{"vulnerability": "cve-2026-9193", "sightings": [{"uuid": "87866498-a0b7-45a4-b77e-c8e5c6343b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9193", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdzu72j3b23", "content": "CVE-2026-9193\nA security issue in Progress MarkLogic Server's Hadoop integration allows a user with limited access to gain more power and access sensitive areas. This affects versions before 11.3.6 and 12.0.3. To stay safe,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-05T17:18:05.451893Z"}, {"uuid": "12e15b76-8dfa-487d-91fe-b7cdec89b657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-9193", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781", "content": "", "creation_timestamp": "2026-08-06T16:15:53.894229Z"}, {"uuid": "4e993b3e-49f4-4328-9bb8-9b3399956f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9193", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muqjcdrh6s2b", "content": "Progress\u306eDB\u88fd\u54c1\u300cMarkLogic Server\u300d\u306b\u8106\u5f31\u6027 - \u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d7\u4ef6\n\nProgress Software\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u88fd\u54c1\u300cMarkLogic Server\u300d\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u3001\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u3002\u91cd\u8981\u5ea6\u304c\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d\u3068\u3055\u308c\u308b\u8106\u5f31\u6027\u3082\u8907\u6570\u4fee\u6b63\u3055\u308c\u3066\u3044\u308b\u3002\n\n...\n\n\u3053\u306e\u3046\u30617\u4ef6\u306b\u3064\u3044\u3066\u306f\u3001\u5171\u901a\u8106\u5f31\u6027\u8a55\u4fa1\u30b7\u30b9\u30c6\u30e0\u300cCVSSv3.1\u300d\u306e\u30d9\u30fc\u30b9\u30b9\u30b3\u30a2\u304c\u300c9.0\u300d\u4ee5\u4e0a\u3068\u8a55\u4fa1\u3055\u308c\u3066\u304a\u308a\u3001\u306a\u304b\u3067\u3082\u300cCVE-2026-7329\u300d\u300cCVE-2026-8709\u300d\u300cCVE-2026-9193\u300d\u306e3\u4ef6\u306b\u3064\u3044\u3066\u306f\u300c9.9\u300d\u3068\u3055\u308c\u308b\u3002", "creation_timestamp": "2026-09-05T03:16:47.232431Z"}, {"uuid": "25006d91-8a1e-4c8a-a3a4-98a9e84db5f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91931", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl7uvxvx225", "content": "CVE-2026-91931 - flowise\nIf you run Flowise version earlier than 3.1.4, a feature called the Custom MCP node can be tricked by a signed\u2011in user to download and run any npm package. This lets the attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "creation_timestamp": "2026-09-15T18:10:05.410686Z"}, {"uuid": "ddce6d75-dee8-4290-bc46-160569f44535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91932", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl7uyhfw42y", "content": "CVE-2026-91932 - flowise\nThe Flowise application (versions earlier than 3.1.4) can be tricked by a signed\u2011in user into accepting a crafted directory path, which then lets the attacker run their own\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "creation_timestamp": "2026-09-15T18:10:08.484868Z"}, {"uuid": "cbfbb978-95a6-4c19-b8d0-a573237a8111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91939", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlmqwt7vz2v", "content": "\ud83d\udd34 CVE-2026-91939 - Critical (9.8)\n\nCotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classe...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-91939/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T22:00:31.880276Z"}, {"uuid": "dfbbe8d9-63ec-43e8-b0f8-3c310e48dda0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91930", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmer77sew2p", "content": "CVE-2026-91930 - flowise\nIn versions of Flowise earlier than 3.1.4, the system does not correctly limit certain management functions to the user's own company. A logged\u2011in user can trick the software into\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "creation_timestamp": "2026-09-16T05:10:08.848251Z"}, {"uuid": "a7bd570a-7948-431b-a535-e27446b47f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91934", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmfcxwtku25", "content": "CVE-2026-91934 - flowise\nVersions of Flowise earlier than 3.1.4 do not check file locations when using the SQLite database feature. A user who has a valid account can place arbitrary files on the server,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "creation_timestamp": "2026-09-16T05:20:06.331488Z"}, {"uuid": "68f07d78-4c33-433f-80af-590987c01343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91939", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmlzkzxbr2w", "content": "CVE-2026-91939 - cotonti\nThe comments add\u2011on in Cotonti version 1.0.0 accepts a value called \u201cci\u201d from the web address and processes it without checking what it contains. A malicious user can craft a special request\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cotonti #CVE #infosec", "creation_timestamp": "2026-09-16T07:20:06.000987Z"}]}