https://vulnerability.circl.lu/sightings/feed 2026-09-22T05:57:33.770819+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4f896f31-f117-466d-baeb-e8900a633744/export 2026-09-22T05:57:33.794103+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4f896f31-f117-466d-baeb-e8900a633744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90843", "type": "seen", "source": "https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621", "content": "This daily threat intelligence digest highlights three high-impact vulnerabilities:\n\n\u2022 **CVE-2026-91771 (Weights & Biases, 8.8):** Path traversal in `File.download` (wandb < 0.29.0) allows attackers to write files outside intended directories, potentially enabling remote code execution.\n\u2022 **CVE-2026-90843 (SabyasachiRana WebMap, 8.3):** Remote OS command injection in the `nmap_newscan` function. Publicly exploited; a silent patch is available.\n\u2022 **CVE-2026-85706 (GitLab, 10.0):** Critical unauthenticated path traversal in the repository commits API affects GitLab CE/EE (versions prior to 19.1.8, 19.2.6, and 19.3.2). Enables arbitrary file reads, risking credential theft and CI/CD compromise. Actively exploited, CISA KEV-listed, and patched.\n\n**Recommended Actions:** Prioritize immediate GitLab patching. Hunt logs for malicious API requests, rotate any potentially exposed credentials, and enforce strict access controls and API monitoring across all affected platforms.", "creation_timestamp": "2026-09-15T04:02:20.023098Z"} 2026-09-15T04:02:20.023098+00:00