CVE-2026-54546 CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

CVE-classification

CVE-classification This project was created to...

vader

VADER：用于漏洞评估、检测、解释和修复的人工评估基准 官方 GitHub 仓库：https://github.com/AfterQuery/vader Hugging Face 数据集：https://huggingface.co/datasets/AfterQuery/vader VADER 是一个人工评估基准 ，旨在衡量大型语言模型（LLMs）处理真实世界软件漏洞的能力。它包含 174 个真实世界漏洞案例 （从开源仓库中精选），涵盖四项任务： 漏洞识别与分类（CWE） 根因解释 补丁（修复） 测试计划生成 这些案例涵盖 15+ 编程语言 （例如...

CVE-2026-91001

creationtimestamp| type| source ---|---|--- 2026-09-14 15:49:20+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117270181306657011 2026-09-15 06:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117273527976059635 2026-09-15 06:00:29+00:00| seen|...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device, the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the ‘FLOWBLOCKUNBIND’...

Evaluating the NIST Bugs Framework against CWE As a Successor for Automated Vulnerability Classification

Vulnerability classification based on root cause weaknesses is essential for numerous cybersecurity activities, where the Common Weakness Enumeration CWE serves as a public repository of such flaws. However, its overlapping entries create a non-orthogonal structure. The result is the same...

CVE-2026-90770

creationtimestamp| type| source ---|---|--- 2026-09-13 11:46:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ehr4tttpuqdpm 2026-09-13 12:02:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfkgnabxv2b 2026-09-15 04:50:05+00:00| seen|...

CVE-2026-87759

creationtimestamp| type| source ---|---|--- 2026-09-12 07:30:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117256894812339509 2026-09-12 07:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mvckqembwm24 2026-09-12 18:00:26+00:00| seen|...

CVE-2026-18061

creationtimestamp| type| source ---|---|--- 2026-09-11 18:02:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2o3loai2phvut...

EUVD-2026-76123

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2026-88056

creationtimestamp| type| source ---|---|--- 2026-09-10 21:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6xm5stpu2f 2026-09-10 22:35:16+00:00| published-proof-of-concept| https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4...

CVE-2026-19651

creationtimestamp| type| source ---|---|--- 2026-09-09 04:25:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mv2oyduhsy2t...

CVE-2026-66816

creationtimestamp| type| source ---|---|--- 2026-09-08 20:18:19+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0350 2026-09-08 22:03:25+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:00:40+00:00| seen|...

CVE-2026-65669

creationtimestamp| type| source ---|---|--- 2026-09-08 20:08:41+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muztak4iaf2f 2026-09-08 20:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muzuynrzg52y 2026-09-08 22:00:55+00:00| seen|...

log-horizon v0.9.0

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI

Agentic AI systems with persistent memory introduce a distinct attack surface known as memory poisoning, in which adversarially crafted content is stored in long-term memory and subsequently influences future agent behavior. Such attacks can suppress security alerts, facilitate privilege...

CVE-2026-82757

CVE-2026-82757 is a Server-Side Request Forgery (SSRF) vulnerability in the Elixir package ash_authentication_oauth2_server , affecting versions from 0.3.0 before 0.3.1. The flaw resides in the public_ip?/1 function of AshAuthentication.Oauth2Server.CIMD.ReqFetcher, which incorrectly classifies I...

CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

CVE-2026-84968

creationtimestamp| type| source ---|---|--- 2026-09-07 13:15:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muwlooa74k2r...

PT-2026-86937

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...