We've got one word for it, and it's usually the wrong one

Welcome to this week's edition of the Threat Source newsletter. Ask anybody in this industry what the work does to the health of the people who do it and you get one word back: burnout. It's a fine word, in and of itself. It's easy to reach for, understandable to everyone… and it's the wrong one,...

CVE-2026-88050

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length but accepts negative code values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can...

CVE-2026-88937

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/achufej3w2s5g 2026-09-11 05:30:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7tkel43c2y...

CVE-2026-80351

creationtimestamp| type| source ---|---|--- 2026-09-10 17:00:11+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6jndegk32p 2026-09-15 05:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvju4tql6g2r...

CVE-2026-88868

creationtimestamp| type| source ---|---|--- 2026-09-10 14:40:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6bstzdrx2b 2026-09-10 16:07:58+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpws3p425...

CVE-2026-88867

creationtimestamp| type| source ---|---|--- 2026-09-10 14:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6bsrhhbr2y 2026-09-10 16:07:47+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpnjiyh22...

CVE-2026-88877

creationtimestamp| type| source ---|---|--- 2026-09-10 13:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv66zhoooq22 2026-09-10 16:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gqixwi22j 2026-09-15 06:37:07+00:00| seen|...

CVE-2026-88888

A flaw was found in Renovate. Attackers can exploit a command injection vulnerability in the Mix manager by injecting shell metacharacters through malicious package names when processing private dependencies with unescaped organization parameters. This allows for the execution of arbitrary comman...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

DEBIAN-CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-87803

creationtimestamp| type| source ---|---|--- 2026-09-10 11:45:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5m6nq6fpltjui...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

EUVD-2026-75397

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

CVE-2026-88859 is a flaw in the Evolution email client where a remote attacker can send a crafted HTML email containing a spoofed vCard control . When the victim clicks it, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source , res...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

AIs Compress Exploit Timeline

Give an AI agent a mere rumor of an exploit, and it's enough for them to find it. What's worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumo...

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

PYSEC-2026-3820 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...