{"vulnerability": "CVE-2026-9112", "sightings": [{"uuid": "9a8bf907-dde5-44ab-ae26-3d354a2fcd41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9112", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmfxdiiuzn2h", "content": "\ud83d\udccc CVE-2026-9112 - Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a c... https://www.cyberhub.blog/cves/CVE-2026-9112", "creation_timestamp": "2026-05-22T03:08:20.198715Z"}, {"uuid": "1dff7459-e8a5-4cfb-bfd0-185675106686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-9112", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260526", "content": "", "creation_timestamp": "2026-05-25T18:00:00.000000Z"}, {"uuid": "a2bdb876-caed-442a-bdff-32f152c5a2c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-9112", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260527", "content": "", "creation_timestamp": "2026-05-26T18:00:00.000000Z"}, {"uuid": "c596250d-7615-4834-bd64-ee77582596d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91127", "type": "seen", "source": "https://gist.github.com/alon710/bf97988f1160e11a1fe815e1134e8b70", "content": "# CVE-2026-91127: CVE-2026-91127: DOM Cross-Site Scripting via Unsafe Hyperlink Schemes in Flyfish File Viewer Legacy DOC Renderer\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91127\n\n## Summary\nThis report details CVE-2026-91127 (GHSA-3753-m2x2-q623), a high-severity DOM Cross-Site Scripting (DOM XSS) vulnerability in the file-viewer workspace developed by flyfish-dev. The legacy Word document (.doc) parser fails to restrict hyperlink URI schemes when rendering extracted document targets into generated HTML. As a result, a remote attacker can construct a malicious legacy DOC file containing scripts inside hyperlink properties. When a user previews the file and clicks the hyperlink, arbitrary JavaScript executes in the context of the hosting origin, enabling session hijacking, credential theft, or unauthorized API interaction.\n\n## TL;DR\nThe legacy DOC file parser in Flyfish File Viewer fails to sanitize hyperlink schemes before injecting them into anchor tags. Under typical execution flows, an attacker can embed malicious javascript: or vbscript: URIs into document links, executing arbitrary script in the host application's origin upon user click. This high-severity flaw (CVSS 8.2) is remediated in package versions starting with @file-viewer/doc 2.3.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79, CWE-83\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: DOM Cross-Site Scripting (DOM XSS)\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- flyfish-dev file-viewer (workspace integration)\n- @file-viewer/doc\n- msdoc-viewer\n- @file-viewer/renderer-word\n- @file-viewer/preset-all\n- @file-viewer/preset-office\n- @file-viewer/vue3-full\n- @file-viewer/react-full\n- @file-viewer/web-full\n- **@file-viewer/doc**: < 2.3.1 (Fixed in: `2.3.1`)\n- **msdoc-viewer**: < 0.2.2 (Fixed in: `0.2.2`)\n- **@file-viewer/renderer-word**: < 2.3.2 (Fixed in: `2.3.2`)\n- **@file-viewer/preset-all**: < 2.3.4 (Fixed in: `2.3.4`)\n\n## Mitigation\n\n- Upgrade @file-viewer/doc to 2.3.1 or higher\n- Implement strict Content Security Policy (CSP) blocking inline execution\n- Restrict or disable preview options for legacy .doc formats, allowing download-only access.\n\n**Remediation Steps:**\n1. Identify all occurrences of flyfish-dev viewer packages in workspace dependencies.\n2. Run `pnpm add @file-viewer/vue3-full@2.3.4` or the corresponding package target.\n3. Validate dependencies lockfile to confirm no nested packages use vulnerable versions.\n4. Deploy strict CSP headers targeting host origins.\n\n## References\n\n- [NVD Detail page](https://nvd.nist.gov/vuln/detail/CVE-2026-91127)\n- [GitHub Security Advisory GHSA-3753-m2x2-q623](https://github.com/flyfish-dev/file-viewer/security/advisories/GHSA-3753-m2x2-q623)\n- [CVE.org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-91127)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91127) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T07:32:11.908608Z"}, {"uuid": "30978f45-81db-49af-83d7-7ed924881936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91129", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/24c3ejk3m5ej4", "content": "CVE-2026-91129 - Home Assistant: mDNS Server-Side Request Forgery\nCVE ID : CVE-2026-91129\n \n Published : Sept. 22, 2026, 7:05 p.m. | 23\u00a0minutes ago\n \n Description : Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, ...", "creation_timestamp": "2026-09-22T20:22:52.270564Z"}, {"uuid": "278ae062-824b-4b32-84ed-021a799448be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91129", "type": "seen", "source": "https://gist.github.com/alon710/514237596aac504f5f1548b022761aec", "content": "# CVE-2026-91129: CVE-2026-91129: Server-Side Request Forgery in Home Assistant Core IPP Integration\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91129\n\n## Summary\nHome Assistant Core prior to version 2026.2.3 is vulnerable to Server-Side Request Forgery (SSRF) via the IPP integration's auto-discovery mechanism. Unauthenticated mDNS advertisements can trigger HTTP requests that follow malicious redirects to loopback interfaces.\n\n## TL;DR\nAn unauthenticated adjacent attacker can exploit the IPP auto-discovery mechanism in Home Assistant Core to conduct SSRF attacks, potentially accessing local loopback interfaces or internal services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Adjacent Network (AV:A)\n- **CVSS Score**: 5.4\n- **EPSS Score**: N/A (Pending)\n- **Impact**: Confidentiality and Integrity Bypass via SSRF\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Home Assistant Core prior to 2026.2.3\n- Home Assistant Green installations prior to core update 2026.2.3\n- Any Home Assistant deployment utilizing the IPP auto-discovery integration\n- **Core**: < 2026.2.3 (Fixed in: `2026.2.3`)\n\n## Mitigation\n\n- Upgrade Home Assistant Core to 2026.2.3 or newer\n- Segment IoT devices onto an isolated VLAN\n- Disable mDNS reflection between untrusted networks and the Home Assistant network\n\n**Remediation Steps:**\n1. Identify the current running Home Assistant version.\n2. Navigate to Settings -> System -> Updates.\n3. Select the update to version 2026.2.3 or newer and apply it.\n4. Verify that the IPP integration is operating securely and no unauthorized mDNS entries are processed.\n\n## References\n\n- [Home Assistant Core GHSA](https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3)\n- [Home Assistant Core PR 162941](https://github.com/home-assistant/core/pull/162941)\n- [CVE Record CVE-2026-91129](https://www.cve.org/CVERecord?id=CVE-2026-91129)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91129) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T22:31:58.914669Z"}, {"uuid": "4d0a9d8b-9d8d-45f2-89bf-bb0c578720ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-91129", "type": "published-proof-of-concept", "source": "https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3", "content": "", "creation_timestamp": "2026-09-22T22:35:04.491320Z"}, {"uuid": "64ac3ffa-7793-4982-9452-139b7d8c7a8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91122", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i5l47v6t4uezw", "content": "CVE-2026-91122 - Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users\nCVE ID : CVE-2026-91122\n \n Published : 24 septembre 2026 17:17 | 21\u00a0minutes ago\n \n Description : Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 20...", "creation_timestamp": "2026-09-24T18:46:58.340114Z"}]}