{"vulnerability": "cve-2026-1082", "sightings": [{"uuid": "0602cb77-0b66-4ef6-a7cd-9c92469f5b86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10825", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mofrmfzfxl2w", "content": "\ud83d\udd17 CVE : CVE-2026-10825, CVE-2026-10828, CVE-2026-10829", "creation_timestamp": "2026-06-16T12:15:08.338333Z"}, {"uuid": "fe38757b-c0b7-446e-8772-1eb107a4c96a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10828", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mofrmfzfxl2w", "content": "\ud83d\udd17 CVE : CVE-2026-10825, CVE-2026-10828, CVE-2026-10829", "creation_timestamp": "2026-06-16T12:15:08.488777Z"}, {"uuid": "86752b8f-dd2e-4325-b0e9-dbc08c153ca5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10829", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mofrmfzfxl2w", "content": "\ud83d\udd17 CVE : CVE-2026-10825, CVE-2026-10828, CVE-2026-10829", "creation_timestamp": "2026-06-16T12:15:08.631166Z"}, {"uuid": "4603da93-825b-4b56-ad40-b3c0a55146c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10829", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mofvpcucfu2h", "content": "CVE-2026-10829 - Moxa NPort Stack-Based Buffer Overflow Remote Code Execution\nCVE ID : CVE-2026-10829\n \n Published : June 16, 2026, 12:16 p.m. | 52\u00a0minutes ago\n \n Description : A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series v...", "creation_timestamp": "2026-06-16T13:28:19.842472Z"}, {"uuid": "952a7909-ee04-45cd-9776-7894b240a176", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10828", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3moia3vpqfm2u", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-10828\n\nA format string vulnerability has been found in the \"alias\" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Serie...", "creation_timestamp": "2026-06-17T11:39:38.950349Z"}, {"uuid": "a076d34c-e817-4a5d-8fdb-e53b07e2a169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10825", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-610", "content": "", "creation_timestamp": "2026-06-17T10:39:36.000000Z"}, {"uuid": "1f33409b-9f97-448e-8ab3-d0aebe0f666d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10828", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-610", "content": "", "creation_timestamp": "2026-06-17T10:39:36.000000Z"}, {"uuid": "dd59145b-1184-48f8-9a52-b587dca492db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10829", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-610", "content": "", "creation_timestamp": "2026-06-17T10:39:36.000000Z"}, {"uuid": "9f94aa6b-7181-43b3-8c11-7a097467d803", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10820", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpb6wg555k2q", "content": "CVE-2026-10820 - ProfilePress\nCVE ID : CVE-2026-10820\n \n Published : June 27, 2026, 6 a.m. | 3\u00a0hours, 45\u00a0minutes ago\n \n Description : The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 ...", "creation_timestamp": "2026-06-27T09:55:14.845065Z"}, {"uuid": "f5b0939a-9a60-4d92-91a5-ef5992cc760f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10823", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-10823.yaml", "content": "", "creation_timestamp": "2026-06-29T12:00:04.238530Z"}, {"uuid": "a3954679-b8d0-46a0-bb4b-1fc6c0df32cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10822", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrarlpzzf32u", "content": "ISC has disclosed nine vulnerabilities in BIND 9 (CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321)", "creation_timestamp": "2026-07-22T16:47:00.617602Z"}, {"uuid": "2a17cdd8-4dba-4dda-afcb-51ed85b85d52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10822", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mraz4gyvek2o", "content": "BIND 9\u306e\u8106\u5f31\u6027(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822)\u3068\u4fee\u6b63\u30d0\u30fc\u30b8\u30e7\u30f3(9.20.26, 9.21.24)\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #dns #bind\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-22T19:01:40.536269Z"}, {"uuid": "039587ea-f828-4fcf-9f56-15952e730a89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108263", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhx7c4a232n", "content": "\ud83d\udd34 CVE-2026-108263 - Critical (9.9)\n\nAstron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108263/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T21:47:14.182481Z"}, {"uuid": "2ee43dc3-c9cf-4a58-94ce-522e92f9173a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108258", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412888597591536", "content": "CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108258https://github.com/posit-dev/py-shiny/security/advisories/GHSA-47c3-hpmg-7j6phttps://github.com/posit-dev/py-shiny/commit/1d8ecb46cbc9621b7dc8812111d26692e086b376https://github.com/posit-dev/py-shiny/releases/tag/v1.6.4#posit-dev #py-shiny#CVE_2026_108258#bot", "creation_timestamp": "2026-10-09T20:41:48.063955Z"}, {"uuid": "21639841-6a40-4fb0-a26e-1510471e079e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108264", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhx7iiszi2g", "content": "\ud83d\udd34 CVE-2026-108264 - Critical (9.1)\n\nWizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other m...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108264/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T21:47:20.708984Z"}, {"uuid": "502a726c-bdcf-4450-b528-58498c429c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108259", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412929309371025", "content": "CVE-2026-108259 Tina: Code injection via unescaped Git branch name in generated client source Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108259https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5chttps://github.com/tinacms/tinacms/pull/7526https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71ddehttps://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0#tinacms #@tinacms #cli#CVE_2026_108259#bot", "creation_timestamp": "2026-10-09T20:52:02.125659Z"}, {"uuid": "90c6ca00-9e1e-4223-b266-5eb6b548d8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108260", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412931952729577", "content": "CVE-2026-108260 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108260https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vghttps://github.com/tinacms/tinacms/pull/7523https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3bhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1#tinacms #@tinacms #web-components#CVE_2026_108260#bot", "creation_timestamp": "2026-10-09T20:52:42.547372Z"}, {"uuid": "323b4d08-1f5e-4171-a082-6072f6509634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412934600245223", "content": "CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108261https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7https://github.com/tinacms/tinacms/pull/7522https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecfhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0#tinacms #@tinacms #app#CVE_2026_108261#bot", "creation_timestamp": "2026-10-09T20:53:22.754600Z"}, {"uuid": "1beb6821-606d-462c-a7b7-7cdaa84b0a4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108263", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412937243045534", "content": "CVE-2026-108263 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108263https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5https://github.com/iflytek/astron-agent/pull/1650https://github.com/iflytek/astron-agent/pull/1651https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18fhttps://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36https://github.com/iflytek/astron-agent/releases/tag/v1.1.2#iflytek #astron-agent#CVE_2026_108263#bot", "creation_timestamp": "2026-10-09T20:54:03.263140Z"}, {"uuid": "f4fdc78c-6981-4e51-88db-03ae4f4e59c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108264", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412960582250313", "content": "CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE) Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108264https://github.com/wizarrrr/wizarr/security/advisories/GHSA-h9rv-mxh2-35f3https://github.com/wizarrrr/wizarr/commit/6aa3c33c1b3d945e055ef116cc531028b3735bb7https://github.com/wizarrrr/wizarr/releases/tag/v2026.9.1#wizarrrr #wizarr#CVE_2026_108264#bot", "creation_timestamp": "2026-10-09T20:59:59.358701Z"}, {"uuid": "1faba8ca-19f8-4b2b-90fe-c563d2371c23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108265", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412963225518174", "content": "CVE-2026-108265 enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108265https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8ehttps://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0https://privasys.org/blog/binding-attestation-to-the-tls-session#Privasys #enclave-os-mini#CVE_2026_108265#bot", "creation_timestamp": "2026-10-09T21:00:39.783938Z"}, {"uuid": "3039006f-5884-47ec-9737-fd6ad8d3decf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-108260", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg", "content": "", "creation_timestamp": "2026-09-16T22:02:19.000000Z"}, {"uuid": "08c4f46d-bbc7-4cda-aba8-326683827757", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108266", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412992140699850", "content": "CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108266https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1https://privasys.org/blog/binding-attestation-to-the-tls-session#privasys #Privasys #rustls#CVE_2026_108266#bot", "creation_timestamp": "2026-10-09T21:08:00.768254Z"}, {"uuid": "25e831b7-db2d-4a2a-9215-79e9975323ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108267", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117413051196470510", "content": "CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108267https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5https://privasys.org/blog/binding-attestation-to-the-tls-session#privasys #Privasys #go#CVE_2026_108267#bot", "creation_timestamp": "2026-10-09T21:23:02.073418Z"}, {"uuid": "4e5c8e74-78dd-4b24-9c9a-c78166d28b34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117413053839041888", "content": "CVE-2026-108268 enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108268https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43https://privasys.org/blog/binding-attestation-to-the-tls-session#Privasys #enclave-os-virtual#CVE_2026_108268#bot", "creation_timestamp": "2026-10-09T21:23:42.192397Z"}, {"uuid": "5e4970d7-e07a-4ba6-80a3-8ec86d8ea303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108269", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117413056504531904", "content": "CVE-2026-108269 ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108269https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvxhttps://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvxhttps://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0https://privasys.org/blog/binding-attestation-to-the-tls-session#Privasys #ra-tls-clients#CVE_2026_108269#bot", "creation_timestamp": "2026-10-09T21:24:22.891089Z"}, {"uuid": "b8721c54-70b3-4521-bc63-357ff984b49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108259", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhx5rfnuu2g", "content": "\ud83d\udfe0 CVE-2026-108259 - High (8.2)\n\nTina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch value...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108259/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T21:46:23.459993Z"}, {"uuid": "ca377206-50c0-488a-a6f3-f6ad93dcca72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108260", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhx5xqgeb2b", "content": "\ud83d\udfe0 CVE-2026-108260 - High (7.6)\n\nTina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packag...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108260/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T21:46:29.850253Z"}, {"uuid": "7d03d2bd-48de-4218-87de-a75a73f610d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhx65zlvq2g", "content": "\ud83d\udd34 CVE-2026-108261 - Critical (9.3)\n\nTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, th...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108261/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T21:46:36.678153Z"}, {"uuid": "1ec8fbf5-8c4a-4d3a-b137-1658d4c04b5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhyddfa352h", "content": "\ud83d\udea8 CVE-2026-108261 \u2014 CVSS 9.3 CRITICAL\n\nTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* adm...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108261\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:23.376889Z"}, {"uuid": "73ca07f8-ec4d-4583-b6f1-d9bf849b9216", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108263", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhydleq5l2o", "content": "\ud83d\udea8 CVE-2026-108263 \u2014 CVSS 9.9 CRITICAL\n\nAstron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the defaul...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108263\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:31.273946Z"}, {"uuid": "0710c525-05c7-47d6-90b4-3972017cdddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108263", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mxhydlsv5f2a", "content": "\ud83d\udea8 CVE-2026-108263 \u2014 CVSS 9.9 CRITICAL\n\nAstron Agent is an agentic workflow platform for building and running BO agents. Prior to 1.1.2, the defaul...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108263\n\n#CVE #PotatoSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:33.274687Z"}, {"uuid": "38a47d07-7e5b-49f9-8703-ec5955e6dda6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108264", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhydt4fuq22", "content": "\ud83d\udea8 CVE-2026-108264 \u2014 CVSS 9.1 CRITICAL\n\nWizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media serve...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108264\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:39.458689Z"}, {"uuid": "2dcbd259-77b1-4533-affb-1f35e6e54326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108265", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhye3i5sf2w", "content": "\ud83d\udea8 CVE-2026-108265 \u2014 CVSS 9.1 CRITICAL\n\nEnclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to w...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108265\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:48.199836Z"}, {"uuid": "e8e2b8ae-865a-4d93-b9da-6fb6e8679eee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108266", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhyedjg7n2z", "content": "\ud83d\udea8 CVE-2026-108266 \u2014 CVSS 9.1 CRITICAL\n\nPrivasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-bindi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108266\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:56.605835Z"}, {"uuid": "1b492f08-3fc2-422d-8606-4682c7f0b8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-108261", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7", "content": "", "creation_timestamp": "2026-09-16T22:02:13.000000Z"}, {"uuid": "17818f1b-99ac-45b9-ba0e-66637053ad38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108264", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117413452793328440", "content": "CVE-2026-108264 - Critical Jinja2 template injection RCE in Wizarr media user management. CVSS 9.1. Update to 2026.9.1 immediately. #CVE #infosec #cybersecurity\nhttps://www.valtersit.com/cve/CVE-2026-108264/", "creation_timestamp": "2026-10-09T23:05:10.125859Z"}, {"uuid": "f7ecfbdc-c34a-4bdc-8fdb-fc79ce93f27e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108269", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4nkrostmlodim", "content": "CVE-2026-108269 - ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session\nCVE ID : CVE-2026-108269\n \n Published : Oct. 9, 2026, 10:16 p.m. | 1\u00a0hour, 3\u00a0minutes ago\n \n Description : Remote Attestation TLS Clients provides multi-language utilities f...", "creation_timestamp": "2026-10-09T23:50:21.081253Z"}, {"uuid": "c797a292-1f03-4738-8c35-6be4342ee74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7tcv5yhpy7yci", "content": "CVE-2026-108268 - enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session\nCVE ID : CVE-2026-108268\n \n Published : Oct. 9, 2026, 10:16 p.m. | 1\u00a0hour, 3\u00a0minutes ago\n \n Description : Enclave OS Virtual runs container workloads inside confidential virtu...", "creation_timestamp": "2026-10-09T23:56:20.422121Z"}, {"uuid": "9fb1f662-66b5-446f-ae7e-5139fcfcd3bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108267", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxi727r7pn2o", "content": "\ud83d\udea8 CVE-2026-108267 \u2014 CVSS 9.1 CRITICAL\n\nPrivasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Pri...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108267\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T00:07:33.371056Z"}, {"uuid": "69b8971d-0c94-48ff-975e-086f69039de6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxi72hqbt52o", "content": "\ud83d\udea8 CVE-2026-108268 \u2014 CVSS 9.1 CRITICAL\n\nEnclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestatio...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108268\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T00:07:41.683196Z"}, {"uuid": "4487f148-e975-4773-b8a6-0c3f7f447d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108269", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxi72ph6x52n", "content": "\ud83d\udea8 CVE-2026-108269 \u2014 CVSS 9.1 CRITICAL\n\nRemote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Pr...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108269\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T00:07:49.955541Z"}, {"uuid": "6e2b912c-b728-4d7e-a594-cc801de452f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108263", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxiauf7kav2q", "content": "CVE-2026-108263 - astron-agent\nThe Astron Agent platform (versions before 1.1.2) lets a low\u2011privilege user run unrestricted Python code on the server. This can let them act as the system administrator,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#astronagent #iflytek #CVE #infosec", "creation_timestamp": "2026-10-10T00:40:05.173332Z"}, {"uuid": "8ffe2e26-cf6f-4b63-ba56-b0d4aa79d99f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxibgaegrl2r", "content": "CVE-2026-108264 - wizarr\nIn versions of Wizarr before the September 2026 update, the wizard feature processed custom text without proper safety checks. A user with a valid account could add specially crafted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wizarr #wizarrrr #CVE #infosec", "creation_timestamp": "2026-10-10T00:50:04.553697Z"}, {"uuid": "7d2f87a5-57db-405c-b230-4b466329eaf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108265", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxiby5arip24", "content": "CVE-2026-108265 - enclave-os-mini\nEnclave OS Mini runs confidential code inside Intel SGX. If an attacker gets the TLS private key, they can reuse a trusted quote on a different connection, making a server think it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:00:05.055773Z"}, {"uuid": "93e51e62-beb8-48d6-8374-be3febf78816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxiby6uadc2l", "content": "CVE-2026-108261 - tinacms\nThe TinaCMS admin interface builds the preview frame URL from the page\u2019s hash without confirming it points to the same site. An attacker can craft a link that makes the admin load an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tinacms #npm #CVE #infosec", "creation_timestamp": "2026-10-10T01:00:06.512020Z"}, {"uuid": "d0daf42f-8686-469d-9dd1-e940657a2f79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108266", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxicjza7hi24", "content": "CVE-2026-108266 - rustls\nThe privasys rustls library, used to secure communications, could allow a stolen private key to be used on a different connection, making it appear as a trusted enclave. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rustls #privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:10:04.821057Z"}, {"uuid": "0745f900-b6af-429f-9568-7f1ebbc6be56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108267", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxick2qwid27", "content": "CVE-2026-108267 - go\nThe Privasys Go software, which adds special security checks to Go\u2019s TLS library, did not link the proof of a secure enclave to the actual network session in versions before v0.5.1-go1.26.5.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#go #privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:10:06.512501Z"}, {"uuid": "36a0b18b-f277-4209-a9b5-6e5e539780ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxid3upx6j2x", "content": "CVE-2026-108268 - enclave-os-virtual\nThe Enclave OS Virtual software that runs container workloads in secure virtual machines could be tricked into accepting a fake proof of its identity if an attacker steals its\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:20:04.489329Z"}, {"uuid": "99d770aa-8870-4079-9388-718a130f701b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108269", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxid3w4xvf2n", "content": "CVE-2026-108269 - ra-tls-clients\nVersions of privasys RA\u2011TLS client before 0.5.0 could be fooled into accepting a connection that isn\u2019t the genuine secure enclave if an attacker steals the enclave\u2019s TLS private key.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:20:05.273528Z"}, {"uuid": "4fc4641c-b6c5-4e78-b1d2-38f952dd2301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108269", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117414024133512059", "content": "CVE-2026-108269 (CRITICAL, CVSS 9.1): Privasys ra-tls-clients <0.5.0 origin validation error lets attackers relay attestation quotes, compromising TLS trust. Upgrade to 0.5.0+ now. https://radar.offseq.com/threat/cve-2026-108269-cwe-346-origin-validation-error-in-privasys-ra-tls-clients-1e6de81a7e6f2eb8 #OffSeq #CVE2026108269 #Rust #Go #TLS", "creation_timestamp": "2026-10-10T01:30:28.043973Z"}, {"uuid": "78ccf9ea-03e6-4484-b1b6-3f5e5c68e45e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108269", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxidojfxrt2l", "content": "Privasys ra-tls-clients <0.5.0 hit by CRITICAL origin validation bug (CVE-2026-108269, CVSS 9.1) \u2014 attackers can relay genuine quotes. Upgrade to 0.5.0+ now! https://radar.offseq.com/threat/cve-2026-108269-cwe-346-origin-validation-error-in-privasys-ra-tls-clients-1e6de81a7e6f2eb8 #OffSeq #CVE202...", "creation_timestamp": "2026-10-10T01:30:30.179055Z"}, {"uuid": "44031784-1f94-4afd-b90b-1564abd23001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108268", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117414377789581647", "content": "CVE-2026-108268 (CRITICAL, CVSS 9.1): Privasys enclave-os-virtual <0.2.43/<0.6.27 origin validation error lets attackers relay attestation quotes if they have the enclave TLS private key. Upgrade to patched versions ASAP. https://radar.offseq.com/threat/cve-2026-108268-cwe-346-origin-validation-error-in-privasys-enclave-os-virtual-3494df223a867096 #OffSeq #CVE2026108268 #Vuln", "creation_timestamp": "2026-10-10T03:00:24.526236Z"}, {"uuid": "18b0d22b-7e8c-4b18-9158-510c7c559b6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108268", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxiipdmhmk2j", "content": "CRITICAL: Privasys enclave-os-virtual (<0.2.43/<0.6.27) origin validation bug enables relay attacks \u2014 attacker can spoof enclave attestation. Update to fixed versions now. https://radar.offseq.com/threat/cve-2026-108268-cwe-346-origin-validation-error-in-privasys-enclave-os-virtual-3494df223a8670...", "creation_timestamp": "2026-10-10T03:00:26.535183Z"}, {"uuid": "4b56d47d-c6ea-4eb9-8132-05f1b9477ca5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mxjp6wa4ii2i", "content": "CVE-2026-108261 affects @tinacms/app below 2.5.14: TinaCMS builds its admin preview iframe from an attacker-controlled URL fragment. That origin becomes the postMessage trust anchor; the fixes are @tinacms/app 2.5.14 and tinacms 3.14.0. #software", "creation_timestamp": "2026-10-10T14:29:11.762012Z"}]}