{"vulnerability": "cve-2026-7514", "sightings": [{"uuid": "729d7db9-817c-4384-b5d2-b5bd69c04282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/CyberDispatch/2687", "content": "A Marimo notebook can launch MCP commands before cells run.\n\nCVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.\nMarimo fixed it in 0.23.15.", "creation_timestamp": "2026-08-30T00:00:39.026901Z"}, {"uuid": "aa86f527-bd1a-4229-b30a-3d35a81b43d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/CyberDispatch/2687", "content": "A Marimo notebook can launch MCP commands before cells run.\n\nCVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.\nMarimo fixed it in 0.23.15.", "creation_timestamp": "2026-08-29T20:00:04.379070Z"}, {"uuid": "fe0cbb6a-8a74-471f-badf-5803ff532b55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75146", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthcrdnr5g22", "content": "\ud83d\udfe0 CVE-2026-75146 - High (8.1)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dash...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75146/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T18:00:45.071042Z"}, {"uuid": "a16821d1-665f-4925-8709-9ba45303916c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75141", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthcrkiqxx2m", "content": "\ud83d\udfe0 CVE-2026-75141 - High (7.8)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75141/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T18:00:52.081086Z"}, {"uuid": "ca5e74e5-a848-4649-9ee7-18c539818997", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75142", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthcrrcxzy2z", "content": "\ud83d\udfe0 CVE-2026-75142 - High (7.8)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/m...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75142/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T18:00:59.207113Z"}, {"uuid": "f64bf9fb-8fed-4062-90fa-3ff1efc02255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75143", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthctfogca2z", "content": "\ud83d\udd34 CVE-2026-75143 - Critical (9.8)\n\nFFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavfo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75143/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T18:01:55.098998Z"}, {"uuid": "fe526c02-fa24-4f24-9ee5-933712777b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75144", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthctmi36u27", "content": "\ud83d\udfe0 CVE-2026-75144 - High (7.8)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75144/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T18:02:01.462236Z"}, {"uuid": "161352d1-bf22-46ed-8275-a7269f9538fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtodwdulv325", "content": "CVE-2026-75149\nVersions of marimo before 0.23.15 let an attacker place a specially crafted server setting in a notebook. When that notebook is opened for editing, the program will automatically run the attacker\u2019s command on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T13:10:04.457622Z"}, {"uuid": "b99cf846-6305-4c6c-abe3-938fd28b3900", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75143", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mthdepbcts2j", "content": "\ud83d\udea8 CVE-2026-75143 \u2014 CVSS 9.3 CRITICAL\n\nFFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/libri...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75143\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T18:11:33.916437Z"}, {"uuid": "3561a92e-9672-4a32-9662-70a3ca08827f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75143", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mthg3ipu342p", "content": "CVE-2026-75143 - ffmpeg\nA security risk exists in older versions of FFmpeg, specifically in its RIST protocol reader. This could allow an attacker to cause a program using FFmpeg to crash or potentially execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ffmpeg #CVE #infosec", "creation_timestamp": "2026-08-19T19:00:06.820625Z"}, {"uuid": "11634cbf-ebdb-4100-baaa-accac35f82d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fpt3gt6vrui2y", "content": "CVE-2026-75149 - marimo\nCVE ID : CVE-2026-75149\n \n Published : Aug. 19, 2026, 6:17 p.m. | 13\u00a0minutes ago\n \n Description : marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by ...", "creation_timestamp": "2026-08-19T19:00:43.080490Z"}, {"uuid": "68ffc02a-8cc6-4f03-8383-335c25849f4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthg4ubkfb27", "content": "\ud83d\udfe0 CVE-2026-75149 - High (8.8)\n\nmarimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handl...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75149/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T19:00:52.861106Z"}, {"uuid": "7c56d059-4f3d-41dd-a584-c5a20a6ba46e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75140", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjpvckg5f26", "content": "\ud83d\udfe0 CVE-2026-75140 - High (7.5)\n\njsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vuln...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75140/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-20T17:00:56.091503Z"}, {"uuid": "df1468b2-b581-453f-98ff-4acb3bcef871", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75143", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mti5khap7v2m", "content": "CVE-2026-75143 - ffmpeg\nA flaw in Debian's OpenSSL implementation can cause it to incorrectly validate certificates. This could allow an attacker to create fake certificates that appear to be\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ffmpeg #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-20T02:00:04.794736Z"}, {"uuid": "57187083-9583-4f6d-937c-3fc4d76933c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9888", "content": "\u203c\ufe0f A Marimo notebook can launch MCP commands before cells run.\n\nCVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.\nMarimo fixed it in 0.23.15.\n\nRead the details: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html", "creation_timestamp": "2026-08-26T19:00:03.568778Z"}, {"uuid": "319796b1-d9b1-41e9-8a3c-b52ef8afa99b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9888", "content": "\u203c\ufe0f A Marimo notebook can launch MCP commands before cells run.\n\nCVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.\nMarimo fixed it in 0.23.15.\n\nRead the details: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html", "creation_timestamp": "2026-08-27T00:00:09.383140Z"}, {"uuid": "630971f2-23b4-4494-ae3d-7628bec709ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/pphm_HackerNews/2854", "content": "\ud83d\udd34 Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode\n\nMarimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record.\n\nThe CNA record says the command can run as a local subprocess when the notebook is opened in edit mode.\n\nThe vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15. VulnCheck's CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.", "creation_timestamp": "2026-08-27T00:00:10.990235Z"}, {"uuid": "abb5fd5c-3ca0-41e1-ad37-9dd89c0d4320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/pphm_HackerNews/2854", "content": "\ud83d\udd34 Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode\n\nMarimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record.\n\nThe CNA record says the command can run as a local subprocess when the notebook is opened in edit mode.\n\nThe vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15. VulnCheck's CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.", "creation_timestamp": "2026-08-26T03:00:03.573950Z"}, {"uuid": "3fbbada6-9926-4285-bb8c-7e59c63197c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mtvx5cqydc2m", "content": "CVE-2026-75149 lets crafted Marimo notebooks execute attacker-supplied MCP commands as local subprocesses when opened in edit mode; fixed in 0.23.15.\n", "creation_timestamp": "2026-08-25T13:42:37.647863Z"}, {"uuid": "834ce6be-5acf-47f9-93ca-1a2649674199", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7514", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvaq2esev62q", "content": "\ud83d\udd17 CVE : CVE-2024-11222, CVE-2025-14871, CVE-2026-1168, CVE-2026-12910, CVE-2026-13210, CVE-2026-16794, CVE-2026-19619, CVE-2026-3855, CVE-2026-7514, CVE-2026-78252, CVE-2026-79708, CVE-2026-8030, CVE-2026-82837, CVE-2026-85706, CVE-2026-86340, CVE-2026-86341, CVE-2026-87719, CVE-2026-88765", "creation_timestamp": "2026-09-11T14:00:11.545043Z"}, {"uuid": "58ea9338-e5a8-4d1e-892b-eeeb0243678b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7514", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260914", "content": "", "creation_timestamp": "2026-09-14T07:45:14.773258Z"}, {"uuid": "980463c4-b496-489e-b24c-737b00ab5e7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7514", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-25", "content": "", "creation_timestamp": "2026-09-14T07:46:10.154538Z"}]}