EUVD-2026-70811

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODEMESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...

CVE-2026-85380 light0011 cms UEditor controller.php catchimage server-side request forgery

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

EUVD-2026-70853

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

CVE-2026-85380

CVE-2026-85380 affects the UEditor component of light0011 CMS (a GitHub-hosted content management system). The vulnerability resides in the catchimage function within Public/ueditor/php/controller.php , where manipulation of the source[] argument enables Server-Side Request Forgery (SSRF) . The a...

CVE-2026-85380 light0011 cms UEditor controller.php catchimage server-side request forgery

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

SUSE CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

PT-2026-85331

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

PT-2026-85386

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host...

CVE-2026-85085: Improper Verification of Source of a Communication Channel

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...

PT-2026-89188

Уязвимость прикладного программного интерфейса программных платформ для разработки и управления онлайн магазинами Magento Open Source, Adobe Commerce и Adobe Commerce B2B связана с непринятием мер по нейтрализации специальных элементов в механизме создания шаблонов. Эксплуатация уязвимости может...

PT-2026-86946

Уязвимость прикладного программного интерфейса программных платформ для разработки и управления онлайн магазинами Magento Open Source, Adobe Commerce и Adobe Commerce B2B связана с непринятием мер по нейтрализации специальных элементов в механизме создания шаблонов. Эксплуатация уязвимости может...

CVE-2026-85378

creationtimestamp| type| source ---|---|--- 2026-09-03 23:44:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2dalamshcy3eo...

CVE-2026-85435

creationtimestamp| type| source ---|---|--- 2026-09-03 23:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munmpxrwsz2y 2026-09-04 00:09:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munoeb3ll32o 2026-09-04 00:10:48+00:00| seen|...

CVE-2026-62916

creationtimestamp| type| source ---|---|--- 2026-09-03 23:36:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fib4rqqx4kk3b 2026-09-04 00:07:41+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munobcp2og2t 2026-09-04 01:30:06+00:00| seen|...

CVE-2026-85433

creationtimestamp| type| source ---|---|--- 2026-09-03 23:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munm643azs2p 2026-09-04 00:09:02+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munodpif7422...

CVE-2026-85432

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-49509

CVE-2026-49509 is an out-of-bounds read vulnerability in Samsung Opensource Escargot , a JavaScript engine, that allows overread of buffers. The affected commit is 25648aef19187b3f87f4d9420b8d761453ad4630. The CNA-assigned CVSS 3.1 score is 4.4 (MEDIUM) , with a local attack vector, low complexit...

CVE-2026-64197

creationtimestamp| type| source ---|---|--- 2026-09-03 23:01:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munkld3kwi2i...

CVE-2026-85223

creationtimestamp| type| source ---|---|--- 2026-09-03 22:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gya6xuyqcakrm 2026-09-03 23:01:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munkkvrh6q2c 2026-09-04 11:08:57+00:00| seen|...

CVE-2026-64200

creationtimestamp| type| source ---|---|--- 2026-09-03 22:39:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4ctwqq7rjfos7 2026-09-03 23:02:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munkmxz2dk2l...