CVE-2026-87470

creationtimestamp| type| source ---|---|--- 2026-09-10 02:00:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4xdvotsq2n 2026-09-10 04:47:43+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 16:07:08+00:00| seen|...

TestRail-files.md5-IAC-scanner

TestRail-files.md5-IAC-scanner Gurock TestRail 7.2.0.3014 미만 버전의 부적절한 접근 제어Improper Access Control로 인해 민감한 정보가 노출되었습니다. 공격자는 Gurock TestRail 애플리케이션의 클라이언트 측에서 /files.md5 파일에 접근하여 애플리케이션 파일 전체 목록과 해당 파일 경로를 확인할 수 있습니다. 해당 파일 경로를 테스트할 수 있으며, 경우에 따라 하드코딩된 자격 증명, API 키 또는 기타 민감한 데이터가 노출될 수 있습니다. 출처:...

CVE-2026-87438

creationtimestamp| type| source ---|---|--- 2026-09-10 00:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4tgmrtns2n 2026-09-10 04:46:31+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 18:37:07+00:00| seen|...

kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

A flaw was found in the Linux kernel's SCSI target subsystem. This vulnerability, a buffer overflow, occurs in the tgptgpmembersshow function when processing long iSCSI IQN names. An attacker could potentially exploit this by providing a specially crafted input, leading to the disclosure of...

CVE-2026-88002

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:06+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6 2026-09-10 02:31:55+00:00| seen| https://gist.github.com/alon710/401536538bb41a7576b21df62b940fb2...

CVE-2026-88001

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:04+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w 2026-09-10 01:32:33+00:00| seen| https://gist.github.com/alon710/855b51c2ea136c7c49beab7d27d1ef40...

PT-2026-89276

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are...

Oracle Linux 8 : ELSA-2026-65832-0: / mrtg (ELSA-2026-658320)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-658320 advisory. 2.17.7-1.1 - Fix CVE-2026-72694: symlink-following chown in PID file handling Resolves: RHEL-236037 Tenable has extracted the preceding description block...

PT-2026-89370

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8739-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8739-1 advisory. It was discovered that ImageMagick incorrectly handled certain images. An attacker could...

PT-2026-89422

Yappp new one for this month 1-3 for September CVE-2026-87807. A good starting point for September. Updates for August 3/4 pulled another one CVE-2026-85715...

Security Updates for Microsoft Outlook Products C2R (September 2026)

The Microsoft Outlook Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. CVE-2026-69629 - Use of uninitialized resource in Microsoft...

CVE-2026-88069

creationtimestamp| type| source ---|---|--- 2026-09-09 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4ofosx6i2t 2026-09-10 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117244154620572346 2026-09-10 01:30:27+00:00| seen|...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-87017 Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that...

GOXLR-malware-family

このリポジトリは当初、goxlr.net で発見されたマルウェアの分析とレポート用のものでした。最近、彼らがさまざまなマルウェア亜種を配信する他のマルウェアドメインも複数運営していたことを発見しました。これまでのところすべてスティーラーで、すべて "goxlr" のクローンです。 そのため、現在は彼らの全ドメインから見つけられるすべてのサンプルをリバースエンジニアリングしています。この GitHub リポジトリが私の情報の中心です。サンプル1と2は goxlr.net から、サンプル3は goxlrapp.com から取得したものです。 C2...

Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. CVE-2026-84639 One byte overflow read in mail parser. CVE-2026-84640 Information disclosure due to malicious IMAP server response. CVE-2026-84641 Calendar invitation attachments could launch local executables. CVE-2026-84637 Allowed UNC hostnames for...

CVE-2026-18147

creationtimestamp| type| source ---|---|--- 2026-09-09 17:30:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gvpjw73fbh6bz 2026-09-09 20:59:01+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mv4gji5m542r...

CVE-2026-80924

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...

CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...