https://vulnerability.circl.lu/sightings/feed 2026-09-16T16:50:05.848678+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/20dcd1a3-305c-41ee-b6bb-62c3fc9fdad1/export 2026-09-16T16:50:05.877400+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "20dcd1a3-305c-41ee-b6bb-62c3fc9fdad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117280605916782332", "content": "CRITICAL: The Events Calendar WP plugin (<6.17.4.1) has two unauthenticated RCEs \u2014 CVE-2026-78159 (code injection) & CVE-2026-78006 (object injection, comments enabled). 240K+ sites at risk. Update now: https://radar.offseq.com/threat/unauthenticated-rce-flaws-could-expose-200000-wordpress-sites-to-takeover-7f3911d49bdf2638 #OffSeq #WordPress #RCE #Vuln", "creation_timestamp": "2026-09-16T12:00:27.627092Z"} 2026-09-16T12:00:27.627092+00:00 https://vulnerability.circl.lu/sighting/4c95de2c-e726-4591-90da-473afe6ce1bb/export 2026-09-16T16:50:05.882536+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4c95de2c-e726-4591-90da-473afe6ce1bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmf45ohj23", "content": "The Events Calendar CVE-2026-78006 and CVE-2026-78159 (critical unauth RCE) allow anonymous commenters to trigger code execution \u2014 update the plugin or disable comments now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:26:33.027900Z"} 2026-09-16T07:26:33.027900+00:00 https://vulnerability.circl.lu/sighting/0c53b091-d8a0-4e3a-807e-17ce63cc7d76/export 2026-09-16T16:50:05.882654+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0c53b091-d8a0-4e3a-807e-17ce63cc7d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78159", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mvi7rhzih72e", "content": "Two unauthenticated RCEs (CVSS 9.8) in The Events Calendar WordPress plugin, all versions through 6.17.4. Disable or update\u2026 https://0daynews.com/articles/2026-09-13-events-calendar-cve-2026-78159-78006-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-2001", "creation_timestamp": "2026-09-14T13:30:10.897557Z"} 2026-09-14T13:30:10.897557+00:00 https://vulnerability.circl.lu/sighting/7c18c3bc-1f89-42c6-921a-e63c8720fc77/export 2026-09-16T16:50:05.882732+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7c18c3bc-1f89-42c6-921a-e63c8720fc77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117262203324178669", "content": "CVE-2026-78159: The Events Calendar <=6.17.3 for WordPress has a CRITICAL RCE flaw via parse_array(). Unauthenticated code execution if comments on tribe_events posts are enabled. Disable comments as interim mitigation. https://radar.offseq.com/threat/the-the-events-calendar-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-versions-up-1ecd7d8aa73f934d #OffSeq #WordPress #RCE #CVE202678159", "creation_timestamp": "2026-09-13T06:00:27.059310Z"} 2026-09-13T06:00:27.059310+00:00 https://vulnerability.circl.lu/sighting/8c1b71d8-6097-4822-8700-5058119932ff/export 2026-09-16T16:50:05.882805+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8c1b71d8-6097-4822-8700-5058119932ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvctiqrd4225", "content": "\ud83d\udea8 CVE-2026-78159 \u2014 CVSS 9.8 CRITICAL\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78159\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-12T10:07:14.073013Z"} 2026-09-12T10:07:14.073013+00:00 https://vulnerability.circl.lu/sighting/0253bfad-2275-4fce-ad3d-756bef47ef1b/export 2026-09-16T16:50:05.882877+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0253bfad-2275-4fce-ad3d-756bef47ef1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/b4egtall5vex2", "content": "CVE-2026-78159 - The Events Calendar\nCVE ID : CVE-2026-78159\n \n Published : Sept. 12, 2026, 8:16 a.m. | 43\u00a0minutes ago\n \n Description : The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the pars...", "creation_timestamp": "2026-09-12T09:28:02.139565Z"} 2026-09-12T09:28:02.139565+00:00 https://vulnerability.circl.lu/sighting/745ece2a-5dcd-4043-a6bb-16e8a036f727/export 2026-09-16T16:50:05.882948+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "745ece2a-5dcd-4043-a6bb-16e8a036f727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78159", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvcprcnvek24", "content": "stellarwp The Events Calendar <=6.17.3 hit by CRITICAL RCE (CVE-2026-78159). Unauthenticated code execution via crafted comments. Disable comments on tribe_events posts to reduce risk. Details: https://radar.offseq.com/threat/cve-2026-78159-cwe-94-improper-control-of-generation-of-code-code-injec...", "creation_timestamp": "2026-09-12T09:00:27.242850Z"} 2026-09-12T09:00:27.242850+00:00 https://vulnerability.circl.lu/sighting/b4e3817b-5ebf-49b8-b853-e41f58675385/export 2026-09-16T16:50:05.883018+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b4e3817b-5ebf-49b8-b853-e41f58675385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvcprbwjz42v", "content": "\ud83d\udd34 CVE-2026-78159 - Critical (9.8)\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78159/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T09:00:26.341637Z"} 2026-09-12T09:00:26.341637+00:00 https://vulnerability.circl.lu/sighting/8723feab-61e9-4e50-9206-5badd99b02f0/export 2026-09-16T16:50:05.883085+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8723feab-61e9-4e50-9206-5badd99b02f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78159", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117257248707504649", "content": "CVE-2026-78159: CRITICAL RCE in The Events Calendar (<=6.17.3). Unauthenticated attackers can run arbitrary code via crafted comments. Disable comments on tribe_events posts to mitigate. CVSS 9.8. Details: https://radar.offseq.com/threat/cve-2026-78159-cwe-94-improper-control-of-generation-of-code-code-injection-in-stellarwp-the-events-c0d168b99a9315ff #OffSeq #WordPress #Infosec #RCE", "creation_timestamp": "2026-09-12T09:00:24.840386Z"} 2026-09-12T09:00:24.840386+00:00 https://vulnerability.circl.lu/sighting/0191a399-b196-462a-8a64-8c8dd9271d92/export 2026-09-16T16:50:05.883150+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0191a399-b196-462a-8a64-8c8dd9271d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvcmxdfmwh2p", "content": "CVE-2026-78159 - the events calendar\nThe Events Calendar add\u2011on for WordPress can be tricked into executing any code an attacker supplies, even without logging in. The problem occurs when a crafted comment is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#stellarwp #CVE #infosec", "creation_timestamp": "2026-09-12T08:10:07.352943Z"} 2026-09-12T08:10:07.352943+00:00