{"vulnerability": "cve-2026-9056", "sightings": [{"uuid": "e218009a-1898-43d6-9eb3-db198bd44ebe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9056", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmbed5i7lf2i", "content": "CVE-2026-9056 - Security fix for Qlik Talend Administration Center cross-site scripting vulnerability\nCVE ID : CVE-2026-9056\n \n Published : May 20, 2026, 5:16 a.m. | 58\u00a0minutes ago\n \n Description : A stored cross-site scripting vulnerability has been found in the Talend Admini...", "creation_timestamp": "2026-05-20T07:16:16.016851Z"}, {"uuid": "f2db427f-728b-4300-ada8-0275cb10ddcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90560", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdrermf7t2s", "content": "\ud83d\udfe0 CVE-2026-90560 - High (8.2)\n\nzstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdD...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90560/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T19:02:01.695234Z"}, {"uuid": "ea74ae3d-079f-47fa-85f0-f327f3d0ff0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90562", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117263618841865453", "content": "LangBot <4.10.11 is affected by CRITICAL CVE-2026-90562: password reset keys generated with only 24 bits of entropy & no rate limiting let attackers brute-force admin resets. Upgrade to 4.10.11+! https://radar.offseq.com/threat/cve-2026-90562-insufficient-entropy-in-langbot-app-langbot-e9a2899a1e2d1fa5 #OffSeq #CVE202690562 #infosec #AppSec", "creation_timestamp": "2026-09-13T12:00:25.742219Z"}, {"uuid": "d5d51e8b-7890-4f2f-9eb8-1fccdd65fac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90562", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvfkc44rgx2p", "content": "LangBot 4.0.8.1 \u2013 4.10.10 has a CRITICAL flaw: weak password reset keys & no rate limiting enable admin password takeovers. Upgrade to 4.10.11+ ASAP. https://radar.offseq.com/threat/cve-2026-90562-insufficient-entropy-in-langbot-app-langbot-e9a2899a1e2d1fa5 #OffSeq #CVE202690562 #AppSec", "creation_timestamp": "2026-09-13T12:00:27.175390Z"}, {"uuid": "17bddd22-5794-4efc-85a9-6bea6c1c0c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfkh3kzys22", "content": "\ud83d\udfe0 CVE-2026-90561 - High (8.7)\n\nStrapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vu...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90561/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T12:03:15.192172Z"}, {"uuid": "375c8ee6-4033-445c-b067-65fd2fc19f4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvfko24id22j", "content": "\ud83d\udea8 CVE-2026-90561 \u2014 CVSS 9.3 CRITICAL\n\nStrapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerabilit...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90561\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T12:07:07.613524Z"}, {"uuid": "ab01e392-5f5d-4fc9-a399-18aca3b03060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvfkoc5v7y2f", "content": "\ud83d\udea8 CVE-2026-90562 \u2014 CVSS 9.2 CRITICAL\n\nLangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate li...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90562\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T12:07:15.798572Z"}, {"uuid": "6f9bdd4f-3244-4ae7-ad28-c5db199c5f87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfnpxbamg2o", "content": "\ud83d\udfe0 CVE-2026-90562 - High (8.1)\n\nLangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90562/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T13:02:03.753457Z"}, {"uuid": "8fbc7029-8f06-4a09-ba70-0c1fded1f7da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvfpci67k72r", "content": "CVE-2026-90561 - strapi\nStrapi versions up to 4.26.2 and before 5.48.1 allow a user with author rights to save malicious code in rich\u2011text fields. When an editor or super\u2011admin opens the preview pane, that code runs\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#strapi #CVE #infosec", "creation_timestamp": "2026-09-13T13:30:08.726185Z"}, {"uuid": "1cde1a38-2e8f-450b-b402-1c470c63c39a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvfpub3t6j2j", "content": "CVE-2026-90562 - langbot\nVersions of LangBot before 4.10.11 create password\u2011reset keys that are easy to guess and do not limit how often the reset function can be called. If an attacker knows the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#langbot #langbotapp #CVE #infosec", "creation_timestamp": "2026-09-13T13:40:05.036966Z"}, {"uuid": "848b5f6f-8023-4b61-a90b-6e6d32bde650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117267511621881553", "content": "Strapi 4.x \u2013 4.26.2 & 5.x<5.48.1: CRITICAL stored XSS (CVE-2026-90561, CVSS 8.7) in WYSIWYG preview lets Author roles execute malicious scripts in higher-privileged sessions. Restrict roles & monitor vendor updates. https://radar.offseq.com/threat/strapi-versions-4x-through-4262-and-5x-before-5481-contain-a-stored-cross-site-scripting-vulnerability-e05bee9fce842336 #OffSeq #Strapi #XSS #Infosec", "creation_timestamp": "2026-09-14T04:30:29.361442Z"}, {"uuid": "ba6a98e0-b0cb-4420-9070-0efb67cd1582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvhdgjejaa25", "content": "Daily IT Security Digest \u2014 2026-09-14\nexploits.\n\n3. **Strapi Stored XSS (CVE-2026-90561, CVSS", "creation_timestamp": "2026-09-14T05:02:57.946415Z"}, {"uuid": "eabab310-894a-4bb2-b313-0a8fb3f5092e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvhjwehwaz2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85046: 26 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-20079: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-51990: 7 interactions\nCVE-2026-90561: 4 interactions\nCVE-2025-59287: 3 interactions\n", "creation_timestamp": "2026-09-14T06:59:12.780017Z"}, {"uuid": "8b224484-4a60-4164-8838-be54084f7fef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvisavgvvd2e", "content": "Strapi CVE-2026-90561 (CVSS 9.3) stored XSS lets an Author execute code in admin sessions \u2014 patch to 5.48.1 or upgrade past 4.26.2 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-14T19:00:55.602744Z"}, {"uuid": "cdd4f469-5488-4301-80c2-6006c80faac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfzr2il2l", "content": "LangBot CVE-2026-90562 (CVSS 9.2) uses 24-bit recovery keys and no rate limiting \u2014 attackers can reset admin passwords. Patch to 4.10.11 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:27:04.055902Z"}]}