CVE-2026-87607

creationtimestamp| type| source ---|---|--- 2026-09-10 01:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4v4bh7i42t 2026-09-10 05:15:18+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 08:07:07+00:00| seen|...

CVE-2026-87621

creationtimestamp| type| source ---|---|--- 2026-09-10 01:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4ukfajsa2p 2026-09-10 05:15:49+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 07:37:07+00:00| seen|...

CVE-2026-87527

creationtimestamp| type| source ---|---|--- 2026-09-10 00:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4tgo6dgh2w 2026-09-10 04:49:51+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 12:37:07+00:00| seen|...

PT-2026-89349

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-88894: Incorrect Authorization

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-15889: Improper Neutralization of Input During Web Page Generation

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-88062: Improper Control of Generation of Code

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

PT-2026-89722

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2026-54054: Server-Side Request Forgery (SSRF)

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-78083: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2025-57231: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

Empire v7.0.2

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

CVE-2026-87016

creationtimestamp| type| source ---|---|--- 2026-09-09 23:01:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4ndzoauy24 2026-09-10 22:35:05+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7 2026-09-16...

CVE-2026-87995

creationtimestamp| type| source ---|---|--- 2026-09-09 23:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4ndlgnru22 2026-09-10 16:35:12+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jmc6-2wr8-h3wj 2026-09-17...

CVE-2026-68484

creationtimestamp| type| source ---|---|--- 2026-09-09 22:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4mq2hgmx2p...

CVE-2026-61907

creationtimestamp| type| source ---|---|--- 2026-09-09 19:40:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/64kwekmjcusjz...

CVE-2026-22590

creationtimestamp| type| source ---|---|--- 2026-09-09 18:04:35+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mv44rkfwjm2w 2026-09-09 22:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4m67g7dc2y...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the setDict, setLongMax, setLevel, and setRefMultipleDDicts methods of its streaming classes. An attacker can corrupt native heap state or crash the JVM by calling these setters on a stream after close, causing them to...

CVE-2026-80117

creationtimestamp| type| source ---|---|--- 2026-09-09 15:00:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv3shkbndg2c 2026-09-09 15:00:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117241675871290048...

WordPress Builderall for WordPress plugin <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...