m.shiono@shioccii
まとめ・その他（Linux） 再掲: CVE-2026-99170／99185（8.8）、99216（8.4）、99131（8.2） 新規: Topluyo Desktop for Linux CVE-2026-115904（9.6） 11/2配信のカーネルCVE 10件はいずれも7.0〜7.8 ディストリのアドバイザリで修正版を確認しましょう #CVE #脆弱性
0100074
277 followersView on X
CVE-2026-115904
LOWCVSS 9.6 · CRITICALSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
0.0/ 10 priority
Sources & remediation
Weakness type (CWE)
CWE-78
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Threat summary
- 2 mentions across 2 observed days
- Momentum state: stable
What's happening
- Peaked 1d ago at 1 mentions (2026-11-02); latest day: 1
- 2 total mentions across 2 days
Deep dive
Activity timeline2 mentions / 2d
Referenced assets1 URL
Full discourse2 posts
cve.now@cvedotnow🚨 Update: public exploit code for topluyo App CVE-2026-115904 is out on GitHub. Patch → 2026.9.2410 https://cve.now/CVE-2026-115904?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=exploit
0000023721.4K followersView on X