EUVD-2026-80902

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719

Quickwit through 0.9.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its SQS file sources . The root cause is a failure to validate the host and scheme of the queue_url parameter, allowing an unauthenticated attacker to supply a malicious value via the create-source API and...

CVE-2026-87186

creationtimestamp| type| source ---|---|--- 2026-09-16 02:00:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvm25hjtyc2y 2026-09-16 02:15:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2y5hs3e2w 2026-09-23 08:07:06+00:00| seen|...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299: Missing Authorization

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

PT-2026-93882

Name of the Vulnerable Software and Affected Versions Quickwit versions prior to 0.9.1 Description Insufficient validation of the host and scheme in the queue url parameter within SQS file sources allows an attacker to force the node to send requests to arbitrary internal addresses. By providing ...

Chromium CVE-2026-87629: Incorrect authorization in Sources

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-76461

creationtimestamp| type| source ---|---|--- 2026-09-14 16:34:23+00:00| seen| https://infosec.exchange/ap/users/117202824925377048/statuses/117270349040395789 2026-09-14 16:42:48+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117270391382884208 2026-09-14 17:30:06+00:00| seen|...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: Media: aspeed – Fix the clock handling logic The Video Engine uses eclk and vclk as its clock sources. Its reset control is coupled with eclk, so the current clock enabling sequence works as follows: 1. Enable eclk. 2. De-assert...

Astra Linux – Vulnerability in NTP

In NTP versions prior to 4.2.8p14 and 4.3.x before 4.3.100, remote attackers could exploit this vulnerability to cause a denial of service—resulting in the daemon exiting or the system time being changed. This was possible by predicting the transmit timestamps used in forged packets. The victim w...

Astra Linux – Vulnerability in Containerd

Containerd is a container runtime. A bug was discovered in containerd versions prior to 1.4.8 and 1.5.4, where pulling and extracting a specially crafted container image could result in changes to Unix file permissions for existing files in the host’s filesystem. Changes to file permissions could...

Astra Linux – Vulnerability in Flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Starting from version 0.9.4 and before version 1.10.2, Flatpak has a vulnerability in its “file forwarding” feature, which can be exploited by attackers to gain access to files that would normally...

CVE-2026-90607

creationtimestamp| type| source ---|---|--- 2026-09-14 01:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvgvuaeebq2y 2026-09-14 03:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117267157816858685 2026-09-14 03:00:28+00:00| seen|...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-90769: Server-Side Request Forgery (SSRF)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

Brave Android 1.95.101 Security Fixes

Fix "brave://" URLs opening from external sources as reported on HackerOne by stoletheminerals. Upgraded Chromium to 153.0.8010.37 — refer to Google Chrome advisories for inherited CVEs...

Ivanti Neurons for ITSM deserialization vulnerability (CNVD-2026-37872)

Ivanti Neurons for ITSM is a modern IT Service Management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a deserialization vulnerability, which stems from improper handling of deserialized data from untrusted sources. Attackers can exploit this vulnerability to execute...

data-generation-tool (>=1.0.1, <=1.1.1), openrlhf (>=0.4.0, <=0.4.2) +2 more potentially affected by CVE-2026-9856 via transformers (4.43.3)

transformers PYPI version 4.43.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - data-generation-tool =1.0.1, =0.4.0, =0.0.1, =0.1.1, =0.2.1 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

SUSE CVE-2026-87629

Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. Chromium security severity: Low...

Malicious code in external_deps_enjoyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6 package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather tha...