{"vulnerability": "cve-2026-1003", "sightings": [{"uuid": "6ffe493a-52c1-4039-a8ac-96f5725bf3dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1003", "type": "seen", "source": "https://gist.github.com/Darkcrai86/31070bcecaf6d68688cd91fbdac4075b", "content": "", "creation_timestamp": "2026-01-16T10:19:10.000000Z"}, {"uuid": "1af45aa4-3115-48f5-a7d9-951c0806ba73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1003", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mcjza4yndf2c", "content": "", "creation_timestamp": "2026-01-16T11:39:44.840359Z"}, {"uuid": "c654d00b-482a-4996-a0b9-7578fbd575ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-1003", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mieqr62ze22w", "content": "", "creation_timestamp": "2026-03-31T17:56:04.221442Z"}, {"uuid": "cf50999a-5da9-4f93-985c-6875bcc8aa8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "published-proof-of-concept", "source": "Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxy_XdixQ", "content": "", "creation_timestamp": "2026-08-31T00:00:46.458844Z"}, {"uuid": "b8a29ba8-2a09-4783-acda-535464d73d83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10032", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/j7o7c57m4b5cj", "content": "CVE-2026-10032 - Arbitrary JavaScript Execution via openUrl in @a2ui/web_core\nCVE ID : CVE-2026-10032\n \n Published : Aug. 4, 2026, 3:36 p.m. | 39\u00a0minutes ago\n \n Description : The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() withou...", "creation_timestamp": "2026-08-04T16:48:34.160645Z"}, {"uuid": "a170079a-3592-4bab-8221-a1ad61373eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muaelwjgds25", "content": "CVE-2026-10036\nThe SpeechBrain speech\u2011recognition library before version 1.1.1 can read specially crafted checkpoint description files and unintentionally execute any code the attacker places in them. This means a malicious\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-29T17:10:03.712014Z"}, {"uuid": "4e8cbc69-19d7-47db-a84d-dbeec188d6fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "seen", "source": "Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxy_XdixQ", "content": "", "creation_timestamp": "2026-08-29T23:00:08.950087Z"}, {"uuid": "d4e46d63-56fb-4fe6-afde-5d8faa2efd7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "seen", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-29T23:00:13.904629Z"}, {"uuid": "49d1ff8d-a522-43e5-85cc-1053bd90ce5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10038", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnlg3tfxl72o", "content": "CVE-2026-10038 - Charitable\nCVE ID : CVE-2026-10038\n \n Published : June 6, 2026, 12:16 a.m. | 16\u00a0minutes ago\n \n Description : The Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct ...", "creation_timestamp": "2026-06-06T00:39:46.792998Z"}, {"uuid": "0aef76a9-a769-4315-9cbf-4d4619fa29a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "published-proof-of-concept", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-31T00:00:45.674661Z"}, {"uuid": "db6d3303-cdcb-418e-b212-5b5f517b0b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100100", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10036-speechbrain-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SaiTeja-Erukude\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-28 12:37:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSpeechBrain < 1.1.1 checkpoint metadata RCE via unsafe PyYAML parsing of CKPT.yaml.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-29T00:00:08.572701Z"}, {"uuid": "d8fbba3e-b840-4429-b636-cda479f30d7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10036", "type": "seen", "source": "https://t.me/GithubRedTeam/100100", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10036-speechbrain-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SaiTeja-Erukude\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-28 12:37:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSpeechBrain < 1.1.1 checkpoint metadata RCE via unsafe PyYAML parsing of CKPT.yaml.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-28T16:00:06.784793Z"}, {"uuid": "a15a3bee-6bb2-4bdb-96c5-b2775de82b0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100369", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gawoxc43gzebm", "content": "CVE-2026-100369 - CliInvoke: Argument Injection in Extensibility Runner Factory\nCVE ID : CVE-2026-100369\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invokin...", "creation_timestamp": "2026-09-25T22:07:06.457946Z"}, {"uuid": "c812c416-c34c-4cd2-93d8-ab8f3fdb3bd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100389", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwersu2dai2q", "content": "\ud83d\udea8 CVE-2026-100389 \u2014 CVSS 9.2 CRITICAL\n\nGestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100389\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T22:07:36.643172Z"}, {"uuid": "a6249c83-ae5d-4f34-bada-dffc6662e5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100390", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwert3tkyi2f", "content": "\ud83d\udea8 CVE-2026-100390 \u2014 CVSS 9.1 CRITICAL\n\nZoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when sett...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100390\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T22:07:45.316493Z"}, {"uuid": "68ad9b17-aab7-4b49-862d-a83a855ea4e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100391", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7mcphb2gwcwiu", "content": "CVE-2026-100391 - MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation\nCVE ID : CVE-2026-100391\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulner...", "creation_timestamp": "2026-09-25T22:13:02.786062Z"}, {"uuid": "a34ab75c-dc34-488c-a526-2012c636c72d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100390", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4isgsiugxlflj", "content": "CVE-2026-100390 - Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6\nCVE ID : CVE-2026-100390\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteA...", "creation_timestamp": "2026-09-25T22:19:06.507838Z"}, {"uuid": "23c65c3e-aa72-4e78-bd7e-8ee85e423524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100389", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4y4725iyrjslk", "content": "CVE-2026-100389 - GestSup before 3.2.61 Remote Code Execution via IMAP Attachment\nCVE ID : CVE-2026-100389\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP ...", "creation_timestamp": "2026-09-25T22:25:02.390072Z"}, {"uuid": "d6f689c6-dfc2-4ccc-a55d-b79be8738e5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100387", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7r6kfmvt2qlap", "content": "CVE-2026-100387 - pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization\nCVE ID : CVE-2026-100387\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimen...", "creation_timestamp": "2026-09-25T22:27:02.527381Z"}, {"uuid": "30f06ba1-d6ea-4932-9890-d2e83adfdfb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100382", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117334398532334299", "content": "CVE-2026-100382 (CRITICAL, CVSS 10): Wikimedia Mediawiki ExternalData Extension (<3.7) suffers OS Command Injection. Remote, unauthenticated code execution is possible. Restrict access & monitor systems. Details: https://radar.offseq.com/threat/cve-2026-100382-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-75689d73ee2acd97 #OffSeq #CVE2026100382 #infosec #Mediawiki", "creation_timestamp": "2026-09-26T00:00:37.958876Z"}, {"uuid": "0ba067de-79b1-4d5f-9721-64e7a1dadb80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100382", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwey4y6xt62q", "content": "CVE-2026-100382: CRITICAL OS Command Injection in Mediawiki ExternalData Extension (<3.7). Remote attackers can run arbitrary commands. Restrict access & monitor for signs of compromise. https://radar.offseq.com/threat/cve-2026-100382-cwe-78-improper-neutralization-of-special-elements-used-in-an-...", "creation_timestamp": "2026-09-26T00:00:39.841304Z"}, {"uuid": "6820a426-b2a8-476c-b394-c4541ce49901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100387", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwey7yp7352c", "content": "\ud83d\udfe0 CVE-2026-100387 - High (8.1)\n\npgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100387/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T00:02:21.487964Z"}, {"uuid": "dde59198-f0f2-419a-8ca0-0619759168e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100389", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mweyaa25sv2g", "content": "\ud83d\udfe0 CVE-2026-100389 - High (8.1)\n\nGestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP co...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100389/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T00:02:29.137268Z"}, {"uuid": "a0686ce3-bca9-4e7e-9137-a5ee9d779792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100391", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mweyagy5as2d", "content": "\ud83d\udfe0 CVE-2026-100391 - High (8.2)\n\nMediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100391/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T00:02:36.267456Z"}, {"uuid": "f20f9cf3-89cd-4f99-9711-16f75ac4f961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c", "content": "This daily cyber threat intelligence digest highlights three critical software vulnerabilities, a major legal sentencing, and one non-security community post. Key takeaways:\n\n\u2022 **MediaWiki (CVE-2026-100382):** Critical (CVSS 10.0) unauthenticated RCE via OS command injection in the ExternalData extension (v<3.7).  \n\u2022 **WordPress (AV26-952):** Critical path traversal in page-template resolution enabling conditional RCE in versions <7.1.2. The flaw is actively exploited in the wild and has been added to CISA\u2019s KEV database; immediate patching is required.  \n\u2022 **CliInvoke.Specializations (CVE-2026-100368):** High (CVSS 8.4) command injection in PowerShell/Cmd wrappers caused by improper handling of untrusted arguments containing double quotes. Patched versions and mitigation workarounds are available.  \n\u2022 **Legal/Incident:** A U.S. Army soldier received a 70-month prison sentence and ~$300K in restitution for hacking AT&T and Verizon to steal mobile metadata, impacting over 100 million customers.  \n\u2022 **Non-Technical:** The digest also includes a community event recommendation for a family squid dissection in Tennessee.  \n\n**Overall:** Organizations should prioritize patching MediaWiki, WordPress, and CliInvoke components, while the sentencing underscores ongoing insider threats targeting critical telecom infrastructure.", "creation_timestamp": "2026-09-26T00:00:32.000000Z"}, {"uuid": "47fb435d-e03d-4352-b57c-d606553f40e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c", "content": "This daily cyber threat intelligence digest highlights three critical software vulnerabilities, a major legal sentencing, and one non-security community post. Key takeaways:\n\n\u2022 **MediaWiki (CVE-2026-100382):** Critical (CVSS 10.0) unauthenticated RCE via OS command injection in the ExternalData extension (v<3.7).  \n\u2022 **WordPress (AV26-952):** Critical path traversal in page-template resolution enabling conditional RCE in versions <7.1.2. The flaw is actively exploited in the wild and has been added to CISA\u2019s KEV database; immediate patching is required.  \n\u2022 **CliInvoke.Specializations (CVE-2026-100368):** High (CVSS 8.4) command injection in PowerShell/Cmd wrappers caused by improper handling of untrusted arguments containing double quotes. Patched versions and mitigation workarounds are available.  \n\u2022 **Legal/Incident:** A U.S. Army soldier received a 70-month prison sentence and ~$300K in restitution for hacking AT&T and Verizon to steal mobile metadata, impacting over 100 million customers.  \n\u2022 **Non-Technical:** The digest also includes a community event recommendation for a family squid dissection in Tennessee.  \n\n**Overall:** Organizations should prioritize patching MediaWiki, WordPress, and CliInvoke components, while the sentencing underscores ongoing insider threats targeting critical telecom infrastructure.", "creation_timestamp": "2026-09-26T00:00:32.000000Z"}, {"uuid": "a286ba8e-6a19-4c7c-8e60-06122fee3ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mweyjccx4n2q", "content": "\ud83d\udea8 CVE-2026-100382 \u2014 CVSS 10 CRITICAL\n\nImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100382\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-26T00:07:32.256525Z"}, {"uuid": "a1b5c14a-4411-4219-b457-dd1343678a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100390", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117334751644153923", "content": "CRITICAL vuln: CVE-2026-100390 in tobychui zoraxy (3.2.3 \u2013 3.3.4). IPv6 parsing flaw lets attackers bypass IP-based controls via spoofed X-Forwarded-For headers. Restrict IPv6 or XFF reliance until patch. https://radar.offseq.com/threat/cve-2026-100390-authentication-bypass-by-spoofing-in-tobychui-zoraxy-92a9e1620a0f6d01 #OffSeq #CVE2026100390 #infosec", "creation_timestamp": "2026-09-26T01:30:25.870139Z"}, {"uuid": "996bc84d-0ec9-4cb8-9958-b2d663a9323e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100390", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwf55kpllb2q", "content": "CRITICAL: tobychui zoraxy 3.2.3 \u2013 3.3.4 has auth bypass (CVE-2026-100390) via IPv6 X-Forwarded-For spoofing. Restrict IPv6 or avoid IP-based controls until patched. https://radar.offseq.com/threat/cve-2026-100390-authentication-bypass-by-spoofing-in-tobychui-zoraxy-92a9e1620a0f6d01 #OffSeq #CVE20...", "creation_timestamp": "2026-09-26T01:30:28.461261Z"}, {"uuid": "fdc4c6e9-7947-42d9-8d7d-d7edd053c62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100369", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfd4z4myy2c", "content": "\ud83d\udfe0 CVE-2026-100369 - High (8.4)\n\nCliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invokin...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100369/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:17:32.561721Z"}, {"uuid": "44714c21-1fb6-45f7-bf32-1e3030edb500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfd5hhuco2m", "content": "\ud83d\udfe0 CVE-2026-100368 - High (8.4)\n\nCliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specialization...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100368/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:17:47.647780Z"}, {"uuid": "766e24c1-39d3-434e-977a-ecc542d3ebae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://gist.github.com/alon710/3bf978c1c1d2c0f47957618ee41a82fa", "content": "# CVE-2026-100368: CVE-2026-100368: OS Command Injection in CliInvoke Shell Wrappers\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-100368\n\n## Summary\nAn OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers of the CliInvoke .NET library (specifically the CliInvoke.Specializations package). Under vulnerable configurations, arguments and targets are passed as a single flat string to ProcessStartInfo.Arguments, permitting double-quote breakout and execution of arbitrary secondary commands with host process privileges.\n\n## TL;DR\nFlaw in CliInvoke shell wrappers allows unauthenticated local attackers to execute arbitrary OS commands via crafted double-quote characters in target paths or execution arguments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 8.4\n- **EPSS Score**: N/A\n- **Impact**: High (Full Confidentiality, Integrity, and Availability Impact)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CliInvoke.Specializations\n- AlastairLundy.CliInvoke.Specializations\n- .NET Core and .NET applications wrapping powershell or cmd execution via CliInvoke\n- **CliInvoke.Specializations**: >= 2.2.0, <= 2.8.4 (Fixed in: `2.8.5`)\n- **CliInvoke.Specializations**: >= 2.9.0, <= 2.9.3 (Fixed in: `2.9.4`)\n- **CliInvoke.Specializations**: >= 2.10.0, <= 2.10.4 (Fixed in: `2.10.5`)\n- **CliInvoke.Specializations**: 3.0.0-alpha.1 - 3.0.0-alpha.10 (Fixed in: `3.0.0-beta.1`)\n- **AlastairLundy.CliInvoke.Specializations**: >= 1.0.0-rc.1, <= 2.0.0 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade CliInvoke.Specializations to safe versions (2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.1)\n- Strictly validate user-supplied parameters to reject double quotes (\")\n- Bypass shell wrappers entirely when executing processes using untrusted parameters\n\n**Remediation Steps:**\n1. Identify all projects using CliInvoke.Specializations or AlastairLundy.CliInvoke.Specializations\n2. Update NuGet dependencies to the appropriate patched release versions\n3. Audit validation libraries to block quotes (\") and shell operators (; | & $ ` ()) on legacy lines\n\n## References\n\n- [GitHub Security Advisory (Authoritative)](https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv)\n- [National Vulnerability Database (NVD) Record](https://nvd.nist.gov/vuln/detail/CVE-2026-100368)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-100368)\n- [GitHub Commit - Code Tokenization Implementation](https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685)\n- [GitHub Commit - Shell Middleware ArgumentList Integration](https://github.com/alastairlundy/CliInvoke/commit/2077e5239850e83dc9cc67ae6036dcd4e68a1876)\n- [CliInvoke Release v2.10.5 Tag](https://github.com/alastairlundy/CliInvoke/releases/tag/2.10.5)\n- [CliInvoke Release v3.0.0-beta.1 Tag](https://github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.1)\n- [CliInvoke Project Repository](https://github.com/alastairlundy/CliInvoke)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-100368) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T03:30:31.000000Z"}, {"uuid": "46b0a269-6fa9-4634-968a-f54d8ca211cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100369", "type": "seen", "source": "https://gist.github.com/alon710/2d1e9d9adea50782a3aa28ba496e0855", "content": "# CVE-2026-100369: CVE-2026-100369: Argument Injection Vulnerability in CliInvoke Process Runner Factories\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-100369\n\n## Summary\nAn argument injection vulnerability (CWE-88) in CliInvoke and AlastairLundy.CliInvoke allows local attackers to execute arbitrary system commands. By injecting double-quote characters into target file paths or arguments, attackers can terminate operating-system-level quoted boundaries and introduce new commands when shell runners are utilized.\n\n## TL;DR\nCliInvoke process runner factories are vulnerable to argument injection via double-quote manipulation. This allows local attackers to execute arbitrary system commands when wrapper shell runners are used. Fixes are available in versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88\n- **Attack Vector**: Local (AV:L)\n- **CVSS Base Score**: 8.4 (High)\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CliInvoke (NuGet Package)\n- AlastairLundy.CliInvoke (Legacy NuGet Package)\n- **CliInvoke**: >= 2.0.0, <= 2.8.4 (Fixed in: `2.8.5`)\n- **CliInvoke**: >= 2.9.0, <= 2.9.3 (Fixed in: `2.9.4`)\n- **CliInvoke**: >= 2.10.0, <= 2.10.4 (Fixed in: `2.10.5`)\n- **CliInvoke**: >= 3.0.0-alpha.1, <= 3.0.0-beta.1 (Fixed in: `3.0.0-beta.2`)\n- **AlastairLundy.CliInvoke**: >= 2.0.0-alpha.1, <= 2.0.0 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade the package to the latest patched version\n- Ensure target execution uses .NET 8.0 or greater for active ArgumentList populating\n- Implement double-quote filtering on all user-supplied paths and arguments\n\n**Remediation Steps:**\n1. Identify all direct or transitive dependencies on CliInvoke or AlastairLundy.CliInvoke.\n2. Update project files to reference NuGet package CliInvoke >= 2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.2, or legacy package AlastairLundy.CliInvoke >= 2.0.2.\n3. Recompile and deploy updated binaries targeting .NET 8.0 or higher.\n4. Confirm that runner invocations parse arguments into discrete collections where possible.\n\n## References\n\n- [GitHub Security Advisory GHSA-j73w-8hfr-4gc9](https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9)\n- [CVE-2026-100369 on CVE Registry](https://www.cve.org/CVERecord?id=CVE-2026-100369)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-100369) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T04:30:32.000000Z"}, {"uuid": "f18e171f-0d7d-4be5-b593-fc62923b83f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100311", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwftx2ngmo2r", "content": "CVE-2026-100311: A cross-site scripting flaw in mathurvishal's CloudClassroom-PHP-Project affects the Faculty Video Management component, allowing remote script injection. A public exploit is available per the CVE record. No fixed version is disclosed.", "creation_timestamp": "2026-09-26T08:18:25.200206Z"}, {"uuid": "72d0d078-c8dd-4197-9542-e72605358212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117336521016931097", "content": "Mediawiki ExternalData Extension <3.7 has a CRITICAL OS Command Injection vuln (CVE-2026-100382). Unauthenticated attackers could run arbitrary OS commands. No exploits yet. Restrict access, monitor activity. https://radar.offseq.com/threat/improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-b27f1e4f9d070501 #OffSeq #CVE2026100382 #Mediawiki #Security", "creation_timestamp": "2026-09-26T09:00:24.231763Z"}, {"uuid": "3dd19f3b-2a88-4df2-9837-3c80a7349100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100311", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d6tvibtommqtf", "content": "CVE-2026-100311 - mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting\nCVE ID : CVE-2026-100311\n \n Published : Sept. 26, 2026, 8 a.m. | 18\u00a0minutes ago\n \n Description : A vulnerability was identified in mathurvishal CloudClassr...", "creation_timestamp": "2026-09-26T09:22:06.516100Z"}, {"uuid": "0243b457-5d8b-4704-a6cc-b84f3033ccb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100389", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117336874943730236", "content": "GestSup <3.2.61 is vulnerable to CRITICAL RCE (CVE-2026-100389) via IMAP connector. Attackers can send PHP attachments to monitored mailboxes, leading to system compromise. Upgrade to 3.2.61+ ASAP. https://radar.offseq.com/threat/gestsup-versions-before-3261-contain-a-remote-code-execution-vulnerability-in-the-basic-imap-125b3f214ef54f5e #OffSeq #Infosec #RCE #GestSup", "creation_timestamp": "2026-09-26T10:30:24.770889Z"}, {"uuid": "991d9db0-8327-4b3e-9d8c-1edfe712fd2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100390", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgmmsx5hs2y", "content": "CVE-2026-100390 - zoraxy\nVersions 3.2.3 through 3.3.4 of Zoraxy do not correctly handle IPv6 addresses when processing the X-Forwarded-For header. This lets unauthenticated users send fake source IP\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zoraxy #tobychui #CVE #infosec", "creation_timestamp": "2026-09-26T15:40:04.995942Z"}, {"uuid": "a45c5a5a-b15a-4b84-9398-33bf9594e2db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100389", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgmmucudh2q", "content": "CVE-2026-100389 - gestsup\nVersions of GestSup older than 3.2.61 let anyone send a specially crafted email with a PHP file attached. The system saves that file in a publicly reachable folder and runs it, giving the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gestsup #CVE #infosec", "creation_timestamp": "2026-09-26T15:40:06.371345Z"}, {"uuid": "bb638bde-8e40-4165-9681-65dfb86b074b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgnqkqw3k26", "content": "CVE-2026-100382 - mediawiki - externaldata extension\nThe ExternalData add\u2011on for Mediawiki can be tricked into executing system commands without any authentication. This means an attacker could run\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wikimediafoundation #CVE #infosec", "creation_timestamp": "2026-09-26T16:00:04.700078Z"}, {"uuid": "c0d4e32c-b88c-44fd-97ec-cb5b4308ad05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100314", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwgovonafd2v", "content": "mathurvishal CloudClassroom-PHP-Project\uff085dadec098bfbbf3300d60c3494db3fb95b66e7be\u307e\u3067\uff09\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u2026\nCVE-2026-100314 CVSS 7.3 | HIGH", "creation_timestamp": "2026-09-26T16:20:50.342366Z"}, {"uuid": "a8a1df54-63a2-4254-a748-ae2744b3c2ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100315", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwgoxwtsul2g", "content": "mathurvishal CloudClassroom-PHP-Project\uff08\u30d0\u30fc\u30b8\u30e7\u30f3\u7279\u5b9a\u4e0d\u53ef\uff09\u306emydetailsfaculty.php\u3067SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002\u30ea\u30e2\u30fc\u2026\nCVE-2026-100315 CVSS 7.3 | HIGH", "creation_timestamp": "2026-09-26T16:22:05.832485Z"}, {"uuid": "bd3af71d-6b29-465d-a0ea-519e9be2f10a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100372", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwhx3t4fxz2i", "content": "CVE-2026-100372 - clipbucket-v5\nThe template editor in ClipBucket version 5 before 5.5.3-#197 lets an admin user change the folder name to reach outside the intended directory and replace PHP files.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#clipbucketv5 #macwarrior #CVE #infosec", "creation_timestamp": "2026-09-27T04:20:05.757817Z"}, {"uuid": "c51bdda4-77ae-48f8-9f9e-39f2870519a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100313", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mwipnsmgzg2o", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-100313\n\nA weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown f...", "creation_timestamp": "2026-09-27T11:39:39.273944Z"}, {"uuid": "02a18407-ca6f-4be7-9379-a721cdbff42e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "Telegram/xW8z4oUOq-Ane7EXj1wNqp6zyl2_0CSzOhfXQFSSmteKMQE", "content": "", "creation_timestamp": "2026-09-27T19:00:15.000000Z"}, {"uuid": "830fe099-2562-4cd0-975f-e27dbf2e54ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "published-proof-of-concept", "source": "Telegram/xW8z4oUOq-Ane7EXj1wNqp6zyl2_0CSzOhfXQFSSmteKMQE", "content": "", "creation_timestamp": "2026-09-27T19:00:15.000000Z"}, {"uuid": "b5e8589d-0d12-46ce-9e4c-e0c4a8f4df3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwrw6qtxfk2t", "content": "Attackers exploit CVE-2026-100382, a CVSS 10 unauthenticated MediaWiki RCE in External Data. PoC is public. Upgrade to 3.7 now.\n\n#MediaWiki #ExternalData #CVE2026100382 #RCE #CommandInjection #ExploitedInTheWild #PoC", "creation_timestamp": "2026-10-01T03:30:27.622771Z"}, {"uuid": "f86e7f79-a939-46ed-b498-d974c6f71053", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100308", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwtjiqpwwo2p", "content": "CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization #patchmanagement", "creation_timestamp": "2026-10-01T18:48:43.909862Z"}, {"uuid": "43581cf5-4eaf-462b-86bd-763be1b1bbb3", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/67178a7a-26a9-4107-b0b6-88b1053a340d", "content": "", "creation_timestamp": "2026-10-02T10:00:41.724155Z"}, {"uuid": "2e4ccfa1-d4d2-49aa-99fe-da55c1bd6ade", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100381", "type": "seen", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "content": "", "creation_timestamp": "2026-09-30T03:00:06.000000Z"}, {"uuid": "a2a3e25f-3e8e-4968-8a5b-8d988db3abd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100380", "type": "seen", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "content": "", "creation_timestamp": "2026-09-30T03:00:06.000000Z"}, {"uuid": "fb2c91e3-83cc-41be-a8a1-f4622f381a0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100380", "type": "published-proof-of-concept", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "content": "", "creation_timestamp": "2026-09-30T03:00:06.000000Z"}, {"uuid": "49fe5819-1b9f-4157-89f7-86457d6f7575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100381", "type": "published-proof-of-concept", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "content": "", "creation_timestamp": "2026-09-30T03:00:06.000000Z"}, {"uuid": "86cf4baf-77f2-4d90-9789-7bbfe3d4982a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10032", "type": "seen", "source": "https://gist.github.com/alon710/bbef448ddedc6cabee70ea28e567bc12", "content": "# CVE-2026-10032: CVE-2026-10032: DOM-based Cross-Site Scripting (XSS) via window.open in Google @a2ui/web_core\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-10032\n\n## Summary\nCVE-2026-10032 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Google's @a2ui/web_core Node.js library. The vulnerability is located within the openUrl utility function, which processes and opens dynamic URLs defined in layout configurations. Because the function fails to sanitize or validate the target URL scheme before passing it to the window.open browser sink, an attacker can specify a javascript: pseudo-protocol to execute arbitrary client-side script in the context of the host origin.\n\n## TL;DR\nUnvalidated URL configuration parameter passing to the window.open sink within the @a2ui/web_core layout engine enables unauthenticated remote attackers to execute arbitrary JavaScript in the victim browser origin.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **EPSS Score**: 0.00130 (Percentile: 2.227%)\n- **Impact**: Execution of arbitrary JavaScript under victim origin (XSS)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @a2ui/web_core npm library\n- **@a2ui/web_core**: >= 0.9.0, < 0.10.2 (Fixed in: `0.10.2`)\n\n## Mitigation\n\n- Upgrade @a2ui/web_core dependency to version 0.10.2 or higher.\n- Implement a Content Security Policy (CSP) that restricts 'unsafe-inline' scripts.\n- Validate and sanitize layout JSON configurations on the server-side before serving them to clients.\n- Ensure all window opening implementations enforce 'noopener,noreferrer' attributes to mitigate reverse tab-nabbing.\n\n**Remediation Steps:**\n1. Open the package.json file of your project.\n2. Locate the '@a2ui/web_core' dependency entry under dependencies.\n3. Update the version string to '^0.10.2'.\n4. Run 'npm install' or 'yarn install' to pull the patched version.\n5. Validate the upgrade by executing security test suites against layout renderers.\n\n## References\n\n- [GitHub Security Advisory GHSA-72qq-p3r5-f7wq](https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq)\n- [CVE-2026-10032 Record](https://www.cve.org/CVERecord?id=CVE-2026-10032)\n- [Patch Commit](https://github.com/a2ui-project/a2ui/commit/71573078c4168b2dc166bb847c3a85715dadc675)\n- [Pull Request #1707](https://github.com/a2ui-project/a2ui/pull/1707)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-10032) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T23:30:28.000000Z"}]}