{"vulnerability": "cve-2026-9093", "sightings": [{"uuid": "67810245-44d5-499d-91d9-bb98808a0ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90937", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvi7rfmuht2f", "content": "CVE-2026-90937 - froxlor\nIn versions of Froxlor earlier than 2.2.5, the system does not check for hidden line\u2011break characters in the URLs used for subdomain redirects. This lets an authenticated customer paste\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#froxlor #CVE #infosec", "creation_timestamp": "2026-09-14T13:30:07.972130Z"}, {"uuid": "d78108bd-08b7-42ed-9c59-61d08e752248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90937", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvibukmgim2b", "content": "\ud83d\udea8 CVE-2026-90937 \u2014 CVSS 9.4 CRITICAL\n\nfroxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing auth...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90937\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T14:07:41.389039Z"}, {"uuid": "1660578c-c45d-4206-bf08-cf2905714738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90932", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvjt6iguis2p", "content": "CVE-2026-90932 - laradashboard\nThe backup feature in LaraDashboard 0.9.2 through 1.2.2 does not check the file name it receives, so a user with basic editing rights can include \u201c../\u201d sequences and cause the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#laradashboard #CVE #infosec", "creation_timestamp": "2026-09-15T04:50:07.969918Z"}, {"uuid": "e0e6321b-6521-4682-891d-341f74e81dfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90934", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvjtqelbyd2g", "content": "CVE-2026-90934 - espocrm\nIn versions of EspoCRM older than 10.0.4, the features that list meeting and call participants do not verify the correct permissions. A signed\u2011in user can view email addresses that should be\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#espocrm #CVE #infosec", "creation_timestamp": "2026-09-15T05:00:08.302731Z"}]}