CVE-2026-52769

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

CVE-2026-85654

creationtimestamp| type| source ---|---|--- 2026-09-04 22:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupxnu7m6m2m 2026-09-08 18:30:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3muznq5uzq42v 2026-09-08 18:30:05+00:00| seen|...

CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...

CVE-2026-85702

creationtimestamp| type| source ---|---|--- 2026-09-04 21:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j74zbtuplef5k 2026-09-09 08:40:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv35a2rqrj2g 2026-09-09 08:40:15+00:00| seen|...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

CVE-2026-85786

creationtimestamp| type| source ---|---|--- 2026-09-04 21:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupuci4ugc22 2026-09-10 02:40:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv4zmdvnk22b 2026-09-10 02:40:41+00:00| seen|...

CVE-2026-80119

creationtimestamp| type| source ---|---|--- 2026-09-04 20:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqxskiz62g 2026-09-10 04:20:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv577dvbel2x 2026-09-10 04:20:47+00:00| seen|...

CVE-2026-80116

creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwnrtul2v 2026-09-09 04:40:31+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv2ptqiwjx2b 2026-09-09 04:40:32+00:00| seen|...

CVE-2026-80114

creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwgw4gw2g 2026-09-09 07:10:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117239827757083424 2026-09-09 07:10:13+00:00| seen|...

WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability

Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...

CVE-2026-18175

creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkainfhn2z 2026-09-09 22:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4kdac7kj2p...

CVE-2026-19274

creationtimestamp| type| source ---|---|--- 2026-09-04 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupijajral2w 2026-09-04 18:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupknjyxry22 2026-09-05 23:01:21+00:00| seen|...

CVE-2026-18149

creationtimestamp| type| source ---|---|--- 2026-09-04 17:24:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w 2026-09-29 23:30:32+00:00| seen| https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5 2026-09-30 12:01:15+00:00| seen|...

CVE-2026-18540

creationtimestamp| type| source ---|---|--- 2026-09-04 17:17:57+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muphtit3ps2w 2026-09-30 12:01:11+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcb3dlkw2b...

CVE-2026-84890

creationtimestamp| type| source ---|---|--- 2026-09-04 17:06:12+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3muph6jb6xk2w 2026-09-12 08:40:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117257168610414149 2026-09-12 08:50:03+00:00| seen|...

CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...