CVE-2023-54398: Deserialization of Untrusted Data

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...

CVE-2026-58200: Improper Verification of Cryptographic Signature

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-52825: Improper Authorization

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-44300: Improper Input Validation

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-55864: Server-Side Request Forgery (SSRF)

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-91984: Authorization Bypass Through User-Controlled Key

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91146

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-82435

creationtimestamp| type| source ---|---|--- 2026-09-14 21:30:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvj2lpjrjs25...

CVE-2026-75030

creationtimestamp| type| source ---|---|--- 2026-09-14 21:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvizhu6c5l24...

CVE-2026-65838

creationtimestamp| type| source ---|---|--- 2026-09-14 21:01:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mviyy5okkd2m...

CVE-2026-73496

creationtimestamp| type| source ---|---|--- 2026-09-14 21:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mviyxvwudy2b 2026-09-18 12:00:05+00:00| published-proof-of-concept| https://t.me/bdufstecru/3465 2026-09-19 00:00:37+00:00| published-proof-of-concept|...

CVE-2026-73370

creationtimestamp| type| source ---|---|--- 2026-09-14 21:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviyvyv53c24...

CVE-2024-58383

creationtimestamp| type| source ---|---|--- 2026-09-14 19:58:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvivhexoih2e...

CVE-2026-78299

creationtimestamp| type| source ---|---|--- 2026-09-14 19:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviugwhbwb2n...

CVE-2026-78330

creationtimestamp| type| source ---|---|--- 2026-09-14 19:30:20+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvituzizet2t 2026-09-15 04:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/117273174374332264 2026-09-15 04:30:33+00:00| seen|...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking online via Zoom at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET. I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conference runs September 30–October 1, 2026; the time of my talk i...

CVE-2026-90946

creationtimestamp| type| source ---|---|--- 2026-09-14 19:02:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvisd6gaee2m...

CVE-2026-59178

creationtimestamp| type| source ---|---|--- 2026-09-14 18:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvirnn6qjc2j 2026-09-14 19:32:08+00:00| seen| https://gist.github.com/alon710/3693f8803a657bff4ffb362747901533 2026-09-14 20:00:44+00:00| seen|...

OESA-2026-3723 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privilege...

CVE-2026-59569

creationtimestamp| type| source ---|---|--- 2026-09-14 16:05:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6zfkww6wjfg5h 2026-09-21 12:10:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117308957574042512 2026-09-21 12:20:05+00:00| seen|...