{"vulnerability": "CVE-2026-10855", "sightings": [{"uuid": "e9ae7ef5-348c-41a1-80d4-91de07976bfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10855", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnhvjeg3gk2b", "content": "CVE-2026-10855 - MISP Event template importer authorization bypass\nCVE ID : CVE-2026-10855\n \n Published : June 4, 2026, 2:16 p.m. | 16\u00a0minutes ago\n \n Description : An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event tem...", "creation_timestamp": "2026-06-04T15:05:12.709598Z"}, {"uuid": "4db426a6-1571-4ffb-ba6c-91778a544299", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108550", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417155210142622", "content": "CVE-2026-108550 SkillHub before 0.2.22 Account Takeover via Account Merge Flow SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108550https://github.com/iflytek/skillhub/issues/921https://github.com/iflytek/skillhubhttps://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4https://github.com/iflytek/skillhub/releases/tag/v0.2.22https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow#iflytek #skillhub#CVE_2026_108550#bot", "creation_timestamp": "2026-10-10T14:46:44.171162Z"}, {"uuid": "1a74d0b8-d47c-4624-a7e6-34f3a9e9e6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108551", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417157854300985", "content": "CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108551https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809https://github.com/ferdikoomen/openapi-typescript-codegenhttps://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L110https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23https://www.vulncheck.com/advisories/openapi-typescript-codegen-through-0.31.0-code-injection-via-handlebars-templates#ferdikoomen #openapi-typescript-codegen#CVE_2026_108551#bot", "creation_timestamp": "2026-10-10T14:47:24.525582Z"}, {"uuid": "8408c375-4293-47d7-913c-bc2bd047b8c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108553", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417182801773432", "content": "CVE-2026-108553 OpenRefine through 3.10.1 CSRF to RCE via get-rows Command OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108553https://github.com/OpenRefine/OpenRefine/issues/7999https://github.com/OpenRefine/OpenRefinehttps://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.java#L174-L186https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.java#L327-L339https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.java#L142https://www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command#OpenRefine#CVE_2026_108553#bot", "creation_timestamp": "2026-10-10T14:53:45.199296Z"}, {"uuid": "06ff5097-3c6a-4e6a-b07e-9eecdf6735c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108554", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417185448178755", "content": "CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108554https://github.com/PDFMathTranslate/PDFMathTranslate/issues/1188https://github.com/PDFMathTranslate/PDFMathTranslatehttps://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L149-L179https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L257-L269https://www.vulncheck.com/advisories/pdfmathtranslate-through-1.9.11-ssrf-via-gradio-web-gui-link-input#PDFMathTranslate#CVE_2026_108554#bot", "creation_timestamp": "2026-10-10T14:54:25.626685Z"}, {"uuid": "c387aec7-5124-48a2-8db2-720814018579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108555", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417188089909882", "content": "CVE-2026-108555 PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108555https://github.com/schlagmichdoch/PairDrop/issues/510https://github.com/schlagmichdoch/PairDrophttps://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/peer.js#L44-L54https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/ws-server.js#L312-L314https://www.vulncheck.com/advisories/pairdrop-through-1.11.2-ip-spoofing-via-cf-connecting-ip-header#schlagmichdoch #PairDrop#CVE_2026_108555#bot", "creation_timestamp": "2026-10-10T14:55:07.123916Z"}, {"uuid": "990b1a74-4476-45b6-b156-1e2d2ee0b1d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108551", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxjt5q52uf27", "content": "CVE-2026-108551 - openapi-typescript-codegen\nThe openapi-typescript-codegen tool (up to version 0.31.0) can run malicious code if an attacker supplies a crafted OpenAPI file. By inserting a single quote into\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ferdikoomen #CVE #infosec", "creation_timestamp": "2026-10-10T15:40:05.892841Z"}, {"uuid": "e1fab70e-649f-410f-bdf6-10b5a25bb8a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108551", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxjzg5b3xq2b", "content": "\ud83d\udd34 CVE-2026-108551 - Critical (9.8)\n\nopenapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows att...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108551/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T17:32:11.051967Z"}, {"uuid": "f606e309-7dc4-47cf-aae0-52c20c09078a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108551", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxjuoatyti2w", "content": "\ud83d\udea8 CVE-2026-108551 \u2014 CVSS 9.3 CRITICAL\n\nopenapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers con...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108551\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T16:07:13.849945Z"}, {"uuid": "a0c3b676-28ee-4297-9801-70011fd6e612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108550", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxjzfwyhxz2d", "content": "\ud83d\udfe0 CVE-2026-108550 - High (8.8)\n\nSkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108550/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T17:32:04.460848Z"}, {"uuid": "fa04b1a3-bccf-49e2-a02b-5d79944a0b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108553", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxk26rpptw2e", "content": "\ud83d\udfe0 CVE-2026-108553 - High (7.5)\n\nOpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows com...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108553/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T17:45:57.963045Z"}, {"uuid": "6da4540e-8be1-4f68-9db0-73e7851c6d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108550", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxl3f4r5f22n", "content": "CVE-2026-108550 - skillhub\nVersions of SkillHub earlier than 0.2.22 let a signed\u2011in user hijack another person's account by misusing the account\u2011merge feature. The attacker can merge into the victim's\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#skillhub #iflytek #CVE #infosec", "creation_timestamp": "2026-10-11T03:40:03.751073Z"}, {"uuid": "260a49db-b308-4280-851d-e3c686ee7f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108553", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxl3f6bpos22", "content": "CVE-2026-108553 - openrefine\nThe OpenRefine tool (versions up to 3.10.1) can be tricked into running system commands if a logged\u2011in user clicks a specially crafted link on another website. An attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openrefine #Debian12 #CVE #infosec", "creation_timestamp": "2026-10-11T03:40:05.118373Z"}]}