Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
It's been a while .... 3 new CVEs in @velocidex by @rapid7 CVE-2026-18860 CVE-2026-18640 CVE-2026-18348 https://t.co/yEWuS2qN6i
Post summary
The tweet announces three new CVEs affecting Velocidex, reported by Rapid7, without providing further technical or exploitation details.