CVE-2026-85691: Server-Side Request Forgery (SSRF)

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

EUVD-2026-71768

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

PT-2026-86257

An authenticated remote code execution RCE vulnerability in the admin config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-79423

A remote code execution (RCE) vulnerability exists in the admin_config.php component of seacms v13.6 . The flaw allows an authenticated attacker to execute arbitrary code by sending a crafted POST request . This vulnerability is characterized as an Improper Neutralization of Special Elements used...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-86091: Missing Authorization

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

CVE-2026-86090: Missing Authorization

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-85434

creationtimestamp| type| source ---|---|--- 2026-09-03 23:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munmpvwqbt2w 2026-09-04 00:09:12+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munodzancc2b...

CVE-2026-85430

creationtimestamp| type| source ---|---|--- 2026-09-03 23:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munm62oo6t2o...

CVE-2026-85426

creationtimestamp| type| source ---|---|--- 2026-09-03 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munlm6b7vw2l 2026-09-04 00:08:33+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munocujoyo2t...

CVE-2026-85425

creationtimestamp| type| source ---|---|--- 2026-09-03 23:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munl2dit722y 2026-09-04 00:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munocmhb522b...

CVE-2026-85424

creationtimestamp| type| source ---|---|--- 2026-09-03 23:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munl2bwa3a2w 2026-09-04 00:08:15+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munocdsfxt2w...

CVE-2026-85061

creationtimestamp| type| source ---|---|--- 2026-09-03 21:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mundrvolze2g 2026-09-03 22:08:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munhm3g2gz2g 2026-09-04 07:27:07+00:00| seen|...

CVE-2026-84851

creationtimestamp| type| source ---|---|--- 2026-09-03 20:32:41+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3muncauor4z2o...

CVE-2026-85388

creationtimestamp| type| source ---|---|--- 2026-09-03 20:01:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3munajqqklf2q...

CVE-2026-73711

creationtimestamp| type| source ---|---|--- 2026-09-03 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mun75in5hb23...

CVE-2026-85394

creationtimestamp| type| source ---|---|--- 2026-09-03 19:35:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bds6xdgeayvdp 2026-09-03 20:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munagl6zlt2l 2026-09-03 20:00:57+00:00| seen|...

CVE-2026-82526

creationtimestamp| type| source ---|---|--- 2026-09-03 18:50:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7nqraoi4wx5rc 2026-09-03 19:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mun7unyeuf2o 2026-09-03 20:07:54+00:00| seen|...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...