CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

EUVD-2026-74847

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...

BIT-ELK-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

GHSA-WVXP-WPWP-MMPW

creationtimestamp| type| source ---|---|--- 2026-09-09 05:00:09+00:00| seen| https://t.me/IntelEncyclopedia/2853 2026-09-10 00:00:46+00:00| seen| https://t.me/IntelEncyclopedia/2853...

CVE-2026-52307

creationtimestamp| type| source ---|---|--- 2026-09-09 04:00:37+00:00| seen| Telegram/nMh3ts5dc8zkSwTaV9m7alIlypUPowc3P5Zcioq1A5ss 2026-09-09 15:05:47+00:00| seen| https://bsky.app/profile/hacker.at.thenote.app/post/3mv3srtbm7225 2026-09-10 00:00:24+00:00| published-proof-of-concept|...

CVE-2026-87657

creationtimestamp| type| source ---|---|--- 2026-09-09 01:52:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/356y2aim7dvwv 2026-09-10 04:46:05+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-16 04:46:27+00:00| seen|...

MAL-2026-16061 Malicious code in @yongot/canary-mcp-isolation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ff9f45262c13bea579ed092cabfb043896d60c89787301b73eef78848802574 package.json declares a postinstall script that runs beacon.js, and index.js also requires beacon.js on load. beacon.js POSTs the installer's...

Malicious code in @yongot/canary-mcp-isolation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ff9f45262c13bea579ed092cabfb043896d60c89787301b73eef78848802574 package.json declares a postinstall script that runs beacon.js, and index.js also requires beacon.js on load. beacon.js POSTs the installer's...

PT-2026-89178

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

PT-2026-88959

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

Linux Distros Unpatched Vulnerability : CVE-2026-82065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent...

PT-2026-89168

Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...

preflight v0.22.0

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...

GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL

Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...

CVE-2026-77487

creationtimestamp| type| source ---|---|--- 2026-09-08 20:18:03+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0350 2026-09-08 22:03:57+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:00:44+00:00| seen|...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73969

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28622

A permissions bypass vulnerability exists in the getQueryBuilderInternal method of MediaProvider.java within the Media Provider component. This flaw allows an attacker to retrieve location metadata , potentially resulting in local information disclosure . The vulnerability requires no additional ...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...