{"vulnerability": "cve-2026-9094", "sightings": [{"uuid": "19fae644-ad2f-46a6-9581-bea195b1b508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90948", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117269703165930171", "content": "A severe vulnerability was disclosed for Red Hat Enterprise Linux (CVE-2026-90948) https://vuldb.com/vuln/403548", "creation_timestamp": "2026-09-14T13:47:44.471439Z"}, {"uuid": "e8c1ae4a-2f5d-4bfd-90b0-c30dda805d4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90943", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvimmngx652r", "content": "CVE-2026-90943 - filament-comments\nThe Filament-Comments component (up to version 3.0.0) lets people who are signed into the admin panel add comments that contain hidden code. When other users,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#filamentcomments #parallax #CVE #infosec", "creation_timestamp": "2026-09-14T17:20:07.056399Z"}, {"uuid": "280d7cb1-0389-4a24-9c97-e1d396b47465", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90943", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvipd33ojl2f", "content": "\ud83d\udea8 CVE-2026-90943 \u2014 CVSS 9.3 CRITICAL\n\nparallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment bo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90943\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T18:08:27.073795Z"}, {"uuid": "765e5190-21f4-4f56-b370-bc629309b8c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90942", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvir3pm7j72g", "content": "CVE-2026-90942 - casdoor\nThe Casdoor authentication service (versions up to 4.4.0) returns its internal private key when anyone calls the /api/get-certs or /api/get-cert endpoints. Because the key is revealed, an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#casdoor #CVE #infosec", "creation_timestamp": "2026-09-14T18:40:09.496132Z"}, {"uuid": "7cd9b44b-8821-4dc7-b404-e8c5834bdc05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90945", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117270891652982778", "content": "Go fuck with some crawlers.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-90945\n\nCrawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.", "creation_timestamp": "2026-09-14T18:49:59.785124Z"}, {"uuid": "d09cb5a6-1c93-404e-b152-93585b48707c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90945", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvirnkmmka2j", "content": "CVE-2026-90945 - crawlab\nVersions of Crawlab up to 0.6.3 use a fixed secret to create login tokens, and this secret cannot be changed. Because of that, anyone can create a token that looks like it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#crawlab #crawlabteam #CVE #infosec", "creation_timestamp": "2026-09-14T18:50:07.318246Z"}, {"uuid": "dabedf01-3590-4707-babf-3627dda6ba78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90945", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mviscwpqmn22", "content": "\ud83d\udd34 CVE-2026-90945 - Critical (9.8)\n\nCrawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be o...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90945/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T19:02:05.491763Z"}, {"uuid": "a24f1b68-97d3-4d73-ba97-792a714f533b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90946", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvisd6gaee2m", "content": "\ud83d\udfe0 CVE-2026-90946 - High (7.5)\n\nDeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthe...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90946/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T19:02:12.779210Z"}, {"uuid": "10c316f5-b95b-44a7-a5dd-81b3e5000b51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90942", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvivzb3opi2p", "content": "\ud83d\udea8 CVE-2026-90942 \u2014 CVSS 9.3 CRITICAL\n\nCasdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90942\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T20:08:14.041236Z"}, {"uuid": "acd80713-cf33-43b1-a21b-7507fd6ae6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90945", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvivzjiupe25", "content": "\ud83d\udea8 CVE-2026-90945 \u2014 CVSS 9.3 CRITICAL\n\nCrawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90945\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T20:08:22.780083Z"}, {"uuid": "81bb57b4-f082-4194-b587-18a6bd0733c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90942", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvizkajbjq2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-90942: Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, a\u2026\nCVSS 9.6\nhttps://beta.vulnsea.com/cve/CVE-2026-90942\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T21:11:25.014321Z"}]}