https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 09:23:47 +0000 https://vulnerability.circl.lu/sighting/37e7509a-424d-4803-aaf6-8b535f5bc334/export {"uuid": "37e7509a-424d-4803-aaf6-8b535f5bc334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mu4vfqfoqk2r", "content": "A WordPress SSO plugin bug patched in July is being exploited in August \u2014 6 of 7 paid editions got zero advisory. CVE-2026-61979 + CVE-2026-15981 (9.8): forge SAML, log in as admin. \n\n\ud83c\uddec\ud83c\udde7 diesec.com/2026/08/mini...\n\ud83c\udde9\ud83c\uddea diesec.com/de/2026/08/m... \n\n#WordPress #CyberSecurity #diesec #vulnerability", "creation_timestamp": "2026-08-28T08:00:12.233476Z"} {"uuid": "37e7509a-424d-4803-aaf6-8b535f5bc334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mu4vfqfoqk2r", "content": "A WordPress SSO plugin bug patched in July is being exploited in August \u2014 6 of 7 paid editions got zero advisory. CVE-2026-61979 + CVE-2026-15981 (9.8): forge SAML, log in as admin. \n\n\ud83c\uddec\ud83c\udde7 diesec.com/2026/08/mini...\n\ud83c\udde9\ud83c\uddea diesec.com/de/2026/08/m... \n\n#WordPress #CyberSecurity #diesec #vulnerability", "creation_timestamp": "2026-08-28T08:00:12.233476Z"} https://vulnerability.circl.lu/sighting/37e7509a-424d-4803-aaf6-8b535f5bc334/export Fri, 28 Aug 2026 08:00:12 +0000 https://vulnerability.circl.lu/sighting/8e9a54d7-5639-406c-b0f7-08378b99ce42/export {"uuid": "8e9a54d7-5639-406c-b0f7-08378b99ce42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mtzj5ai7rf2r", "content": "CVE-2026-15981 is trending. Hype score 2, currently #6 on cvemon.\n\nThe SAML Single Sign On \u2013 SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-15981", "creation_timestamp": "2026-08-26T23:42:41.549541Z"} {"uuid": "8e9a54d7-5639-406c-b0f7-08378b99ce42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mtzj5ai7rf2r", "content": "CVE-2026-15981 is trending. Hype score 2, currently #6 on cvemon.\n\nThe SAML Single Sign On \u2013 SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-15981", "creation_timestamp": "2026-08-26T23:42:41.549541Z"} https://vulnerability.circl.lu/sighting/8e9a54d7-5639-406c-b0f7-08378b99ce42/export Wed, 26 Aug 2026 23:42:41 +0000 https://vulnerability.circl.lu/sighting/6c99b4ca-9364-4b03-893f-f367c1195d88/export {"uuid": "6c99b4ca-9364-4b03-893f-f367c1195d88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mtyw6swvkg2q", "content": "miniOrange SAML 2.0 SSO for WordPress: two auth bypass flaws (CVE-2026-61979, CVE-2026-15981) actively exploited for admin takeover. patch now. #infosec https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited", "creation_timestamp": "2026-08-26T18:03:33.053139Z"} {"uuid": "6c99b4ca-9364-4b03-893f-f367c1195d88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mtyw6swvkg2q", "content": "miniOrange SAML 2.0 SSO for WordPress: two auth bypass flaws (CVE-2026-61979, CVE-2026-15981) actively exploited for admin takeover. patch now. #infosec https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited", "creation_timestamp": "2026-08-26T18:03:33.053139Z"} https://vulnerability.circl.lu/sighting/6c99b4ca-9364-4b03-893f-f367c1195d88/export Wed, 26 Aug 2026 18:03:33 +0000 https://vulnerability.circl.lu/sighting/974c10c4-6944-4117-8b9d-6c16dba22700/export {"uuid": "974c10c4-6944-4117-8b9d-6c16dba22700", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mtx242sips2n", "content": "WordPress\u5411\u3051miniOrange SAML SSO\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b92\u4ef6\u3001\u7ba1\u7406\u8005\u4e57\u3063\u53d6\u308a\u53ef\u80fd\u3000\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u3078\u306e\u8a66\u884c\u3082\u78ba\u8a8d(CVE-2026-15981,CVE-2026-61979) \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027", "creation_timestamp": "2026-08-26T00:08:18.347594Z"} {"uuid": "974c10c4-6944-4117-8b9d-6c16dba22700", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mtx242sips2n", "content": "WordPress\u5411\u3051miniOrange SAML SSO\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b92\u4ef6\u3001\u7ba1\u7406\u8005\u4e57\u3063\u53d6\u308a\u53ef\u80fd\u3000\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u3078\u306e\u8a66\u884c\u3082\u78ba\u8a8d(CVE-2026-15981,CVE-2026-61979) \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027", "creation_timestamp": "2026-08-26T00:08:18.347594Z"} https://vulnerability.circl.lu/sighting/974c10c4-6944-4117-8b9d-6c16dba22700/export Wed, 26 Aug 2026 00:08:18 +0000 https://vulnerability.circl.lu/sighting/44dabbcf-68c0-4c27-96c7-c331fa297f56/export {"uuid": "44dabbcf-68c0-4c27-96c7-c331fa297f56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "exploited", "source": "https://t.me/true_secator/8541", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 miniOrange SAML 2.0 Single Sign On \u0434\u043b\u044f WordPress, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 SAML-\u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041f\u043b\u0430\u0433\u0438\u043d miniOrange SAML SSO \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0430\u0439\u0442 WordPress \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u0443\u0441\u043b\u0443\u0433 SAML, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Microsoft Entra ID, Okta, Google Workspace \u0438\u043b\u0438 OneLogin, \u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 WordPress.\n\n\u0421\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Xecurify, miniOrange \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u0438\u0437 \u0441\u0435\u043c\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043a\u0430\u0447\u0430\u043d\u0430 10 000 \u0440\u0430\u0437, \u0430\u00a0\u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u0438\u043c\u0435\u044e\u0442\u00a030 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0414\u0432\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-61979 \u0438 CVE-2026-15981 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043b\u0430\u0433\u0438\u043d miniOrange SAML SSO \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438\u0437 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SAML-\u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2026-61979 \u0434\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u0430 HMAC-SHA1.\n\n\u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u043b\u0430\u0433\u0438\u043d \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 RSA \u043e\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (IdP) \u043a\u0430\u043a \u043e\u0431\u0449\u0438\u0439 \u0441\u0435\u043a\u0440\u0435\u0442. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043b\u0430\u0433\u0438\u043d \u043f\u0440\u0438\u043c\u0435\u0442 \u0437\u0430 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u0443\u044e.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-15981 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u043b\u0430\u0433\u0438\u043d \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 OpenSSL (-1) \u043a\u0430\u043a \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Patchstack, \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0438\u044e\u043b\u0435. \u041e\u0434\u043d\u0430\u043a\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u043a\u0430\u0441\u0430\u043b\u043e\u0441\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0448\u0435\u0441\u0442\u044c \u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043e\u0441\u0442\u0430\u043b\u0438\u0441\u044c \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0445\u043e\u0442\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0438 \u0434\u043b\u044f \u043d\u0438\u0445.\n\n\u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0440\u0438\u0441\u043a\u0435 \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0430\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043d\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u044f\u043b\u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Patchstack, 16 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 DigitalOcean \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0438\u0437-\u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u043e\u0432 \u0441\u0432\u043e\u0435\u0439 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c cookie-\u0444\u0430\u0439\u043b \u0441\u0435\u0441\u0441\u0438\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043b\u0430\u0433\u0438\u043d \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 16.1.9.\n\n\u0422\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u044f Patchstack \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0435, \u0447\u0442\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0434\u0443\u0442\u0441\u044f \u0441 \u0448\u0435\u0441\u0442\u0438 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u0415\u0432\u0440\u043e\u043f\u0435, \u0410\u0444\u0440\u0438\u043a\u0435 \u0438 \u0421\u0428\u0410.\n\n\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u044b \u0430\u0442\u0430\u043a \u043c\u043e\u0433\u0443\u0442 \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0438.\n\nPatchstack \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438 WordPress \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043d\u0435 \u0431\u0443\u0434\u0443\u0442 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0435\u0433\u043e \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.", "creation_timestamp": "2026-08-26T00:00:10.308774Z"} {"uuid": "44dabbcf-68c0-4c27-96c7-c331fa297f56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "exploited", "source": "https://t.me/true_secator/8541", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 miniOrange SAML 2.0 Single Sign On \u0434\u043b\u044f WordPress, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 SAML-\u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041f\u043b\u0430\u0433\u0438\u043d miniOrange SAML SSO \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0430\u0439\u0442 WordPress \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u0443\u0441\u043b\u0443\u0433 SAML, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Microsoft Entra ID, Okta, Google Workspace \u0438\u043b\u0438 OneLogin, \u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 WordPress.\n\n\u0421\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Xecurify, miniOrange \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u0438\u0437 \u0441\u0435\u043c\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043a\u0430\u0447\u0430\u043d\u0430 10 000 \u0440\u0430\u0437, \u0430\u00a0\u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u0438\u043c\u0435\u044e\u0442\u00a030 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0414\u0432\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-61979 \u0438 CVE-2026-15981 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043b\u0430\u0433\u0438\u043d miniOrange SAML SSO \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438\u0437 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 SAML-\u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2026-61979 \u0434\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u0430 HMAC-SHA1.\n\n\u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u043b\u0430\u0433\u0438\u043d \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 RSA \u043e\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (IdP) \u043a\u0430\u043a \u043e\u0431\u0449\u0438\u0439 \u0441\u0435\u043a\u0440\u0435\u0442. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043b\u0430\u0433\u0438\u043d \u043f\u0440\u0438\u043c\u0435\u0442 \u0437\u0430 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u0443\u044e.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-15981 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u043b\u0430\u0433\u0438\u043d \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 OpenSSL (-1) \u043a\u0430\u043a \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Patchstack, \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0438\u044e\u043b\u0435. \u041e\u0434\u043d\u0430\u043a\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u043a\u0430\u0441\u0430\u043b\u043e\u0441\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0448\u0435\u0441\u0442\u044c \u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043e\u0441\u0442\u0430\u043b\u0438\u0441\u044c \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0445\u043e\u0442\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0438 \u0434\u043b\u044f \u043d\u0438\u0445.\n\n\u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0440\u0438\u0441\u043a\u0435 \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0430\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043d\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u044f\u043b\u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Patchstack, 16 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 DigitalOcean \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0438\u0437-\u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u043e\u0432 \u0441\u0432\u043e\u0435\u0439 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c cookie-\u0444\u0430\u0439\u043b \u0441\u0435\u0441\u0441\u0438\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043b\u0430\u0433\u0438\u043d \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 16.1.9.\n\n\u0422\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u044f Patchstack \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0435, \u0447\u0442\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0434\u0443\u0442\u0441\u044f \u0441 \u0448\u0435\u0441\u0442\u0438 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u0415\u0432\u0440\u043e\u043f\u0435, \u0410\u0444\u0440\u0438\u043a\u0435 \u0438 \u0421\u0428\u0410.\n\n\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u044b \u0430\u0442\u0430\u043a \u043c\u043e\u0433\u0443\u0442 \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0438.\n\nPatchstack \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438 WordPress \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043d\u0435 \u0431\u0443\u0434\u0443\u0442 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0435\u0433\u043e \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.", "creation_timestamp": "2026-08-26T00:00:10.308774Z"} https://vulnerability.circl.lu/sighting/44dabbcf-68c0-4c27-96c7-c331fa297f56/export Wed, 26 Aug 2026 00:00:10 +0000 https://vulnerability.circl.lu/sighting/11f5627f-916d-402c-8318-10b1a99516a7/export {"uuid": "11f5627f-916d-402c-8318-10b1a99516a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://t.me/pphm_HackerNews/2841", "content": "\ud83d\udd34 Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access\n\nBad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.\n\nThe vulnerabilities, as disclosed by Patchstack, are listed below -\n\nCVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion (Fixed in version 17.0.5 for the Standard edition)\nCVE-2026-15981 (CVSS score: 9.8) - An authentication bypass vulnerability stemming from accepting malformed signatures as valid (Fixed in version 17.0.6 for the Standard edition)\n\"This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification,\" according to a description of CVE-2026-15981 on CVE.org.", "creation_timestamp": "2026-08-26T00:00:10.154629Z"} {"uuid": "11f5627f-916d-402c-8318-10b1a99516a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://t.me/pphm_HackerNews/2841", "content": "\ud83d\udd34 Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access\n\nBad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.\n\nThe vulnerabilities, as disclosed by Patchstack, are listed below -\n\nCVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion (Fixed in version 17.0.5 for the Standard edition)\nCVE-2026-15981 (CVSS score: 9.8) - An authentication bypass vulnerability stemming from accepting malformed signatures as valid (Fixed in version 17.0.6 for the Standard edition)\n\"This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification,\" according to a description of CVE-2026-15981 on CVE.org.", "creation_timestamp": "2026-08-26T00:00:10.154629Z"} https://vulnerability.circl.lu/sighting/11f5627f-916d-402c-8318-10b1a99516a7/export Wed, 26 Aug 2026 00:00:10 +0000 https://vulnerability.circl.lu/sighting/02b743cf-4e67-464c-9a4e-b25089c596c0/export {"uuid": "02b743cf-4e67-464c-9a4e-b25089c596c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mtwqdmczlw2z", "content": "miniOrange SAML 2.0 SSO for WordPress: two auth bypass flaws (CVE-2026-61979, CVE-2026-15981) actively exploited for admin takeover. patch now. #infosec https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited", "creation_timestamp": "2026-08-25T21:13:32.340248Z"} {"uuid": "02b743cf-4e67-464c-9a4e-b25089c596c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mtwqdmczlw2z", "content": "miniOrange SAML 2.0 SSO for WordPress: two auth bypass flaws (CVE-2026-61979, CVE-2026-15981) actively exploited for admin takeover. patch now. #infosec https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited", "creation_timestamp": "2026-08-25T21:13:32.340248Z"} https://vulnerability.circl.lu/sighting/02b743cf-4e67-464c-9a4e-b25089c596c0/export Tue, 25 Aug 2026 21:13:32 +0000 https://vulnerability.circl.lu/sighting/12bc7112-776b-420b-8bb1-43547aab5698/export {"uuid": "12bc7112-776b-420b-8bb1-43547aab5698", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mtwcwkfgbo2n", "content": "Hackers are exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, tracked as CVE-2026-61979 and CVE-2026-15981. These flaws allow attackers to forge SAML responses and gain admin access.", "creation_timestamp": "2026-08-25T17:13:35.376998Z"} {"uuid": "12bc7112-776b-420b-8bb1-43547aab5698", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mtwcwkfgbo2n", "content": "Hackers are exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, tracked as CVE-2026-61979 and CVE-2026-15981. These flaws allow attackers to forge SAML responses and gain admin access.", "creation_timestamp": "2026-08-25T17:13:35.376998Z"} https://vulnerability.circl.lu/sighting/12bc7112-776b-420b-8bb1-43547aab5698/export Tue, 25 Aug 2026 17:13:35 +0000 https://vulnerability.circl.lu/sighting/da64ae2b-7290-4964-8d5e-fa45435b2579/export {"uuid": "da64ae2b-7290-4964-8d5e-fa45435b2579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtw6mopvw62m", "content": "MiniOrange SAML 2.0 SSO\u30d7\u30e9\u30b0\u30a4\u30f3\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027\uff08CVE-2026-61979, CVE-2026-15981\uff09\u304c\u3042\u308a\u3001WordPress\u30b5\u30a4\u30c8\u304c\u653b\u6483\u5bfe\u8c61\u3068\u306a\u308b\u3002", "creation_timestamp": "2026-08-25T15:56:29.411799Z"} {"uuid": "da64ae2b-7290-4964-8d5e-fa45435b2579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtw6mopvw62m", "content": "MiniOrange SAML 2.0 SSO\u30d7\u30e9\u30b0\u30a4\u30f3\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027\uff08CVE-2026-61979, CVE-2026-15981\uff09\u304c\u3042\u308a\u3001WordPress\u30b5\u30a4\u30c8\u304c\u653b\u6483\u5bfe\u8c61\u3068\u306a\u308b\u3002", "creation_timestamp": "2026-08-25T15:56:29.411799Z"} https://vulnerability.circl.lu/sighting/da64ae2b-7290-4964-8d5e-fa45435b2579/export Tue, 25 Aug 2026 15:56:29 +0000 https://vulnerability.circl.lu/sighting/a57785d7-b577-4c50-9511-73b9417dac00/export {"uuid": "a57785d7-b577-4c50-9511-73b9417dac00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://t.me/pphm_HackerNews/2841", "content": "\ud83d\udd34 Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access\n\nBad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.\n\nThe vulnerabilities, as disclosed by Patchstack, are listed below -\n\nCVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion (Fixed in version 17.0.5 for the Standard edition)\nCVE-2026-15981 (CVSS score: 9.8) - An authentication bypass vulnerability stemming from accepting malformed signatures as valid (Fixed in version 17.0.6 for the Standard edition)\n\"This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification,\" according to a description of CVE-2026-15981 on CVE.org.", "creation_timestamp": "2026-08-25T14:00:04.045559Z"} {"uuid": "a57785d7-b577-4c50-9511-73b9417dac00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15981", "type": "seen", "source": "https://t.me/pphm_HackerNews/2841", "content": "\ud83d\udd34 Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access\n\nBad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.\n\nThe vulnerabilities, as disclosed by Patchstack, are listed below -\n\nCVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion (Fixed in version 17.0.5 for the Standard edition)\nCVE-2026-15981 (CVSS score: 9.8) - An authentication bypass vulnerability stemming from accepting malformed signatures as valid (Fixed in version 17.0.6 for the Standard edition)\n\"This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification,\" according to a description of CVE-2026-15981 on CVE.org.", "creation_timestamp": "2026-08-25T14:00:04.045559Z"} https://vulnerability.circl.lu/sighting/a57785d7-b577-4c50-9511-73b9417dac00/export Tue, 25 Aug 2026 14:00:04 +0000