{"vulnerability": "cve-2026-4648", "sightings": [{"uuid": "be472d40-c688-4b57-ab0a-daeeb9a591f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46489", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mm4cln3l4l2s", "content": "SolidInvoice 2.3.17 patches CVE-2026-46489\nBlocks stored XSS via SVG uploads; hashing API tokens limits database breach impact.\nUpgrade carefully.\n\n\u2192 releaseport.com/r/solidinvoice-solidinvoice/2-3-17", "creation_timestamp": "2026-05-18T07:02:50.150630Z"}, {"uuid": "76e56c26-6f2c-422c-84a4-aa18088f0118", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46483", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3h6v5lm2e", "content": "\ud83d\udd17 CVE : CVE-2026-34956, CVE-2026-44431, CVE-2026-46483, CVE-2026-41091, CVE-2026-45498, CVE-2026-45584, CVE-2026-34956, CVE-2026-41091, CVE-2026-44431, CVE-2026-45498, CVE-2026-45584, CVE-2026-46483", "creation_timestamp": "2026-05-20T14:10:07.882523Z"}, {"uuid": "fd43a919-3c49-4789-8cb3-1147bdc0fca9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46481", "type": "published-proof-of-concept", "source": "https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg", "content": "", "creation_timestamp": "2026-05-14T15:37:25.000000Z"}, {"uuid": "a332ecca-8684-4ef0-b51e-d08e863391a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46480", "type": "published-proof-of-concept", "source": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wxrr-jp8m-qq7f", "content": "", "creation_timestamp": "2026-05-14T14:18:32.000000Z"}, {"uuid": "a18d0fcb-33b5-4695-82f7-ba8ae8a94677", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46480", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mns634lsdt2a", "content": "CVE-2026-46480 - Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover\nCVE ID : CVE-2026-46480\n \n Published : June 8, 2026, 4:16 p.m. | 17\u00a0minutes ago\n \n Description : Flowise is a drag & drop user interface to build a customized large ...", "creation_timestamp": "2026-06-08T17:04:50.929081Z"}, {"uuid": "c3f4b572-e654-4050-8ccf-cfd4a922d04e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46481", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnshblm7jb2r", "content": "CVE-2026-46481 - OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users\nCVE ID : CVE-2026-46481\n \n Published : June 8, 2026, 5:16 p.m. | 1\u00a0hour, 58\u00a0minutes ago\n \n Description : OpenMetadata is a unified metadata platform. Prior to...", "creation_timestamp": "2026-06-08T19:49:31.699600Z"}, {"uuid": "9a9a4ac5-1315-4883-9372-9715a65f512e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46486", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnslnc7g4f2a", "content": "CVE-2026-46486 - Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing\nCVE ID : CVE-2026-46486\n \n Published : June 8, 2026, 7:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : MVT (Mobile Verification Toolkit) helps with co...", "creation_timestamp": "2026-06-08T21:07:39.859542Z"}, {"uuid": "04772d45-9c24-4717-a8fb-4f1ab24cd225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46484", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnsmi5uyf52i", "content": "CVE-2026-46484 - Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user\nCVE ID : CVE-2026-46484\n \n Published : June 8, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : Headplane is a feature-complete Web UI for ...", "creation_timestamp": "2026-06-08T21:24:13.111887Z"}, {"uuid": "4ff2020f-80e0-40dd-8a74-13e44beb6bb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46484", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnsoloid3q27", "content": "\ud83d\udfe0 CVE-2026-46484 - High (8.1)\n\nHeadplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, H...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46484/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-08T22:00:27.527789Z"}, {"uuid": "983861e3-7f66-489b-8eea-f0ec2f35d8c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46489", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mo2ak5zje723", "content": "CVE-2026-46489 - SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo\nCVE ID : CVE-2026-46489\n \n Published : June 11, 2026, 8:16 p.m. | 1\u00a0hour, 3\u00a0minutes ago\n \n Description : SolidInvoice is an open-source invoicing platform. ...", "creation_timestamp": "2026-06-11T22:10:28.963940Z"}, {"uuid": "8bfd2d8c-8ec7-4e4b-9714-47cfcc2c5b41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46489", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3moc3igphqc2o", "content": "\ud83d\udfe0 CVE-2026-46489 - High (8.1)\n\nSolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo uplo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46489/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-15T01:01:13.322729Z"}, {"uuid": "5478aad9-5982-499f-9176-1a41f5a2b16e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46488", "type": "published-proof-of-concept", "source": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-r3cw-c95m-wfh9", "content": "", "creation_timestamp": "2026-06-20T16:48:06.000000Z"}, {"uuid": "45859fbb-aa12-49a5-b07e-1d0ce4596cf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46485", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpj5fzol22x", "content": "\ud83d\udfe0 CVE-2026-46485 - High (8.2)\n\nDashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can all...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46485/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-15T20:00:35.434223Z"}, {"uuid": "3458a0cf-5439-4c70-b940-255a9453924c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46485", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpnlvlhdp2m", "content": "CVE-2026-46485 - Dash: Users can write to config despire permissions (OIDC tested)\nCVE ID : CVE-2026-46485\n \n Published : July 15, 2026, 7:17 p.m. | 17\u00a0minutes ago\n \n Description : Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can al...", "creation_timestamp": "2026-07-15T21:20:15.897820Z"}]}