https://vulnerability.circl.lu/sightings/feed 2026-10-01T22:12:54.227884+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/48434fca-71fd-4c49-880e-f65a8b121dfc/export 2026-10-01T22:12:54.259738+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "48434fca-71fd-4c49-880e-f65a8b121dfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://t.me/VulnerabilityNews/44153", "content": "WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities\n\nCVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin.\nThe post WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities appeared first on SecurityWeek.\nhttps://www.securityweek.com/wordpress-websites-targeted-via-miniorange-plugin-vulnerabilities/", "creation_timestamp": "2026-09-18T12:00:06.244598Z"} 2026-09-18T12:00:06.244598+00:00 https://vulnerability.circl.lu/sighting/1dd6f405-ea8e-49e1-bdf3-8ad8e5f3d20e/export 2026-10-01T22:12:54.261401+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1dd6f405-ea8e-49e1-bdf3-8ad8e5f3d20e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/mohamedation.com/post/3mukbugb7af2v", "content": "CVE-2026-15981 is the miniOrange/SAML authentication bypass (the openssl_verify -1 treated as true bug). The WPMU DEV Dashboard issue that Wordfence wrote about is actually CVE-2026-76581 \u2014 the Hub SSO HMAC canonicalization confusion in versions \u2264 5.0.1.", "creation_timestamp": "2026-09-02T15:47:44.653964Z"} 2026-09-02T15:47:44.653964+00:00 https://vulnerability.circl.lu/sighting/a415693a-6cef-4d6e-ad0a-d61e7e0a09d7/export 2026-10-01T22:12:54.261534+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a415693a-6cef-4d6e-ad0a-d61e7e0a09d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/mohamedation.com/post/3mukbuavwtt2s", "content": "CVE-2026-15981 is being exploited in public using the POC code. IPs seem to be coming from Russia and the traffic is hitting both WPMU DEV Dashboard and SAML Single Sign-On plugins. If you run either, this is relevant right now.\nThere is some mixing of CVE numbers floating around.", "creation_timestamp": "2026-09-02T15:47:39.609107Z"} 2026-09-02T15:47:39.609107+00:00 https://vulnerability.circl.lu/sighting/37e7509a-424d-4803-aaf6-8b535f5bc334/export 2026-10-01T22:12:54.261647+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "37e7509a-424d-4803-aaf6-8b535f5bc334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mu4vfqfoqk2r", "content": "A WordPress SSO plugin bug patched in July is being exploited in August \u2014 6 of 7 paid editions got zero advisory. CVE-2026-61979 + CVE-2026-15981 (9.8): forge SAML, log in as admin. \n\n\ud83c\uddec\ud83c\udde7 diesec.com/2026/08/mini...\n\ud83c\udde9\ud83c\uddea diesec.com/de/2026/08/m... \n\n#WordPress #CyberSecurity #diesec #vulnerability", "creation_timestamp": "2026-08-28T08:00:12.233476Z"} 2026-08-28T08:00:12.233476+00:00 https://vulnerability.circl.lu/sighting/8e9a54d7-5639-406c-b0f7-08378b99ce42/export 2026-10-01T22:12:54.261747+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8e9a54d7-5639-406c-b0f7-08378b99ce42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mtzj5ai7rf2r", "content": "CVE-2026-15981 is trending. Hype score 2, currently #6 on cvemon.\n\nThe SAML Single Sign On \u2013 SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-15981", "creation_timestamp": "2026-08-26T23:42:41.549541Z"} 2026-08-26T23:42:41.549541+00:00 https://vulnerability.circl.lu/sighting/6c99b4ca-9364-4b03-893f-f367c1195d88/export 2026-10-01T22:12:54.261844+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6c99b4ca-9364-4b03-893f-f367c1195d88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mtyw6swvkg2q", "content": "miniOrange SAML 2.0 SSO for WordPress: two auth bypass flaws (CVE-2026-61979, CVE-2026-15981) actively exploited for admin takeover. patch now. #infosec https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited", "creation_timestamp": "2026-08-26T18:03:33.053139Z"} 2026-08-26T18:03:33.053139+00:00 https://vulnerability.circl.lu/sighting/974c10c4-6944-4117-8b9d-6c16dba22700/export 2026-10-01T22:12:54.261941+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "974c10c4-6944-4117-8b9d-6c16dba22700", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mtx242sips2n", "content": "WordPress\u5411\u3051miniOrange SAML SSO\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b92\u4ef6\u3001\u7ba1\u7406\u8005\u4e57\u3063\u53d6\u308a\u53ef\u80fd\u3000\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u3078\u306e\u8a66\u884c\u3082\u78ba\u8a8d(CVE-2026-15981,CVE-2026-61979) \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027", "creation_timestamp": "2026-08-26T00:08:18.347594Z"} 2026-08-26T00:08:18.347594+00:00 https://vulnerability.circl.lu/sighting/02b743cf-4e67-464c-9a4e-b25089c596c0/export 2026-10-01T22:12:54.262037+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "02b743cf-4e67-464c-9a4e-b25089c596c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mtwqdmczlw2z", "content": "miniOrange SAML 2.0 SSO for WordPress: two auth bypass flaws (CVE-2026-61979, CVE-2026-15981) actively exploited for admin takeover. patch now. #infosec https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited", "creation_timestamp": "2026-08-25T21:13:32.340248Z"} 2026-08-25T21:13:32.340248+00:00 https://vulnerability.circl.lu/sighting/12bc7112-776b-420b-8bb1-43547aab5698/export 2026-10-01T22:12:54.262134+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "12bc7112-776b-420b-8bb1-43547aab5698", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mtwcwkfgbo2n", "content": "Hackers are exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, tracked as CVE-2026-61979 and CVE-2026-15981. These flaws allow attackers to forge SAML responses and gain admin access.", "creation_timestamp": "2026-08-25T17:13:35.376998Z"} 2026-08-25T17:13:35.376998+00:00 https://vulnerability.circl.lu/sighting/da64ae2b-7290-4964-8d5e-fa45435b2579/export 2026-10-01T22:12:54.262229+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "da64ae2b-7290-4964-8d5e-fa45435b2579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtw6mopvw62m", "content": "MiniOrange SAML 2.0 SSO\u30d7\u30e9\u30b0\u30a4\u30f3\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027\uff08CVE-2026-61979, CVE-2026-15981\uff09\u304c\u3042\u308a\u3001WordPress\u30b5\u30a4\u30c8\u304c\u653b\u6483\u5bfe\u8c61\u3068\u306a\u308b\u3002", "creation_timestamp": "2026-08-25T15:56:29.411799Z"} 2026-08-25T15:56:29.411799+00:00