{"uuid": "7e6cee0b-54fd-4524-9b36-530e921cd1f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1340", "type": "seen", "source": "https://t.me/changelogWAF/9", "content": "Emergency WAF Update (2026-03-12)\n\nCVE-2026-1281 / CVE-2026-1340:\nCode Injection vulnerabilities in Ivanti Ivanti Endpoint Manager Mobile allow unauthenticated attackers to execute remote code via unsanitized user input passed to Bash scripts through Apache RewriteMap directives.\n\nGeneric XSS \u2013 Content-Security-Policy Header:\nA new detection blocks malicious payloads injected into the Content-Security-Policy request header, which could allow attackers to perform Cross-Site Scripting (XSS) if applications improperly trust and process CSP header values.", "creation_timestamp": "2026-08-29T00:00:08.236532Z"}