CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...

CVE-2026-85702

creationtimestamp| type| source ---|---|--- 2026-09-04 21:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j74zbtuplef5k 2026-09-09 08:40:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv35a2rqrj2g 2026-09-09 08:40:15+00:00| seen|...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

CVE-2026-85786

creationtimestamp| type| source ---|---|--- 2026-09-04 21:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupuci4ugc22 2026-09-10 02:40:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv4zmdvnk22b 2026-09-10 02:40:41+00:00| seen|...

CVE-2026-80119

creationtimestamp| type| source ---|---|--- 2026-09-04 20:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqxskiz62g 2026-09-10 04:20:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv577dvbel2x 2026-09-10 04:20:47+00:00| seen|...

CVE-2026-80116

creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwnrtul2v 2026-09-09 04:40:31+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv2ptqiwjx2b 2026-09-09 04:40:32+00:00| seen|...

CVE-2026-80114

creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwgw4gw2g 2026-09-09 07:10:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117239827757083424 2026-09-09 07:10:13+00:00| seen|...

WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability

Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...

CVE-2026-18175

creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkainfhn2z 2026-09-09 22:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4kdac7kj2p...

CVE-2026-19274

creationtimestamp| type| source ---|---|--- 2026-09-04 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupijajral2w 2026-09-04 18:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupknjyxry22 2026-09-05 23:01:21+00:00| seen|...

CVE-2026-18149

creationtimestamp| type| source ---|---|--- 2026-09-04 17:24:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w 2026-09-29 23:30:32+00:00| seen| https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5 2026-09-30 12:01:15+00:00| seen|...

CVE-2026-18540

creationtimestamp| type| source ---|---|--- 2026-09-04 17:17:57+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muphtit3ps2w 2026-09-30 12:01:11+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcb3dlkw2b...

CVE-2026-84890

creationtimestamp| type| source ---|---|--- 2026-09-04 17:06:12+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muph6jb6xk2w 2026-09-12 08:40:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117257168610414149 2026-09-12 08:50:03+00:00| seen|...

CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85014

creationtimestamp| type| source ---|---|--- 2026-09-04 16:32:16+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupfbsvqe22w 2026-09-30 12:01:21+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcbehg3c2q...

CVE-2026-85024

creationtimestamp| type| source ---|---|--- 2026-09-04 16:24:24+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupetrfbmk2w 2026-09-28 23:30:32+00:00| seen| https://gist.github.com/alon710/ffd73e42aa4d7534770f3c09713af03e 2026-09-29 12:01:27+00:00| seen|...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...