CVE-2026-83062

creationtimestamp| type| source ---|---|--- 2026-09-16 00:11:57+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlu3yttex2j 2026-09-16 02:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvm4wrexzx2f 2026-09-23 06:07:07+00:00| seen|...

CVE-2026-83058

creationtimestamp| type| source ---|---|--- 2026-09-16 00:11:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlu2zg6332t 2026-09-16 00:40:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlvodn7ut2t 2026-09-23 09:48:09+00:00| seen|...

CVE-2026-83056

creationtimestamp| type| source ---|---|--- 2026-09-16 00:11:08+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlu2jcud422 2026-09-16 00:30:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlv4invrx2t 2026-09-23 09:48:13+00:00| seen|...

PT-2026-94105

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.76 n8n versions prior to 2.37.7 n8n versions prior to 2.38.2 Description The source control push endpoint relies on file paths and status provided in the client request payload rather than server-side status compute...

CVE-2026-86784: Improper Neutralization of Input During Web Page Generation

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

RHEL 9 : unbound (RHSA-2026:68292)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68292 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via...

The vulnerability of the CORS configuration mechanism of the Langflow agent creation and deployment tool allows a attacker to execute arbitrary code.

The vulnerability of the CORS configuration mechanism used by the Langflow agent creation and deployment tool is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-93306

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-92784: Improper Control of Generation of Code

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

PT-2026-93882

Name of the Vulnerable Software and Affected Versions Quickwit versions prior to 0.9.1 Description Insufficient validation of the host and scheme in the queue url parameter within SQS file sources allows an attacker to force the node to send requests to arbitrary internal addresses. By providing ...

Google Chrome Authorization Vulnerability (CNVD-2026-37842)

Google Chrome is a free web browser developed by Google Inc. Google Chrome has a licensing issue vulnerability, which stems from improper licensing management in FedCM. Attackers can exploit this vulnerability by using specially crafted HTML pages to bypass Web source policies...

CVE-2026-92588: Authorization Bypass Through User-Controlled Key

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

Google Chrome Authorization Vulnerability (CNVD-2026-37838)

Google Chrome is a free web browser developed by Google Inc. Google Chrome has a licensing vulnerability, which stems from improper licensing in DeviceBoundSessionCredentials. Attackers can exploit this vulnerability to bypass Web source policies through specially crafted network traffic...

CVE-2026-92719: Server-Side Request Forgery (SSRF)

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

PT-2026-94061

Name of the Vulnerable Software and Affected Versions @refinedev/inferencer versions prior to 7.0.1 Description The software fails to escape API field names during their interpolation into generated JSX source code. This allows attackers who control the data provider to inject malicious JavaScrip...

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This...

ALSA-2026:68291 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

ALSA-2026:68292 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

RHEL 10 : unbound (RHSA-2026:68291)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68291 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via...