{"vulnerability": "cve-2026-91771", "sightings": [{"uuid": "afbd2205-07f3-43f4-9c30-29a4312252f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z", "content": "\ud83d\udfe0 CVE-2026-91771 - High (8.8)\n\nWeights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-91771/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T04:00:21.433673Z"}, {"uuid": "bb250cfd-8a80-4310-a383-0b8278128711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621", "content": "This daily threat intelligence digest highlights three high-impact vulnerabilities:\n\n\u2022 **CVE-2026-91771 (Weights & Biases, 8.8):** Path traversal in `File.download` (wandb < 0.29.0) allows attackers to write files outside intended directories, potentially enabling remote code execution.\n\u2022 **CVE-2026-90843 (SabyasachiRana WebMap, 8.3):** Remote OS command injection in the `nmap_newscan` function. Publicly exploited; a silent patch is available.\n\u2022 **CVE-2026-85706 (GitLab, 10.0):** Critical unauthenticated path traversal in the repository commits API affects GitLab CE/EE (versions prior to 19.1.8, 19.2.6, and 19.3.2). Enables arbitrary file reads, risking credential theft and CI/CD compromise. Actively exploited, CISA KEV-listed, and patched.\n\n**Recommended Actions:** Prioritize immediate GitLab patching. Hunt logs for malicious API requests, rotate any potentially exposed credentials, and enforce strict access controls and API monitoring across all affected platforms.", "creation_timestamp": "2026-09-15T04:02:20.076578Z"}, {"uuid": "a87868bc-3b4d-411d-a1c6-4968991c05d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91771", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvknyp247722", "content": "CVE-2026-91771\nThe wandb library (versions before 0.29.0) does not check the file names it receives when downloading files. An attacker who can control the server could trick the library into saving files in any location on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-15T12:50:04.870644Z"}]}