PT-2026-85331

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

PT-2026-85386

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host...

CVE-2026-85085: Improper Verification of Source of a Communication Channel

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...

PT-2026-89188

Уязвимость прикладного программного интерфейса программных платформ для разработки и управления онлайн магазинами Magento Open Source, Adobe Commerce и Adobe Commerce B2B связана с непринятием мер по нейтрализации специальных элементов в механизме создания шаблонов. Эксплуатация уязвимости может...

PT-2026-86946

Уязвимость прикладного программного интерфейса программных платформ для разработки и управления онлайн магазинами Magento Open Source, Adobe Commerce и Adobe Commerce B2B связана с непринятием мер по нейтрализации специальных элементов в механизме создания шаблонов. Эксплуатация уязвимости может...

CVE-2026-85378

creationtimestamp| type| source ---|---|--- 2026-09-03 23:44:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2dalamshcy3eo...

CVE-2026-85435

creationtimestamp| type| source ---|---|--- 2026-09-03 23:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munmpxrwsz2y 2026-09-04 00:09:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munoeb3ll32o 2026-09-04 00:10:48+00:00| seen|...

CVE-2026-62916

creationtimestamp| type| source ---|---|--- 2026-09-03 23:36:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fib4rqqx4kk3b 2026-09-04 00:07:41+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munobcp2og2t 2026-09-04 01:30:06+00:00| seen|...

CVE-2026-85433

creationtimestamp| type| source ---|---|--- 2026-09-03 23:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munm643azs2p 2026-09-04 00:09:02+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munodpif7422...

CVE-2026-85432

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-49509

CVE-2026-49509 is an out-of-bounds read vulnerability in Samsung Opensource Escargot , a JavaScript engine, that allows overread of buffers. The affected commit is 25648aef19187b3f87f4d9420b8d761453ad4630. The CNA-assigned CVSS 3.1 score is 4.4 (MEDIUM) , with a local attack vector, low complexit...

CVE-2026-64197

creationtimestamp| type| source ---|---|--- 2026-09-03 23:01:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munkld3kwi2i...

CVE-2026-85223

creationtimestamp| type| source ---|---|--- 2026-09-03 22:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gya6xuyqcakrm 2026-09-03 23:01:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munkkvrh6q2c 2026-09-04 11:08:57+00:00| seen|...

CVE-2026-64200

creationtimestamp| type| source ---|---|--- 2026-09-03 22:39:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4ctwqq7rjfos7 2026-09-03 23:02:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munkmxz2dk2l...

CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-85432

MOOS core-moos through 10.4.0, an underwater robotics middleware, contains a message source spoofing flaw in its MOOSDB message processing layer. The root cause is a failure to validate client identity: the system trusts wire-supplied source identifiers in serialized messages rather than the auth...

CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-85431 MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection

MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source an...

CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-85429 MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Spoofing

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODEMESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...