CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

PT-2026-93114

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...

PT-2026-92420

Summary libp2p-quic can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp2p TLS certificate and delays the final TLS 1.3 handshake fragment until the certificate expires. This is remotely reachable by a network peer and can crash applications exposing a...

CVE-2026-91146

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-82435

creationtimestamp| type| source ---|---|--- 2026-09-14 21:30:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvj2lpjrjs25...

CVE-2026-75030

creationtimestamp| type| source ---|---|--- 2026-09-14 21:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvizhu6c5l24...

CVE-2026-65838

creationtimestamp| type| source ---|---|--- 2026-09-14 21:01:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mviyy5okkd2m...

CVE-2026-73496

creationtimestamp| type| source ---|---|--- 2026-09-14 21:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mviyxvwudy2b 2026-09-18 12:00:05+00:00| published-proof-of-concept| https://t.me/bdufstecru/3465 2026-09-19 00:00:37+00:00| published-proof-of-concept|...

CVE-2026-73370

creationtimestamp| type| source ---|---|--- 2026-09-14 21:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviyvyv53c24...

CVE-2024-58383

creationtimestamp| type| source ---|---|--- 2026-09-14 19:58:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvivhexoih2e...

CVE-2026-78299

creationtimestamp| type| source ---|---|--- 2026-09-14 19:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviugwhbwb2n...

CVE-2026-78330

creationtimestamp| type| source ---|---|--- 2026-09-14 19:30:20+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvituzizet2t 2026-09-15 04:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/117273174374332264 2026-09-15 04:30:33+00:00| seen|...

CVE-2026-90946

creationtimestamp| type| source ---|---|--- 2026-09-14 19:02:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvisd6gaee2m...

CVE-2026-59178

creationtimestamp| type| source ---|---|--- 2026-09-14 18:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvirnn6qjc2j 2026-09-14 19:32:08+00:00| seen| https://gist.github.com/alon710/3693f8803a657bff4ffb362747901533 2026-09-14 20:00:44+00:00| seen|...

OESA-2026-3723 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privilege...

CVE-2026-59569

creationtimestamp| type| source ---|---|--- 2026-09-14 16:05:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6zfkww6wjfg5h 2026-09-21 12:10:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117308957574042512 2026-09-21 12:20:05+00:00| seen|...

CVE-2026-61797

creationtimestamp| type| source ---|---|--- 2026-09-14 15:09:41+00:00| seen| https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mvifdge5ft2z 2026-09-14 21:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102329 2026-09-15 00:00:09+00:00| published-proof-of-concept|...

CVE-2026-90786

creationtimestamp| type| source ---|---|--- 2026-09-14 14:36:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2vqxxinlsgmbn...

CVE-2026-71801

creationtimestamp| type| source ---|---|--- 2026-09-14 14:22:41+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvicpf4it42q...

CVE-2026-86348

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...