CVE-2026-89012

creationtimestamp| type| source ---|---|--- 2026-09-12 03:00:04+00:00| seen| https://t.me/GithubRedTeam/102084 2026-09-13 00:00:57+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102084 2026-09-14 03:00:12+00:00| seen| Telegram/dfvCKy19LdeRjtEqhcraGN2yMY0QlrZmHiFOXJRBkeySQpk...

CVE-2026-49992

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-49992 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

EUVD-2026-76753

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-49992 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-49992 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-49992

Kimai , an open-source time tracking application, prior to 2.58.0 , is affected by an authenticated CSRF vulnerability in its default team creation shortcuts. The routes GET /en/admin/project/{id}/create_team, GET /en/admin/customer/{id}/create_team, and GET /en/admin/activity/{id}/create_team pe...

ImpactSword

ImpactSword – Red Team Edition ImpactSword is an offensive se...

CVE-2026-81861

creationtimestamp| type| source ---|---|--- 2026-09-11 04:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/101985 2026-09-12 00:00:54+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/101985 2026-09-14 03:00:15+00:00| seen|...

CVE-2026-49992: Cross-Site Request Forgery (CSRF)

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

ImpactThe API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. Patches https://github.com/WeblateOrg/weblate/pull/19970 ReferencesParts of this issue were independently reported...

CVE-2026-72815

creationtimestamp| type| source ---|---|--- 2026-09-10 04:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/101882 2026-09-10 05:00:05+00:00| published-proof-of-concept| Telegram/gOw7ciMZOTUWYNYtqA2ln1nEEiajeumMwU7KLhL3ORvBRlQ 2026-09-11 00:00:52+00:00| published-proof-of-concep...

Empire v7.0.2

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

CVE-2026-62201

creationtimestamp| type| source ---|---|--- 2026-09-09 10:00:06+00:00| seen| https://t.me/GithubRedTeam/101779 2026-09-09 16:00:06+00:00| seen| Telegram/6CB9q72mBhsjQjI1J7xmJKbYDVj36uzEd2SQzSzeH690k 2026-09-10 00:00:34+00:00| published-proof-of-concept|...

CVE-2026-13184

creationtimestamp| type| source ---|---|--- 2026-09-09 05:00:07+00:00| seen| https://t.me/GithubRedTeam/101482 2026-09-10 00:00:49+00:00| seen| https://t.me/GithubRedTeam/101482...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073357)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073357 advisory. In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053341 advisory. In the Linux kernel, the following vulnerability has been resolved: team: Move team device type change at the end of teamportadd Attempting to add a port device that...

SUSE CVE-2026-6689

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation the check was only applied on update/patch, which allows an authenticated user holding...

SUSE CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-84806

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...