |   Privilege Escalation

A PS4 vulnerability was discovered in the Blu-ray Disc Java (BD-J) privilege escalation using nested JAR files. The vulnerability was found in the PS4 system software versions 13.00 to the latest version 13.02. The vulnerability was caused by a discrepancy between the security policy's path canonicalization and the actual class loading path. The security policy granted AllPermission to code that appeared to be loaded from a trusted directory, while the actual code was loaded from an untrusted nested JAR on the Blu-ray disc. This resulted in a Time-of-Check/Time-of-Use (TOCTOU) vulnerability that allowed untrusted code to obtain AllPermission.

Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.org

Bug reported by Aman Bhuiyan was disclosed at April 27, 2026, 9:43 am   |   Improper Input Validation

A restricted keyword bypass vulnerability was discovered on the Firefox Add-ons platform that allowed an attacker to register a display name visually identical to "Mozilla" by using a Unicode homoglyph character. This circumvented the intended restriction and could have been used to impersonate official accounts.

Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net

Bug reported by Aaqib Hussain was disclosed at April 27, 2026, 4:00 am   |   Improper Access Control - Generic

A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST request. Additionally, the lack of rate limiting or duplicate request validation allowed attackers to spam users by repeatedly sending the same or modified requests.

Non-premium user can disable Ads in japanese version of dic.pixiv.net

Bug reported by Luis G. Moret Hernandez was disclosed at April 27, 2026, 3:58 am   |   Business Logic Errors

A vulnerability was identified in the Japanese version of the pixiv dictionary website where non-premium users could disable advertisements. Normally, the ability to disable ads was restricted to premium users only. However, due to improper access control, any authenticated user could modify their ad display preferences without verification of premium status.

Non-premium user can disable Ads in japanese version of dic.pixiv.net

Bug reported by Luis G. Moret Hernandez was disclosed at April 27, 2026, 3:58 am   |   Business Logic Errors

A vulnerability was identified in the Japanese version of the pixiv dictionary website where non-premium users could disable advertisements. Normally, the ability to disable ads was restricted to premium users only. However, due to improper access control, any authenticated user could modify their ad display preferences without verification of premium status.

RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs

Bug reported by Arccode was disclosed at April 23, 2026, 9:45 am   |   Improper Access Control - Generic

position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.

Bug reported by _NULL was disclosed at April 20, 2026, 12:04 pm   |   Resource Injection

A vulnerability was discovered in the CSS sanitization process of the Roundcube webmail application. The sanitizer failed to properly handle the "position: fixed !important" CSS declaration, allowing an attacker to bypass the mitigation for fixed-position overlays. This could enable the creation of full-viewport phishing overlays.

Unquoted body background attribute enables CSS injection that bypasses remote image blocking

Bug reported by _NULL was disclosed at April 20, 2026, 12:03 pm   |   Resource Injection

A vulnerability was discovered in Roundcube's HTML sanitizer that enabled CSS injection when the `allow_remote` option was set to `false`. The sanitizer failed to quote the value of the `background` attribute from the email's `` element, allowing a crafted `data:` URI to terminate the `url()` function and inject arbitrary CSS properties. This bypass allowed external resources to be loaded even when remote image blocking was enabled.

SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent

Bug reported by _NULL was disclosed at April 20, 2026, 12:03 pm   |   Remote File Inclusion

A vulnerability was discovered in the HTML sanitizer of the Roundcube webmail client. The vulnerability allowed attackers to bypass the "Block remote images" security feature by using SMIL animation attributes to load arbitrary external resources without validation. This could have enabled email tracking without the user's consent.