{"vulnerability": "cve-2026-9448", "sightings": [{"uuid": "45921612-608f-43f3-8509-35887889a9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94488", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4rbg2usddcdnl", "content": "CVE-2026-94488 - Telegram Desktop Cross-Site Scripting Vulnerability\nCVE ID : CVE-2026-94488\n \n Published : Sept. 21, 2026, 5:29 p.m. | 11\u00a0minutes ago\n \n Description : Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) Thi...", "creation_timestamp": "2026-09-21T18:18:43.775141Z"}, {"uuid": "fd72e3c8-b7e8-4f8d-8826-4e96e95b4b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94489", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hkaferjie64xv", "content": "CVE-2026-94489 - OctoPrint File Download API files.py _validate path traversal\nCVE ID : CVE-2026-94489\n \n Published : Sept. 22, 2026, 12:16 a.m. | 25\u00a0minutes ago\n \n Description : A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function ...", "creation_timestamp": "2026-09-22T01:34:44.263587Z"}, {"uuid": "de23b478-50f2-480a-8fb3-9d1b68ed3af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94488", "type": "seen", "source": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488", "content": "", "creation_timestamp": "2026-09-22T12:15:02.603626Z"}, {"uuid": "ca9839b2-3619-457d-9fc4-29672984baac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94488", "type": "seen", "source": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488", "content": "Disponibile una Proof of Concept (PoC) per lo sfruttamento della CVE-2026-94488 - gi\u00e0 sanata dal vendor - presente in Telegram Desktop, client desktop dell'omonima piattaforma di messaggistica. Tale vulnerabilit\u00e0 potrebbe consentire a un utente malintenzionato remoto di eludere i meccanismi di sicurezza sui sistemi interessati.", "creation_timestamp": "2026-09-23T01:00:43.320282Z"}, {"uuid": "be1c109d-001c-46ae-80fa-908b7ca2aec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94489", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117355552432289617", "content": "CVE-2026-94489 OctoPrint path traversal in the File Download API, CVSS 4.3. Exploit is public, no vendor response, no patch. Isolate or restrict access now. https://www.valtersit.com/cve/CVE-2026-94489/ #CVE #infosec #OctoPrint", "creation_timestamp": "2026-09-29T17:40:22.185157Z"}, {"uuid": "30868e7b-717f-473e-bacc-59452a5ef1e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94483", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mxaa7jp56e2m", "content": "\ud83d\udccc CVE-2026-94483 - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS... https://www.cyberhub.blog/cves/CVE-2026-94483", "creation_timestamp": "2026-10-06T20:07:08.203742Z"}, {"uuid": "4da0c89a-3fe4-4297-8556-3e17459fd81b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94483", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mxabck7sar25", "content": "\ud83d\udccc CVE-2026-94483 - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS... https://www.potatohub.blog/cves/CVE-2026-94483", "creation_timestamp": "2026-10-06T20:26:42.376600Z"}]}