https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 17:04:53 +0000 https://vulnerability.circl.lu/sighting/a87868bc-3b4d-411d-a1c6-4968991c05d2/export {"uuid": "a87868bc-3b4d-411d-a1c6-4968991c05d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvknyp247722", "content": "CVE-2026-91771\nThe wandb library (versions before 0.29.0) does not check the file names it receives when downloading files. An attacker who can control the server could trick the library into saving files in any location on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-15T12:50:04.870644Z"} {"uuid": "a87868bc-3b4d-411d-a1c6-4968991c05d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvknyp247722", "content": "CVE-2026-91771\nThe wandb library (versions before 0.29.0) does not check the file names it receives when downloading files. An attacker who can control the server could trick the library into saving files in any location on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-15T12:50:04.870644Z"} https://vulnerability.circl.lu/sighting/a87868bc-3b4d-411d-a1c6-4968991c05d2/export Tue, 15 Sep 2026 12:50:04 +0000 https://vulnerability.circl.lu/sighting/bb250cfd-8a80-4310-a383-0b8278128711/export {"uuid": "bb250cfd-8a80-4310-a383-0b8278128711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621", "content": "This daily threat intelligence digest highlights three high-impact vulnerabilities:\n\n\u2022 **CVE-2026-91771 (Weights & Biases, 8.8):** Path traversal in `File.download` (wandb < 0.29.0) allows attackers to write files outside intended directories, potentially enabling remote code execution.\n\u2022 **CVE-2026-90843 (SabyasachiRana WebMap, 8.3):** Remote OS command injection in the `nmap_newscan` function. Publicly exploited; a silent patch is available.\n\u2022 **CVE-2026-85706 (GitLab, 10.0):** Critical unauthenticated path traversal in the repository commits API affects GitLab CE/EE (versions prior to 19.1.8, 19.2.6, and 19.3.2). Enables arbitrary file reads, risking credential theft and CI/CD compromise. Actively exploited, CISA KEV-listed, and patched.\n\n**Recommended Actions:** Prioritize immediate GitLab patching. Hunt logs for malicious API requests, rotate any potentially exposed credentials, and enforce strict access controls and API monitoring across all affected platforms.", "creation_timestamp": "2026-09-15T04:02:20.076578Z"} {"uuid": "bb250cfd-8a80-4310-a383-0b8278128711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621", "content": "This daily threat intelligence digest highlights three high-impact vulnerabilities:\n\n\u2022 **CVE-2026-91771 (Weights & Biases, 8.8):** Path traversal in `File.download` (wandb < 0.29.0) allows attackers to write files outside intended directories, potentially enabling remote code execution.\n\u2022 **CVE-2026-90843 (SabyasachiRana WebMap, 8.3):** Remote OS command injection in the `nmap_newscan` function. Publicly exploited; a silent patch is available.\n\u2022 **CVE-2026-85706 (GitLab, 10.0):** Critical unauthenticated path traversal in the repository commits API affects GitLab CE/EE (versions prior to 19.1.8, 19.2.6, and 19.3.2). Enables arbitrary file reads, risking credential theft and CI/CD compromise. Actively exploited, CISA KEV-listed, and patched.\n\n**Recommended Actions:** Prioritize immediate GitLab patching. Hunt logs for malicious API requests, rotate any potentially exposed credentials, and enforce strict access controls and API monitoring across all affected platforms.", "creation_timestamp": "2026-09-15T04:02:20.076578Z"} https://vulnerability.circl.lu/sighting/bb250cfd-8a80-4310-a383-0b8278128711/export Tue, 15 Sep 2026 04:02:20 +0000 https://vulnerability.circl.lu/sighting/afbd2205-07f3-43f4-9c30-29a4312252f0/export {"uuid": "afbd2205-07f3-43f4-9c30-29a4312252f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z", "content": "\ud83d\udfe0 CVE-2026-91771 - High (8.8)\n\nWeights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-91771/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T04:00:21.433673Z"} {"uuid": "afbd2205-07f3-43f4-9c30-29a4312252f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z", "content": "\ud83d\udfe0 CVE-2026-91771 - High (8.8)\n\nWeights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-91771/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T04:00:21.433673Z"} https://vulnerability.circl.lu/sighting/afbd2205-07f3-43f4-9c30-29a4312252f0/export Tue, 15 Sep 2026 04:00:21 +0000