CVE-2026-86738

creationtimestamp| type| source ---|---|--- 2026-09-08 17:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muzirohpay2s 2026-09-08 17:58:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5cxtp2tqqrxtz 2026-09-08 18:08:22+00:00| seen|...

CVE-2026-86267

creationtimestamp| type| source ---|---|--- 2026-09-07 08:15:12+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86267...

CVE-2026-86265

creationtimestamp| type| source ---|---|--- 2026-09-07 08:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86265...

CVE-2026-86268

creationtimestamp| type| source ---|---|--- 2026-09-07 05:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2zui7f45fntkc 2026-09-07 08:15:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86268...

CVE-2026-86269

creationtimestamp| type| source ---|---|--- 2026-09-07 05:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2ry6clra3wtkl 2026-09-07 08:15:07+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86269...

CVE-2026-86315

creationtimestamp| type| source ---|---|--- 2026-09-07 05:35:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/g4og66twpugy6 2026-09-07 08:15:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86315...

CVE-2026-86426: Improper Authentication

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

EUVD-2026-71777

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the REST v2 delete handlers for notification endpoints and recipients (in endpoints.lua and recipients.lua). An authenticated non-administrator user can issue POST requests to irreversibly delete all configured notification endpoin...

CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-85650

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CGA-58HM-6GFJ-6HRH

Bulletin has no description...

EUVD-2026-71114

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85650

Trigger.dev versions before 4.5.2 contain a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal servi...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

HTSOC

HTSOC — Integrated SOC System for Event Monitoring, Detection, and Investigation HTSOC is a self-built Security Operations Center system in a lab environment. The system combines log collection, detection with Splunk, alert/case management with TheHive, Observable analysis with Cortex, IOC lookup...

PT-2026-89159

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists in the calendar event model within backend/open webui/models/calendar.py where the meta.alert minutes value is stored without type validation. Because the shared upcoming-eve...