CVE-2026-82754: Improper Protection of Alternate Path

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

CVE-2026-86351: URL Redirection to Untrusted Site

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-12757: Improper Control of Generation of Code

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

CVE-2026-82758: Improper Authentication

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-86437: Incorrect Authorization

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

PT-2026-86679

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-83534

creationtimestamp| type| source ---|---|--- 2026-09-06 17:53:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hjru5723mgrpw...

CVE-2021-38817

creationtimestamp| type| source ---|---|--- 2026-09-06 15:00:03+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag 2026-09-07 01:00:11+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag...

CVE-2026-19858

creationtimestamp| type| source ---|---|--- 2026-09-06 14:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muu5rh4ejm2v...

CVE-2026-84934

creationtimestamp| type| source ---|---|--- 2026-09-06 12:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mutx2l4nrq22...

CVE-2026-18480

creationtimestamp| type| source ---|---|--- 2026-09-06 11:59:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mutwyrwww62r 2026-09-06 16:01:40+00:00| seen| https://gist.github.com/ichintu/fe47c9308dfcae2743b09006cdd52579...

CVE-2026-86179

creationtimestamp| type| source ---|---|--- 2026-09-06 09:42:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3yxjys4sqd66e...

CVE-2026-86180

creationtimestamp| type| source ---|---|--- 2026-09-06 09:36:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ezbipv4pvvcct...

CVE-2026-86164

creationtimestamp| type| source ---|---|--- 2026-09-06 05:40:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4poraz7h7yiac...

pentest-metasploitable2-lab

Análise de Exploração e Resposta a Incidente — Laboratório Met...

PT-2026-86473

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.13 Description An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the pre update value function lacks capability or ownership checks, an...

CVE-2026-19283

creationtimestamp| type| source ---|---|--- 2026-09-05 23:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3musliq75y52r 2026-09-06 00:32:10+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3musqkwmryf2r...

CVE-2026-86149

creationtimestamp| type| source ---|---|--- 2026-09-05 22:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muskufwazg22 2026-09-06 00:07:30+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3musp6ta4jo2n...

CVE-2026-86148

creationtimestamp| type| source ---|---|--- 2026-09-05 22:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muskueclpq2r 2026-09-06 00:07:13+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3musp6dc33e2r 2026-09-06 02:02:27+00:00| seen|...