CVE-2026-55864: Server-Side Request Forgery (SSRF)

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

PT-2026-92060

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.3 Description An uncontrolled resource consumption issue exists in the PDFContentScrapingStrategy that allows untrusted clients to cause a denial of service. Attackers can trigger this by selecting the PDF scrapi...

CVE-2026-91941: Uncontrolled Resource Consumption

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-88616: Incorrect Authorization

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

CVE-2026-91750: Server-Side Request Forgery (SSRF)

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-52825: Improper Authorization

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

PT-2026-92420

Summary libp2p-quic can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp2p TLS certificate and delays the final TLS 1.3 handshake fragment until the certificate expires. This is remotely reachable by a network peer and can crash applications exposing a...

CVE-2026-91146

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-82435

creationtimestamp| type| source ---|---|--- 2026-09-14 21:30:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvj2lpjrjs25...

CVE-2026-75030

creationtimestamp| type| source ---|---|--- 2026-09-14 21:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvizhu6c5l24...

CVE-2026-65838

creationtimestamp| type| source ---|---|--- 2026-09-14 21:01:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mviyy5okkd2m...

CVE-2026-73496

creationtimestamp| type| source ---|---|--- 2026-09-14 21:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mviyxvwudy2b 2026-09-18 12:00:05+00:00| published-proof-of-concept| https://t.me/bdufstecru/3465 2026-09-19 00:00:37+00:00| published-proof-of-concept|...

CVE-2026-73370

creationtimestamp| type| source ---|---|--- 2026-09-14 21:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviyvyv53c24...

CVE-2024-58383

creationtimestamp| type| source ---|---|--- 2026-09-14 19:58:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvivhexoih2e...

CVE-2026-78299

creationtimestamp| type| source ---|---|--- 2026-09-14 19:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviugwhbwb2n...

CVE-2026-78330

creationtimestamp| type| source ---|---|--- 2026-09-14 19:30:20+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvituzizet2t 2026-09-15 04:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/117273174374332264 2026-09-15 04:30:33+00:00| seen|...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking online via Zoom at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET. I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conference runs September 30–October 1, 2026; the time of my talk i...

CVE-2026-90946

creationtimestamp| type| source ---|---|--- 2026-09-14 19:02:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvisd6gaee2m...

CVE-2026-59178

creationtimestamp| type| source ---|---|--- 2026-09-14 18:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvirnn6qjc2j 2026-09-14 19:32:08+00:00| seen| https://gist.github.com/alon710/3693f8803a657bff4ffb362747901533 2026-09-14 20:00:44+00:00| seen|...

OESA-2026-3723 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privilege...