CVE-2026-91198Disclosure

🚨 DATA SECURITY — A NEW GROWTHBOOK FLAW CAN EXPOSE THE SQL BEHIND AN ORGANIZATION'S DATA WAREHOUSE WITHOUT AUTHENTICATION CVE-2026-91198 CyberSignal Priority: 🟠 HIGH A newly disclosed vulnerability affects: GrowthBook ≤ 5.0.1 The problem is not direct database access. It's INFORMATION EXPOSURE that can make later attacks dramatically easier. Certain publicly accessible: REPORT + EXPERIMENT endpoints can return unredacted internal fact-table definitions. That may expose: → raw warehouse SQL → database schema information → table names → datasource identifiers → filtering logic → internal query structure. And authentication is not required if an attacker knows a publicly shared: report ID or experiment ID. The potential reconnaissance chain: PUBLIC REPORT ID ↓ GrowthBook endpoint queried ↓ RAW INTERNAL SQL DISCLOSED ↓ schema + table names identified ↓ attacker understands backend architecture ↓ future attack becomes easier. CVE: CVE-2026-91198 CWE: CWE-200 — Exposure of Sensitive Information. CVSS: 5.3. Important caveat: This is NOT currently listed in CISA KEV. I found no evidence of widespread exploitation. But CVSS alone doesn't capture the value of exposing an organization's internal data architecture. 🧠 CyberSignal insight Attackers don't always need the database. Sometimes knowing: WHAT TABLES EXIST + HOW YOU QUERY THEM + WHERE YOUR DATA LIVES is already extremely valuable intelligence. Sources: MITRE CVE · NVD references · VulDB Disclosure: September 15, 2026

🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 15, 2026 1️⃣ CISCO PATCHES CRITICAL ZERO-DAY IN SECURE EMAIL GATEWAY Cisco fixed a zero-day in the AsyncOS platform that powers its Secure Email Gateway — CVE-2026-76461, rated CVSS 9.8 — where a single crafted email triggers a SQL injection that escalates straight to root-level remote code execution. No credentials, no user interaction, zero prerequisites: the message itself is the payload. CISA has added it to the Known Exploited Vulnerabilities catalog, so affected appliances should be patched and mail logs reviewed rather than assumed clean. 🔹 @ThreatAft 2️⃣ CISA: vCENTER RCE NOW IN RANSOMWARE GANGS' TOOLKIT CISA updated its Known Exploited Vulnerabilities list to flag VMware vCenter CVE-2026-59310 — a critical, unauthenticated remote code execution via Syslog path traversal that had been patched back in July 2026. What changed is the abuse: ransomware crews are now actively exploiting it, after the flaw already saw APT reverse-SSH campaigns across dozens of countries. If you run vCenter, treat this as an emergency patch-and-exposure check, and keep the management interface off the public internet. 🔹 @Orion84x 3️⃣ COSTA RICA INVESTIGATES DARK WEB SALE OF TENS OF MILLIONS OF RECORDS Costa Rica's National Cybersecurity Directorate is investigating a dark web post claiming to sell tens of millions of records tied to people in Costa Rica — including identity card photos, court files, vehicle registrations, and salary data. If the claim holds up, it would be one of the larger national-scale identity dumps in recent memory, and the mix of ID photos with court and income data makes it a serious fraud and identity-theft pipeline. 🔹 @NIKSUN 4️⃣ OPEN SOURCE GROWTHBOOK FLAW LEAKS DATA WAREHOUSE SQL A newly disclosed high-severity flaw (CVE-2026-91198) in GrowthBook — the popular open source feature-flagging platform, versions 5.0.1 and below — lets an unauthenticated attacker reach the SQL sitting behind an organization's data warehouse. It is not direct database access, but it is close enough to expose the queries and structure behind your feature data. If GrowthBook is part of your stack, upgrade past 5.0.1. 🔹 @XQOPTRX 5️⃣ WORDPRESS EVENTS CALENDAR: TWO UNAUTH RCE CHAINS ON ~600K SITES The Events Calendar WordPress plugin is hit with two unauthenticated remote code execution flaws — CVE-2026-78006 and CVE-2026-78159, both around CVSS 9.8. The attack path runs from a comment into a widget, yielding PHP object injection RCE, or an admin password reset without any login when event comments are enabled. With roughly 600,000 sites on the plugin, this is a fast route to mass scanning and mass compromise. 🔹 @Orion84x 6️⃣ VOICEBOX: LOCAL OPEN-SOURCE ALTERNATIVE TO ELEVENLABS A new open source project called Voicebox — already past 53,000 GitHub stars under an MIT license — is being pitched as a local alternative to ElevenLabs and WisprFlow. You give it a short clip of your voice, it clones how you sound, and any AI agent connected to it can speak in that voice — all on your own hardware. For teams that want voice cloning without shipping recordings to a third-party cloud, it is a meaningful option. 🔹 @HelloVyom 7️⃣ NOFIRE OPEN-SOURCES BRIG: microVM SANDBOX FOR AI CODING AGENTS NOFire has open-sourced Brig, a microVM sandbox (Apache 2.0) that runs AI coding agents in hardware-enforced isolation on Mac or Linux. The goal is containment by default: an auto-approved agent's package installs and credential use are locked inside a microVM instead of owning the whole machine. As agents get more autonomy, cheap isolation layers like this are becoming a real security primitive, not a nice-to-have. 🔹 @BadSignalAI 8️⃣ DELAWARE ENACTS AUTOMATED DECISION OPT-OUT RIGHT Delaware has signed a data-privacy update that gives people an opt-out right for automated decision-making and broadens the overall reach of the state's privacy law. It is a small but directional signal: automated-decision opt-outs are moving from enterprise policy into statute, and more jurisdictions are likely to follow. 🔹 @kuriharan 💭 The common thread this morning is that patching alone is no longer the defense — exploitation is. Cisco, vCenter, and WordPress are all patchable, and all are being exploited in the wild anyway. Meanwhile the open source world is quietly shipping the counter-moves: a sandboxed runtime for autonomous agents, and local voice tools that keep your biometrics on your own hardware. The gap between exploit speed and patch speed is where security actually lives now, and tools like Brig are what help close it. Which of these hits closest to home — do you run vCenter, or is GrowthBook part of your stack? Tell me your biggest patching headache below 👇 #CyberSecurity #OpenSource #Privacy #DataBreach #CVE