PT-2026-86679

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-12757: Improper Control of Generation of Code

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

CVE-2026-86416: Missing Authorization

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86538: Improper Limitation of a Pathname to a Restricted Directory

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...

CVE-2026-82758: Improper Authentication

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82754: Improper Protection of Alternate Path

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86437: Incorrect Authorization

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-86351: URL Redirection to Untrusted Site

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-83534

creationtimestamp| type| source ---|---|--- 2026-09-06 17:53:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hjru5723mgrpw...

CVE-2021-38817

creationtimestamp| type| source ---|---|--- 2026-09-06 15:00:03+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag 2026-09-07 01:00:11+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag...

CVE-2026-19858

creationtimestamp| type| source ---|---|--- 2026-09-06 14:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muu5rh4ejm2v...

CVE-2026-84934

creationtimestamp| type| source ---|---|--- 2026-09-06 12:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mutx2l4nrq22...

CVE-2026-18480

creationtimestamp| type| source ---|---|--- 2026-09-06 11:59:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mutwyrwww62r 2026-09-06 16:01:40+00:00| seen| https://gist.github.com/ichintu/fe47c9308dfcae2743b09006cdd52579...

CVE-2026-86179

creationtimestamp| type| source ---|---|--- 2026-09-06 09:42:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3yxjys4sqd66e...

CVE-2026-86180

creationtimestamp| type| source ---|---|--- 2026-09-06 09:36:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ezbipv4pvvcct...

CVE-2026-86164

creationtimestamp| type| source ---|---|--- 2026-09-06 05:40:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4poraz7h7yiac...

pentest-metasploitable2-lab

Análise de Exploração e Resposta a Incidente — Laboratório Met...

CVE-2026-19283

creationtimestamp| type| source ---|---|--- 2026-09-05 23:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3musliq75y52r 2026-09-06 00:32:10+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3musqkwmryf2r...

CVE-2026-86149

creationtimestamp| type| source ---|---|--- 2026-09-05 22:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muskufwazg22 2026-09-06 00:07:30+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3musp6ta4jo2n...