{"vulnerability": "CVE-2026-8445", "sightings": [{"uuid": "3ee52a06-43a5-4fac-8d72-b9cae2b411cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8445", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtqzg74ap52e", "content": "CVE-2026-8445 - justhtml\nVersions of justhtml up to 1.11.0 do not properly remove angle\u2011bracket characters when turning content into Markdown. This means an attacker could supply seemingly safe text\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#justhtml #emilstenstrom #CVE #infosec", "creation_timestamp": "2026-08-23T14:40:04.102884Z"}, {"uuid": "e6b30a61-ce27-46be-8d92-997fd21b7980", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8445", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtr2lf3rar26", "content": "\ud83d\udd34 CVE-2026-8445 - Critical (9.8)\n\njusthtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant char...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-8445/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-23T15:00:52.458116Z"}, {"uuid": "55570f03-55a6-425a-9382-c3c307718a20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8445", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jqzngrmyxswa2", "content": "CVE-2026-8445 - justhtml before 1.12.0 Sanitizer Bypass via Markdown\nCVE ID : CVE-2026-8445\n \n Published : Aug. 23, 2026, 2:16 p.m. | 1\u00a0hour, 43\u00a0minutes ago\n \n Description : justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters...", "creation_timestamp": "2026-08-23T16:06:39.947938Z"}, {"uuid": "78b91783-84fa-4ddf-b5ee-b6fdb90fb303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8445", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtr6cjtfoo25", "content": "\ud83d\udea8 CVE-2026-8445 \u2014 CVSS 9.3 CRITICAL\n\njusthtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-8445\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-23T16:07:29.789664Z"}, {"uuid": "605b5895-3fa6-4d73-bea9-19bf92909164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8445", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117147542223210427", "content": "CVE-2026-8445: EmilStenstrom justhtml <=1.11.0 suffers CRITICAL XSS due to improper escaping in Markdown output. Remote attackers can inject scripts. Update to v1.12.0 now. https://radar.offseq.com/threat/cve-2026-8445-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-42aabed1c30bf24b #OffSeq #XSS #AppSec #CVE20268445", "creation_timestamp": "2026-08-24T04:54:34.671741Z"}, {"uuid": "4f8c1f92-dd18-4925-ae5c-fc651afe0066", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8445", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtsjhyz56t2t", "content": "CVE-2026-8445 - justhtml\nJustHTML can create malicious HTML when converting certain text inputs to Markdown. This can allow an attacker to inject malicious code into your website. To fix this, you should update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#justhtml #pip #CVE #infosec", "creation_timestamp": "2026-08-24T05:00:04.454736Z"}, {"uuid": "38b9378c-5199-422a-a8ed-c2aee22cd64f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2bv4axqgwkdl5", "content": "CVE-2026-84452 - Windows ML CLI Remote Code Execution Vulnerability\nCVE ID : CVE-2026-84452\n \n Published : Sept. 2, 2026, 8:17 p.m. | 19\u00a0minutes ago\n \n Description : Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows...", "creation_timestamp": "2026-09-02T22:14:27.710592Z"}, {"uuid": "24637668-bac9-420b-a7a0-920ffa2db713", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84452", "type": "published-proof-of-concept", "source": "https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf", "content": "", "creation_timestamp": "2026-09-08T22:35:03.599238Z"}, {"uuid": "11e1bbae-9739-423e-8cca-d398b408a62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv23paew7d22", "content": "CVE-2026-84452 - winml-cli\nVersions of Windows ML CLI before 0.4.0 open a local web service that anyone can talk to, even from a malicious website the user visits. That service lets the site tell the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#winmlcli #microsoft #pip #CVE #infosec", "creation_timestamp": "2026-09-08T22:40:04.820207Z"}, {"uuid": "80954a4d-e05e-4199-bae1-f26de39945fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://gist.github.com/alon710/c5bce716a2c740f354075cb003953b3f", "content": "# CVE-2026-84452: CVE-2026-84452: Localhost Remote Code Execution via CORS Misconfiguration in Windows ML CLI\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84452\n\n## Summary\nA critical vulnerability (CVE-2026-84452) in the Windows ML CLI (winml-cli) HTTP server component allows unauthenticated remote code execution via permissive CORS and lack of request validation.\n\n## TL;DR\nUnauthenticated remote code execution in winml-cli before 0.4.0 via CORS wildcard and lack of loopback verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-942, CWE-306\n- **Attack Vector**: Network (via Browser Cross-Origin Request)\n- **CVSS v4.0 Score**: 8.6\n- **EPSS Score**: 0.00945 (58.83rd percentile)\n- **Impact**: Remote Code Execution\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Windows ML CLI (winml-cli)\n- **winml-cli**: < 0.4.0 (Fixed in: `0.4.0`)\n\n## Mitigation\n\n- Upgrade to winml-cli 0.4.0 or higher\n- Implement browser Private Network Access controls\n- Shut down local dev servers when not in use\n\n**Remediation Steps:**\n1. Run pip install --upgrade winml-cli>=0.4.0\n2. Configure workstation firewall to block incoming external connections to localhost ports\n3. Enable PNA on enterprise browsers\n\n## References\n\n- [GitHub Security Advisory GHSA-96p9-rh4f-92cf](https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf)\n- [Microsoft Fix Commit f4073e0](https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993)\n- [GitHub Pull Request #1321](https://github.com/microsoft/winml-cli/pull/1321)\n- [National Vulnerability Database Record](https://nvd.nist.gov/vuln/detail/CVE-2026-84452)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-84452)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84452) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T09:33:16.652278Z"}, {"uuid": "ba3ce181-e296-4a67-a353-c90e5a768d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84458", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwel4p25su2u", "content": "\ud83d\udea8 CVE-2026-84458 \u2014 CVSS 9.1 CRITICAL\n\nZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the \"Automatic acc...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-84458\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T20:07:50.758770Z"}, {"uuid": "1edefc93-6fe8-4834-bd8b-5ba197e45911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84458", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgkx5qpnk2r", "content": "CVE-2026-84458 - zammad\nIf Zammad\u2019s automatic account linking for single sign\u2011on is turned on, it can link a new login to an existing account just by matching the email address, without checking that the email really\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zammad #CVE #infosec", "creation_timestamp": "2026-09-26T15:10:04.611461Z"}]}