CVE-2026-92784: Improper Control of Generation of Code

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

PT-2026-94105

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.76 n8n versions prior to 2.37.7 n8n versions prior to 2.38.2 Description The source control push endpoint relies on file paths and status provided in the client request payload rather than server-side status compute...

CVE-2026-92719: Server-Side Request Forgery (SSRF)

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92588: Authorization Bypass Through User-Controlled Key

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

Google Chrome Authorization Vulnerability (CNVD-2026-37842)

Google Chrome is a free web browser developed by Google Inc. Google Chrome has a licensing issue vulnerability, which stems from improper licensing management in FedCM. Attackers can exploit this vulnerability by using specially crafted HTML pages to bypass Web source policies...

RHEL 9 : unbound (RHSA-2026:68292)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68292 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via...

ALSA-2026:68291 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

ALSA-2026:68292 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

RHEL 10 : unbound (RHSA-2026:68291)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68291 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via...

Langflow agent creation and deployment tool CORS Code Execution

The vulnerability of the CORS configuration mechanism used by the Langflow agent creation and deployment tool is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

SUSE CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

CVE-2026-73437

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

CVE-2026-83043

creationtimestamp| type| source ---|---|--- 2026-09-15 22:14:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnklqpcj2y 2026-09-16 00:20:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlukmtvx624 2026-09-22 07:37:06+00:00| seen|...

CVE-2026-83006

creationtimestamp| type| source ---|---|--- 2026-09-15 22:13:01+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnhc4xbq2b 2026-09-15 23:20:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlr7dre3a2g 2026-09-23 09:49:50+00:00| seen|...

CVE-2026-70757

creationtimestamp| type| source ---|---|--- 2026-09-15 21:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvll2jfxeb2g 2026-09-15 22:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvln6xk4nw22 2026-09-16 12:05:07+00:00| seen|...

CVE-2026-73437 On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

CVE-2026-73437

Arista EOS DHCP relay is vulnerable to spoofed DHCP reply forwarding (CWE-345). An unauthenticated attacker on an adjacent network can send crafted DHCP reply packets from a non-helper IP address, which the relay forwards to clients without source validation, potentially supplying malicious netwo...

CVE-2026-19886

creationtimestamp| type| source ---|---|--- 2026-09-15 20:13:28+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvlgrkta4a2i...

CVE-2026-69213

creationtimestamp| type| source ---|---|--- 2026-09-15 20:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7l7nfi2e 2026-09-16 13:32:29+00:00| seen| https://gist.github.com/alon710/27956b315c2388b848451081f38450c3...