{"vulnerability": "cve-2026-8518", "sightings": [{"uuid": "6a014bac-73ae-4a60-9308-e8d5fe5bdb4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8518", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260515", "content": "", "creation_timestamp": "2026-05-14T18:00:00.000000Z"}, {"uuid": "427b01bd-c273-43c1-8107-51018c64f112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8518", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260518", "content": "", "creation_timestamp": "2026-05-17T18:00:00.000000Z"}, {"uuid": "daa619fc-2c91-4dc7-9cb4-f408bd577687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85181", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumqrvsg3k2l", "content": "CVE-2026-85181 - cat\nThe CAT web tool (up to version 3.1.0) checks session cookies with an insecure method that can be copied and altered without a secret key. Because of this, someone could craft a valid\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cat #dianping #CVE #infosec", "creation_timestamp": "2026-09-03T15:20:05.985598Z"}, {"uuid": "a183147b-12d0-49f5-b3d9-ce48f498b2cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85183", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumrdq2g3u2y", "content": "CVE-2026-85183 - taipy\nTaipy's real\u2011time communication feature is set to accept requests from any web page, meaning a malicious site could connect and change application data or trigger actions without\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#taipy #avaiga #CVE #infosec", "creation_timestamp": "2026-09-03T15:30:04.531779Z"}, {"uuid": "e4cb74ae-5cbc-4810-9a8d-3f98620bc4ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85181", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mumthgeu2r2w", "content": "\ud83d\udea8 CVE-2026-85181 \u2014 CVSS 9.3 CRITICAL\n\nCAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85181\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-03T16:07:55.344223Z"}, {"uuid": "6a4e0053-7214-4b7c-be5c-1be025b855b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85183", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mumthowyxp2y", "content": "\ud83d\udea8 CVE-2026-85183 \u2014 CVSS 9.3 CRITICAL\n\nTaipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any w...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85183\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-03T16:08:04.461462Z"}, {"uuid": "03fd4d21-1421-4d80-b5ce-c3559f977086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85184", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3muonnibgck25", "content": "\ud83d\udea8 Critical-severity security fix in @fastify/middie@9.3.4 just released!\n\nPatches CVE-2026-85184: path-scoped middleware bypass via absolute-form request target. \n\ngithub.com/fastify/midd...", "creation_timestamp": "2026-09-04T09:29:18.237916Z"}, {"uuid": "e3bafa65-53cd-40f9-aa33-980bf0a3d7fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85184", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muor2bmavz2o", "content": "CVE-2026-85184\nIf you use Fastify with the @fastify/middie package version 9.1.0 through 9.3.3, a specially crafted request can avoid the middleware that checks login or permissions. This lets an unauthenticated user reach\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-04T10:30:07.067605Z"}, {"uuid": "0f7222cb-9e5d-4775-8a28-0582fb61c090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85184", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2tjbibd4j4meo", "content": "CVE-2026-85184 - @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target\nCVE ID : CVE-2026-85184\n \n Published : Sept. 4, 2026, 10:17 a.m. | 20\u00a0minutes ago\n \n Description : @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether...", "creation_timestamp": "2026-09-04T10:44:42.567352Z"}, {"uuid": "3b779bbf-a620-4203-842f-24220446f467", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85184", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muowikdvj72w", "content": "\ud83d\udea8 CVE-2026-85184 \u2014 CVSS 9.1 CRITICAL\n\n@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85184\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-04T12:07:33.853395Z"}, {"uuid": "c034ed4f-54ab-4913-9897-1d4919313c39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85187", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3muqb3wymep2g", "content": "CVE-2026-85187: SQL injection in itsourcecode Online Medicine Delivery System v1.0 via Order::pupdate in /rider/orders/controller.php. Remote exploit, publicly disclosed. CVSS 7.3. No patch available. Update immediately or restrict access. https://www.valtersit.com/cve/CVE-2026-8", "creation_timestamp": "2026-09-05T00:50:02.055782Z"}, {"uuid": "7cc23e6d-06b8-4242-adc6-db3fe417bade", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85187", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117215684287540337", "content": "CVE-2026-85187: SQL injection in itsourcecode Online Medicine Delivery System v1.0 via Order::pupdate in /rider/orders/controller.php. Remote exploit, publicly disclosed. CVSS 7.3. No patch available. Update immediately or restrict access. https://www.valtersit.com/cve/CVE-2026-8", "creation_timestamp": "2026-09-05T00:50:04.055586Z"}]}