{"vulnerability": "CVE-2026-5288", "sightings": [{"uuid": "9bb01c79-b716-4849-bbb9-2d656031b570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3migahejbzd2j", "content": "", "creation_timestamp": "2026-04-01T08:09:34.646103Z"}, {"uuid": "e124358a-cdc3-4ef8-a7ff-666bb4b27e75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3migwwsv3bn2s", "content": "", "creation_timestamp": "2026-04-01T14:51:55.503812Z"}, {"uuid": "ae7725c1-879c-4956-9019-ff8bb402d37f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3migyl6zc7s2m", "content": "", "creation_timestamp": "2026-04-01T15:21:13.259487Z"}, {"uuid": "e35b54d8-c41b-4491-a84f-ddfc58cc308f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mitfqm3ajc2c", "content": "", "creation_timestamp": "2026-04-06T13:48:51.059684Z"}, {"uuid": "818a51bb-ef5a-4924-8a9d-0f76636c6cc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260402", "content": "", "creation_timestamp": "2026-04-01T18:00:00.000000Z"}, {"uuid": "35f93c95-840f-4ff1-b65e-b02afa2be83c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "d607e6c0-7ef8-4d95-b7fa-ecfa223af800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5288", "type": "seen", "source": "Telegram/4u6pNJfi3nLv5HBYbkAV_RO5hA7CasKnKFj2guWNAP2iZfQ", "content": "", "creation_timestamp": "2026-04-01T15:25:59.000000Z"}, {"uuid": "1ad996e2-7588-4ec5-af76-af8de0eddccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "published-proof-of-concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "content": "", "creation_timestamp": "2026-08-03T11:08:45.204832Z"}, {"uuid": "07ebaf4c-e864-4f9f-b24e-e0e96a5c4bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "seen", "source": "https://t.me/GithubRedTeam/96368", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52887-NocoBase-SQLi-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiiTts\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:57:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-52887 \u2014 NocoBase SQL injection -> PostgreSQL-superuser RCE (myInAppChannels:list filter, CVSS 10.0). Author PoC + source analysis + docker lab.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T05:00:03.076625Z"}, {"uuid": "1eba33c4-35bd-4065-92b4-cb0511bbc4b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "seen", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-03T08:00:03.201612Z"}, {"uuid": "190e64b4-e899-4bba-b4b0-2f6f58d91bda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52880", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w4c6-7r69-w7j9", "content": "", "creation_timestamp": "2026-06-02T10:32:57.000000Z"}, {"uuid": "5c8fa7df-f85f-47e7-9073-3121042dbb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mnwlmv624n2n", "content": "Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)\n\nDiscussion", "creation_timestamp": "2026-06-10T11:18:20.087854Z"}, {"uuid": "279b85b4-b711-4fe4-8d66-2cb92ac29f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mnwlpjjr3e22", "content": "Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)\ncomments \u00b7 posted on 2026.06.10 at 05:28:40 (c=1, p=5)", "creation_timestamp": "2026-06-10T11:19:33.256164Z"}, {"uuid": "5b8a55a9-1c98-4767-8311-995c5474a08c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3mnwlqi37xp23", "content": "Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884) | Discussion", "creation_timestamp": "2026-06-10T11:20:05.719626Z"}, {"uuid": "db25eeee-b827-47a6-a9d1-19fc5cd65f70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mnwlsm7jik2c", "content": "Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)\nDiscussion | hackernews | Author: ringzeropirate", "creation_timestamp": "2026-06-10T11:21:52.916716Z"}, {"uuid": "f94e41f4-d684-499e-b880-c9f4942108d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mnwmdrqrxc2q", "content": "Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)\n\nhttps://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6", "creation_timestamp": "2026-06-10T11:30:53.385979Z"}, {"uuid": "c7a254f7-a9da-4de7-966c-9a6b3f161f97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3mnwo7xvt7d2u", "content": "Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884) https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6 (https://news.ycombinator.com/item?id=48473731)", "creation_timestamp": "2026-06-10T12:04:33.003852Z"}, {"uuid": "e0ac51a0-ac9c-4d9b-973b-f500163f71ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/sagalinked.bsky.social/post/3mny3xvfhz227", "content": "\ud83d\udcf0 A critical security vulnerability has been discovered in Notepad++, allowing for remote code execution via path traversal (CVE-2026-52884).\n\n\ud83d\udd17 https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6\n\n#Tech #Dev", "creation_timestamp": "2026-06-11T01:43:14.272238Z"}, {"uuid": "a2201426-0143-4da3-a787-1e8e476bbcdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mny6npocp42d", "content": "Top 3 CVE for last 7 days:\nCVE-2025-10263: 24 interactions\nCVE-2026-11645: 23 interactions\nCVE-2015-5119: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-10263: 22 interactions\nCVE-2026-10520: 17 interactions\nCVE-2026-52884: 7 interactions\n", "creation_timestamp": "2026-06-11T02:31:14.547717Z"}, {"uuid": "67c2d3d5-1569-453e-973c-5b29c09ba2f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52885", "type": "published-proof-of-concept", "source": "Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8", "content": "", "creation_timestamp": "2026-06-09T19:00:13.000000Z"}, {"uuid": "6177690a-07e7-456b-940e-608d91ea0303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7xhjvf6h2q", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-52884](https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6...\nhttps://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4 #Vulnerability #CVE #ZeroDay", "creation_timestamp": "2026-06-26T22:08:59.488257Z"}, {"uuid": "a663e300-3be2-4d78-9760-9c350c9fdc6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52885", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xwnrx5d23", "content": "CVE-2026-52885 - Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory\nCVE ID : CVE-2026-52885\n \n Published : June 26, 2026, 8:19 p.m. | 1\u00a0hour, 26\u00a0minutes ago\n \n Description : Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks ...", "creation_timestamp": "2026-06-26T22:17:26.719587Z"}, {"uuid": "f52216d3-7457-4fcb-8f80-ad0928cd339d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpe54rn2dj2x", "content": "\ud83d\udfe0 CVE-2026-52884 - High (7.8)\n\nNotepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-52884/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-28T14:01:00.747021Z"}, {"uuid": "735edb88-92aa-4fc6-adb6-bd5774d107b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgpxqx6qt2t", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-52884 \u0432 Notepad++: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/CD5DBF76-1F74-4B0E-B60C-94AED1D8D9D7", "creation_timestamp": "2026-06-29T14:43:31.701202Z"}, {"uuid": "68b610a0-7783-4f64-a59b-8dad20584087", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52885", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgq7a2jh22t", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-52885 \u0432 Notepad++: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/38F9CF36-82B5-4B22-97FD-D6AA6AD4C2B0", "creation_timestamp": "2026-06-29T14:47:42.475905Z"}, {"uuid": "f2227c84-c78c-4d67-85ef-a4ef8c35511c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mph7foecqu2n", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-52884 \u0432 Notepad++: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/5CBA5C4B-F9A6-4123-BF72-643035B15073", "creation_timestamp": "2026-06-29T19:19:44.890968Z"}, {"uuid": "da8c206b-62b2-4115-a432-be03657d4234", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52885", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mph7n5q2772g", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-52885 \u0432 Notepad++: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7ED60CAB-E334-45B7-99C5-FCFE744A0D05", "creation_timestamp": "2026-06-29T19:23:55.880317Z"}, {"uuid": "156aa088-827b-466f-9ac2-8fc2920c412e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52885", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mph7n7lquc2v", "content": "Notepad++ \u5b89\u5168\u6f0f\u6d1e CVE-2026-52885 \u6df1\u5ea6\u89e3\u6790:\u6f0f\u6d1e\u6210\u56e0\u3001\u5f71\u54cd\u53ca\u4fee\u590d\u6307\u5357\n\n\n\nhttps://qian.cx/posts/5C5073C9-991C-4136-ADD8-57701EA7DEF5", "creation_timestamp": "2026-06-29T19:23:58.046093Z"}, {"uuid": "2cf77289-34ec-43cb-be5d-d57cf5e58f19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52889", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mpylw6zxqa23", "content": "\u26a0\ufe0f PATCH NOW\n\nFormie, a popular form plugin for Craft CMS, has a critical flaw (CVSS 9.8): a hidden field can run attacker-supplied template code, no login needed.\n\nIt's the second such bug in five weeks.\n\nFix: update to Formie 3.1.27. (CVE-2026-52889)", "creation_timestamp": "2026-07-06T17:19:00.442093Z"}, {"uuid": "ade2a912-2f22-424a-beb2-5e31ce7e0fce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52889", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpymggmgx42r", "content": "CVE-2026-52889 - formie\nAn unauthenticated attacker can execute server-side code by visiting a public form with a hidden field that uses a dynamic default value. This could lead to sensitive\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#formie #verbb #composer #CVE #infosec", "creation_timestamp": "2026-07-06T17:28:04.544539Z"}, {"uuid": "e320e78f-14ab-4a53-912b-e8df0919ebfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "seen", "source": "https://t.me/bdufstecru/3242", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 isInTrustedDirectory() \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f RunDlg.cpp \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0433\u043e \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 Notepad++ \u0441\u0432\u044f\u0437\u0430\u043d\u0430 c \u043d\u0435\u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u044b\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0443\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-08136\nCVE-2026-52884\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://notepad-plus-plus.org/news/v8962-released/\nhttps://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\u041a\u0430\u043d\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u0439\u0442\u0435 \u043f\u0443\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044e PathCanonicalize() \u0438\u043b\u0438 GetFullPathNameW() \u043f\u0435\u0440\u0435\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439:\nbool isInTrustedDirectory(const wchar_t* path) {\nwchar_t canonicalPath[MAX_PATH] = {};\n// Resolve .., ., and redundant separators\nif (!PathCanonicalize(canonicalPath, path))\nreturn false;\n// NOW check against trusted directories\nfor (auto& trusted : trustedDirs) {\nif (PathIsPrefix(trusted, canonicalPath))\nreturn true;\n}\nreturn false;\n}", "creation_timestamp": "2026-07-14T01:00:06.375883Z"}, {"uuid": "1c33dcaa-9450-4e4d-89e6-e88c1051dde2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52884", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3242", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 isInTrustedDirectory() \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f RunDlg.cpp \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0433\u043e \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 Notepad++ \u0441\u0432\u044f\u0437\u0430\u043d\u0430 c \u043d\u0435\u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u044b\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0443\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-08136\nCVE-2026-52884\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://notepad-plus-plus.org/news/v8962-released/\nhttps://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\u041a\u0430\u043d\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u0439\u0442\u0435 \u043f\u0443\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044e PathCanonicalize() \u0438\u043b\u0438 GetFullPathNameW() \u043f\u0435\u0440\u0435\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439:\nbool isInTrustedDirectory(const wchar_t* path) {\nwchar_t canonicalPath[MAX_PATH] = {};\n// Resolve .., ., and redundant separators\nif (!PathCanonicalize(canonicalPath, path))\nreturn false;\n// NOW check against trusted directories\nfor (auto& trusted : trustedDirs) {\nif (PathIsPrefix(trusted, canonicalPath))\nreturn true;\n}\nreturn false;\n}", "creation_timestamp": "2026-07-15T00:00:34.112919Z"}, {"uuid": "9f32425d-87b0-443f-a33c-d6d34444d404", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52886", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqnoeb25ov2m", "content": "Notepad++ vulnerabilities now have public PoC exploit code. CVE-2026-52886, CVE-2026-54758, and CVE-2026-57233 are fixed in v8.9.7. Update now.\n\n#NotepadPlusPlus #PathTraversal #ZipSlip #CVE #InfoSec", "creation_timestamp": "2026-07-15T02:28:34.291222Z"}, {"uuid": "d1c603b7-6789-4e95-88fc-3c2faf3c8e19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52881", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpey6zobs2c", "content": "CVE-2026-52881 - mantisbt\nA security flaw in MantisBT allows attackers to trick administrators into revealing their login credentials or being redirected to malicious websites. To protect your MantisBT\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mantisbt #composer #CVE #infosec", "creation_timestamp": "2026-07-15T18:46:04.665009Z"}, {"uuid": "1483f96f-83fc-42a4-9094-737a55f038ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpmoxunof2w", "content": "CVE-2026-52887 - nocobase\nNocoBase's in-app messaging feature allows attackers to inject malicious SQL code. This could potentially give an attacker control over a database and allow them to execute unauthorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nocobase #CVE #infosec", "creation_timestamp": "2026-07-15T21:04:09.596663Z"}, {"uuid": "10446587-7ea4-43a9-800e-78071230b658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqppu2ragj2n", "content": "\ud83d\udd34 CVE-2026-52887 - Critical (10)\n\nNocoBase is an AI-powered no-code/low-code platform for building business applications and enterp...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-52887/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-15T22:00:37.725597Z"}, {"uuid": "5d5386bf-7c45-4299-99f4-54f4a58f48bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpzjwga2c2m", "content": "CVE-2026-52887 - NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE\nCVE ID : CVE-2026-52887\n \n Published : July 15, 2026, 9:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : NocoBase is an AI-powered no-code/low-code platform for building business ...", "creation_timestamp": "2026-07-16T00:53:54.505971Z"}, {"uuid": "82142bb1-329f-492b-b5b9-886422eae2be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52886", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mqsdv3qvdc2r", "content": "Notepad++\u3001v8.9.7\u30675\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63(CVE-2026-54758,CVE-2026-52886)\u904e\u53bb\u306e\u4e2d\u56fd\u7cfbAPT\u4e57\u3063\u53d6\u308a\u4e8b\u4ef6\u3092\u8e0f\u307e\u3048\u8981\u6ce8\u610f\n\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews", "creation_timestamp": "2026-07-16T23:04:31.008870Z"}, {"uuid": "ceee62dd-89d8-4432-a90e-225a9f47b7f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52886", "type": "seen", "source": "https://www.acn.gov.it/portale/w/notepad-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-57233-cve-2026-52886-e-cve-2026-54758", "content": "", "creation_timestamp": "2026-07-17T16:15:05.429006Z"}, {"uuid": "a6a594e6-cfdd-41ad-90df-bd8c7af69e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52886", "type": "seen", "source": "https://www.acn.gov.it/portale/w/notepad-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-57233-cve-2026-52886-e-cve-2026-54758", "content": "DisponibilI Proof of Concept (PoC) per le vulnerabilit\u00e0 identificate dalle CVE-2026-57233, CVE-2026-52886 e CVE-2026-54758 \u2013 gi\u00e0 sanate dal vendor \u2013 presenti nel software \"Notepad++\", noto editor di testo avanzato per Windows.", "creation_timestamp": "2026-07-18T01:00:52.249849Z"}, {"uuid": "6dec95bb-db51-4cee-ad51-edf0c9570e16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52887", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvfustm4y2s", "content": "CVE-2026-52887\nA security issue in NocoBase's notification plugin could allow an authenticated user to execute malicious code on the database. This could lead to unauthorized access and data theft. NocoBase has released a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-18T04:18:03.711327Z"}, {"uuid": "a7e4e904-0212-47ef-8b84-580c696162b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52888", "type": "seen", "source": "https://gist.github.com/alon710/f64be2d49b2d7a1297c03bef66babfa4", "content": "# CVE-2026-52888: CVE-2026-52888: Sensitive Data Exposure and Blacklist Bypass in NocoBase SQL Collection Plugin\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52888\n\n## Summary\nNocoBase, an extensible low-code platform, was found to contain an information exposure vulnerability in its SQL Collection plugin. The validator designed to inspect SQL queries used an incomplete keyword-based blacklist, allowing users with administrative or collection creation privileges to bypass restrictions and execute arbitrary SELECT queries against PostgreSQL system catalogs. This flaw permits unauthenticated or privilege-escalated access to critical system files, active connection listings, and system user password hashes.\n\n## TL;DR\nNocoBase versions prior to 2.1.0-alpha.46 used an incomplete blacklist in checkSQL() validator, enabling privileged users to read system databases, query schema metadata, and extract PostgreSQL MD5/SCRAM password hashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-184\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 6.8\n- **EPSS Score**: 0.00269\n- **Exploit Maturity**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- NocoBase low-code/no-code platform\n- NocoBase SQL Collection Plugin (@nocobase/plugin-collection-sql)\n- **@nocobase/plugin-collection-sql**: <= 2.0.59 (Fixed in: `2.1.0-alpha.46`)\n\n## Mitigation\n\n- Upgrade NocoBase installation to version 2.1.0-alpha.46, 2.0.62, or later.\n- Enforce Least Privilege (least-privilege database user configurations) to prevent access to the system catalog.\n- Revoke access rights on 'pg_shadow' and 'pg_authid' tables for the NocoBase connection user.\n\n**Remediation Steps:**\n1. Identify all active NocoBase deployments utilizing PostgreSQL backends.\n2. Apply the patch using the official repository updates or upgrade the Docker container image to tag v2.0.62.\n3. Modify database privileges so that the database user account does not possess 'superuser' or 'rds_superuser' privileges.\n4. Audit active database tables for exposed application tokens and rotate database credentials.\n\n## References\n\n- [NocoBase Security Advisory GHSA-v8vm-cqh8-q87q](https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q)\n- [NocoBase Patch Commit 87c5489](https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52888) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T21:31:27.843543Z"}, {"uuid": "611b173e-484c-4802-b783-edfa582fe21d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52888", "type": "published-proof-of-concept", "source": "https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q", "content": "", "creation_timestamp": "2026-07-28T22:35:34.813368Z"}]}