{"vulnerability": "cve-2026-9453", "sightings": [{"uuid": "98507354-1084-4d4f-a4fc-1dc82dafce13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94533", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117350006923025248", "content": "CVE-2026-94533: authorization bypass in Fileanyonecontroller (lamp-cloud up to 5.10.0) lets any authenticated user download other users' files via the /anyone/file/down endpoint. CVSS 6.5, no patch yet. Audit access and https://www.valtersit.com/cve/CVE-2026-94533/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-28T18:10:06.889028Z"}, {"uuid": "4f46477a-a7fb-455c-80ce-6c5a815ea53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94533", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwlx2l6fv427", "content": "CVE-2026-94533: authorization bypass in Fileanyonecontroller (lamp-cloud up to 5.10.0) lets any authenticated user download other users' files via the /anyone/file/down endpoint. CVSS 6.5, no patch yet. Audit access and https://www.valtersit.com/cve/CVE-2026-94533/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-28T18:30:04.137814Z"}, {"uuid": "bb264d40-e8fc-494a-873e-3fb2f78d3c1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94532", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117359247491416373", "content": "CVE-2026-94532 lamp-cloud through 5.10.0 auth bypass in getUserInfoById lets any authenticated user harvest others' PII by iterating userId. CVSS 6.5, unpatched. Restrict access now. https://www.valtersit.com/cve/CVE-2026-94532/ #CVE #infosec", "creation_timestamp": "2026-09-30T09:20:03.035685Z"}, {"uuid": "97d4e1d3-4d83-431c-ac46-27e705dc6556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94536", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117364045932194812", "content": "CVE-2026-94536 lamp-cloud through 5.10.0: no employeeId validation on /anyone/visible/resource lets any authenticated user read other employees' roles, permissions and router trees. CVSS 4.3, unpatched. Review access https://www.valtersit.com/cve/CVE-2026-94536/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-10-01T05:40:21.510897Z"}, {"uuid": "0edf9804-5572-491a-afe9-20dd0646c8d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94536", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mws6kafmve2f", "content": "CVE-2026-94536 lamp-cloud through 5.10.0: no employeeId validation on /anyone/visible/resource lets any authenticated user read other employees' roles, permissions and router trees. CVSS 4.3, unpatched. Review access https://www.valtersit.com/cve/CVE-2026-94536/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-10-01T06:00:05.076108Z"}, {"uuid": "59382fd7-b5bd-4e23-9ff5-88cdbff1a415", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94535", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117393694545959067", "content": "CVE-2026-94535 lamp-cloud up to 5.10.0: auth bypass in deleteMyNotice endpoint lets any authenticated user delete other users' notifications. CVSS 7.1, no patch yet. Restrict endpoint access now. https://www.valtersit.com/cve/CVE-2026-94535/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-10-06T11:20:23.350823Z"}, {"uuid": "fa8d8dd1-0f73-4a0c-a382-2b066fdcf4fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94534", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117400377896367818", "content": "CVE-2026-94534 lamp-cloud through 5.10.0 fails to validate identity on PUT /anyone/baseInfo and /anyone/avatar, letting any authenticated user rewrite other users profiles. CVSS 7.1, no patch yet. Restrict access now. https://www.valtersit.com/cve/CVE-2026-94534/ #CVE #infosec", "creation_timestamp": "2026-10-07T15:40:05.604338Z"}]}