{"vulnerability": "CVE-2026-9077", "sightings": [{"uuid": "21d2b37a-8e7e-4460-883f-f30148967ced", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9077", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mse4aiafpl2x", "content": "\ud83d\udfe0 CVE-2026-9077 - High (8.5)\n\nIBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass lo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9077/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T18:00:45.891036Z"}, {"uuid": "75022990-0209-4498-9baf-2b8658f020d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9077", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3rfvjndj5taqu", "content": "CVE-2026-9077 - Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features\nCVE ID : CVE-2026-9077\n \n Published : Aug. 5, 2026, 5:16 p.m. | 33\u00a0minutes ago\n \n Description : IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote a...", "creation_timestamp": "2026-08-05T18:20:15.040687Z"}, {"uuid": "305f36eb-44ba-4dd9-baf7-92074eac5d3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9077", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msitht5ke22o", "content": "\ud83d\udccc CVE-2026-9077 - IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP ser... https://www.cyberhub.blog/cves/CVE-2026-9077", "creation_timestamp": "2026-08-07T15:07:06.842307Z"}, {"uuid": "ce0f1538-5187-42f4-88a7-9104e36a8c2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9077", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3msithuhl4t2i", "content": "\ud83d\udccc CVE-2026-9077 - IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP ser... https://www.potatohub.blog/cves/CVE-2026-9077", "creation_timestamp": "2026-08-07T15:07:08.047995Z"}, {"uuid": "3123fc62-d120-4bd3-b556-d6deed91e2d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90772", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ey6j7kk7xxcr5", "content": "CVE-2026-90772 - Amundsen Frontend through 4.3.0 Stored XSS via Description\nCVE ID : CVE-2026-90772\n \n Published : Sept. 13, 2026, 11:17 a.m. | 13\u00a0minutes ago\n \n Description : Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySe...", "creation_timestamp": "2026-09-13T11:40:08.546833Z"}, {"uuid": "16efb1ff-e8cc-41bf-b1e0-294f2b84a2fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90770", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ehr4tttpuqdpm", "content": "CVE-2026-90770 - Spug through 3.4.0 Remote Code Execution via ping_check\nCVE ID : CVE-2026-90770\n \n Published : Sept. 13, 2026, 11:17 a.m. | 13\u00a0minutes ago\n \n Description : Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interp...", "creation_timestamp": "2026-09-13T11:46:10.222005Z"}, {"uuid": "3db8930a-db2a-488c-989d-d71d179a0fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90774", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2gs2u2aklsg27", "content": "CVE-2026-90774 - rustypaste before 0.18.1 Path Traversal via filename header\nCVE ID : CVE-2026-90774\n \n Published : Sept. 13, 2026, 11:17 a.m. | 13\u00a0minutes ago\n \n Description : rustypaste before 0.18.1 validates the destination path before applying the optional custom filename...", "creation_timestamp": "2026-09-13T12:00:09.968850Z"}, {"uuid": "52943bf9-08d3-4444-810c-236c75f37f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90774", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfkdygqd72z", "content": "\ud83d\udfe0 CVE-2026-90774 - High (7.5)\n\nrustypaste before 0.18.1 validates the destination path before applying the optional custom filen...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90774/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T12:01:31.215086Z"}, {"uuid": "873d6c60-1131-40d8-bef0-e93a456c4957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90770", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfkgnabxv2b", "content": "\ud83d\udfe0 CVE-2026-90770 - High (8.8)\n\nSpug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90770/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T12:02:59.962591Z"}, {"uuid": "7071a402-ab5b-4885-b196-753fb13e9586", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90772", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfkgugkaq2s", "content": "\ud83d\udfe0 CVE-2026-90772 - High (7.6)\n\nAmundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerous...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90772/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T12:03:07.579499Z"}, {"uuid": "62ffd6c6-20b4-4a17-ac1e-b7ed7980dc6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90772", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvfkgvzelq26", "content": "\ud83d\udfe0 CVE-2026-90772 - High (7.6)\n\nAmundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerous...\n\nhttps://www.themasherwire.com/vulnerability/CVE-2026-90772/\n\n#infosec #potatosecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T12:03:08.213953Z"}, {"uuid": "1c75258f-b96b-44c8-a6c9-3e744b615fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90776", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfnnujqog2o", "content": "\ud83d\udfe0 CVE-2026-90776 - High (7.5)\n\nNodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90776/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T13:00:43.959274Z"}, {"uuid": "7c850f93-df67-41d8-87fa-927600d53ff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90777", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfno3rry22b", "content": "\ud83d\udfe0 CVE-2026-90777 - High (8.8)\n\nESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90777/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T13:00:51.026097Z"}, {"uuid": "b4b1330f-bfba-430f-9d93-a8a77326af6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90778", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfnphjnbc2k", "content": "\ud83d\udfe0 CVE-2026-90778 - High (7.5)\n\nSIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when proce...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90778/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T13:01:39.015311Z"}, {"uuid": "025140f2-a489-4db3-b089-71026819b91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90779", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfnppg5dg24", "content": "\ud83d\udfe0 CVE-2026-90779 - High (7.5)\n\nSIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when proc...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90779/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T13:01:52.635089Z"}, {"uuid": "02123b6e-00db-41ee-b0f9-0897c3213938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90775", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117263972638075018", "content": "CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (\u22643.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending \u2014 monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90775-out-of-bounds-read-in-postgis-addressstandardizer-b09887107f7082c5 #OffSeq #PostGIS #Vuln", "creation_timestamp": "2026-09-13T13:30:23.844528Z"}, {"uuid": "76b22b06-ce23-4d7c-ae45-77190fadf4b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90775", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvfpcyijdd2a", "content": "PostGIS address_standardizer \u22643.7.0 hit by HIGH severity out-of-bounds read (CVE-2026-90775). Can cause PostgreSQL backend crash & cluster session loss. Patch status unconfirmed \u2014 monitor vendor. https://radar.offseq.com/threat/cve-2026-90775-out-of-bounds-read-in-postgis-addressstandardizer-b098...", "creation_timestamp": "2026-09-13T13:30:25.581897Z"}, {"uuid": "7dd0d900-3cdd-44f9-aefc-fdb58b9a77af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90776", "type": "seen", "source": "https://gist.github.com/ichintu/ccd66f14a97ed0726d9247eeed3e2e87", "content": "This update covers two high-severity vulnerabilities and a career guidance request:\n\n* **CVE-2026-90776 (8.7/HIGH):** Affects Nodemailer 9.1.0\u201310.0.4. Inefficient quadratic parsing of email headers can trigger CPU exhaustion and Denial of Service.\n* **CVE-2026-90510 (8.3/HIGH):** Impacts dromara orion-visor \u22642.5.7 due to a hard-coded encryption key. The flaw is remotely exploitable with a public exploit available; the vendor has not responded.\n* **Career Request:** A 22-year-old IT graduate from Asia pursuing a US cybersecurity MS seeks feedback on a SOC analyst learning roadmap (SIEM/SOAR, MITRE/NIST frameworks, Wireshark/Nessus, and certifications) and advice on navigating the OPT job market, securing remote roles, and obtaining employer visa sponsorship.", "creation_timestamp": "2026-09-13T16:50:43.336700Z"}, {"uuid": "c29133a4-e068-443e-a1ec-03366b9e6277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90777", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvhdbg2xk22r", "content": "CVE-2026-90777 - espnet\nESPnet versions released before September 2026 can execute harmful code if they load a specially crafted model checkpoint file. This happens because the program trusts the contents of those\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#espnet #CVE #infosec", "creation_timestamp": "2026-09-14T05:00:06.838096Z"}, {"uuid": "0e6e058e-d572-4185-98b1-7077ae75685d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90770", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvjt6fnnrw2w", "content": "CVE-2026-90770 - spug\nThe Spug application up to version 3.4.0 lets users who can monitor systems send specially crafted data that is placed straight into a command line. This can let a malicious user run any\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#spug #openspug #CVE #infosec", "creation_timestamp": "2026-09-15T04:50:05.070473Z"}, {"uuid": "85e79ec1-7c1f-4c83-ab97-a9ee8f4dae60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90770", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfhuljr23", "content": "Spug CVE-2026-90770 (CVSS 8.8) allows authenticated monitor users to inject shell commands via ping_check \u2014 upgrade past 3.4.0 or restrict monitor creation. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:26:45.180626Z"}, {"uuid": "994f23ba-72bb-40a5-9d4d-8b08dc21f504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90777", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmgp4f722l", "content": "Trend: multiple parsing and deserialisation flaws (CVE-2026-90777, CVE-2026-90783, CVE-2026-90776) show untrusted artefacts can RCE or DoS developer pipelines. Sandbox ingestion and patch dependencies. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:27:26.527703Z"}, {"uuid": "2ff5cf21-7be3-4332-8bf8-173b136ab5c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90776", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmgp4f722l", "content": "Trend: multiple parsing and deserialisation flaws (CVE-2026-90777, CVE-2026-90783, CVE-2026-90776) show untrusted artefacts can RCE or DoS developer pipelines. Sandbox ingestion and patch dependencies. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:27:26.631207Z"}, {"uuid": "d5173a1f-1d9c-4503-a34f-008fb55dc229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90776", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3458", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 addressparser \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0438\u0441\u0435\u043c Nodemailer \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-14613\nCVE-2026-90776\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/nodemailer/nodemailer/releases/tag/v10.0.5", "creation_timestamp": "2026-09-16T16:00:03.502070Z"}, {"uuid": "9c7f715a-63c9-424c-97bd-9140c2adfc00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90779", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvwvfozapp24", "content": "sipp: fix CVE-2026-90780 CVE-2026-90779 CVE-2026-90778\n\nhttps://github.com/NixOS/nixpkgs/pull/563981\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-2589\n\n#security", "creation_timestamp": "2026-09-20T09:34:34.422765Z"}, {"uuid": "e594bc61-f7a8-405c-91fc-eade47bf830e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90778", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvwvfozapp24", "content": "sipp: fix CVE-2026-90780 CVE-2026-90779 CVE-2026-90778\n\nhttps://github.com/NixOS/nixpkgs/pull/563981\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-2589\n\n#security", "creation_timestamp": "2026-09-20T09:34:34.470416Z"}, {"uuid": "683a42cc-2c67-4da0-966d-4a367851e27f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90779", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvx64n37o22o", "content": "[Backport release-26.05] sipp: fix CVE-2026-90780 CVE-2026-90779 CVE-2026-90778\n\nhttps://github.com/NixOS/nixpkgs/pull/565177\n\n#security", "creation_timestamp": "2026-09-20T12:10:33.910285Z"}, {"uuid": "8c5ae764-da29-45ea-8a79-3b74ca673c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90778", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvx64n37o22o", "content": "[Backport release-26.05] sipp: fix CVE-2026-90780 CVE-2026-90779 CVE-2026-90778\n\nhttps://github.com/NixOS/nixpkgs/pull/565177\n\n#security", "creation_timestamp": "2026-09-20T12:10:33.958877Z"}]}