CVE-2026-88921

MISP (versions ≤2.5.45) contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, used during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88893

OpenPanel 's share lookup procedures fail to validate access controls, allowing unauthenticated callers who possess a share link to retrieve argon2id password hashes and full report configurations (event names, filters, breakdown dimensions). This enables offline password cracking and theft of bu...

CVE-2026-88893 OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters,...

casc-analys

💜 Что такое CASC-ANAYS? CASC-ANAYS — это модульный аналитиче...

casc-anays

💜 Что такое CASC-ANAYS? CASC-ANAYS — это модульный аналитиче...

CVE-2026-37004

creationtimestamp| type| source ---|---|--- 2026-09-10 12:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv634bqngq2f...

CVE-2026-84828

creationtimestamp| type| source ---|---|--- 2026-09-10 12:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dfxcpbhrx35ue 2026-09-11 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mvai73fffe22...

CVE-2026-8323

creationtimestamp| type| source ---|---|--- 2026-09-10 10:05:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cgolcynnqt54y 2026-09-10 10:08:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv5smfebby2n 2026-09-10 10:20:06+00:00| seen|...

CVE-2026-88285

creationtimestamp| type| source ---|---|--- 2026-09-10 10:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6knaxpydzctnd 2026-09-10 10:07:52+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv5sm2o7xx2n 2026-09-10 10:30:10+00:00| seen|...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

CVE-2026-79941

creationtimestamp| type| source ---|---|--- 2026-09-10 03:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv53suqsbe2y...

Adobe Acrobat Reader DC Annots Report Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

PT-2026-89404

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...

CVE-2026-88893: Exposure of Sensitive Information to an Unauthorized Actor

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters,...

PT-2026-89734

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...

Linux Distros Unpatched Vulnerability : CVE-2026-61909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to anoth...

CVE-2026-87929

creationtimestamp| type| source ---|---|--- 2026-09-09 23:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4nbxmirj25 2026-09-14 15:37:19+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvigutfurb2p...

CVE-2026-75730

creationtimestamp| type| source ---|---|--- 2026-09-09 21:17:58+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4hle6hqx2d...

CVE-2026-86098

creationtimestamp| type| source ---|---|--- 2026-09-09 19:40:16+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv4c4nfww72f 2026-09-09 19:40:22+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117242777798627415...