{"vulnerability": "CVE-2026-10512", "sightings": [{"uuid": "027ff4f7-facb-4880-8239-65c4428febb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105121", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/esheqhcwrsrpl", "content": "CVE-2026-105121 - OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping\nCVE ID : CVE-2026-105121\n \n Published : Oct. 3, 2026, 2:16 p.m. | 47\u00a0minutes ago\n \n Description : OpenAM before 16.1.3 contains an improper authorization vulnerability that...", "creation_timestamp": "2026-10-03T15:47:25.378992Z"}, {"uuid": "1b4bee1c-8512-4d19-8218-55b2b25d488f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105120", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bma3eerlqussf", "content": "CVE-2026-105120 - OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint\nCVE ID : CVE-2026-105120\n \n Published : Oct. 3, 2026, 2:16 p.m. | 47\u00a0minutes ago\n \n Description : OpenAM before 16.1.3 contains an authorization bypass vulnerability in the session...", "creation_timestamp": "2026-10-03T15:53:25.337064Z"}, {"uuid": "01a49e47-0882-4bde-a962-350b7b635893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105122", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5r5rtwwwc5hon", "content": "CVE-2026-105122 - OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri\nCVE ID : CVE-2026-105122\n \n Published : Oct. 3, 2026, 2:16 p.m. | 47\u00a0minutes ago\n \n Description : OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able...", "creation_timestamp": "2026-10-03T16:07:25.668672Z"}, {"uuid": "d75f78a0-5c48-464d-a27b-15f56af694c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105123", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwz5kqs3yn2b", "content": "\ud83d\udfe0 CVE-2026-105123 - High (8.8)\n\nW (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allow...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105123/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-04T00:31:07.367854Z"}, {"uuid": "ff0fb017-fdd2-481c-a8f6-40b40a7abb43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105123", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117380050105304564", "content": "vincent-peugnet wcms \u22643.18.0 is vulnerable (CVE-2026-105123, HIGH, CVSS 8.7): Authenticated editors can upload malicious files via /api/v0/media/upload/ and delete arbitrary files. Restrict privileges, monitor uploads. https://radar.offseq.com/threat/cve-2026-105123-unrestricted-upload-of-file-with-dangerous-type-in-vincent-peugnet-wcms-9cc4f5671e51d0dd #OffSeq #RCE #WebSecurity #Vuln", "creation_timestamp": "2026-10-04T01:30:25.437272Z"}, {"uuid": "7fa9bfc6-d614-4df1-b727-efe88194073b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105123", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwzauvzaqs2p", "content": "vincent-peugnet wcms \u22643.18.0 has a HIGH-severity vuln: CVE-2026-105123 allows editor-level RCE via arbitrary file upload. Restrict privileges & monitor endpoints. https://radar.offseq.com/threat/cve-2026-105123-unrestricted-upload-of-file-with-dangerous-type-in-vincent-peugnet-wcms-9cc4f5671e51d0...", "creation_timestamp": "2026-10-04T01:30:27.475823Z"}, {"uuid": "5f5298df-ba90-4998-a23c-da9faf8228c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105123", "type": "seen", "source": "https://gist.github.com/ichintu/1d0f62e7f5bbc80cb4372e1a7110c679", "content": "On October 4, 2026, three high-severity vulnerabilities were disclosed:\n\u2022 **CVE-2026-88779 (8.7):** Memory overflow in older NetScaler ADC/Gateway versions, causing Denial of Service.\n\u2022 **CVE-2026-105126 (8.6):** Privilege escalation in LaraDashboard (<1.4.8) allowing admins to gain Superadmin rights, risking account takeover and code execution.\n\u2022 **CVE-2026-105123 (8.8):** Remote Code Execution and arbitrary file manipulation in W CMS (\u22643.18.0) via an unvalidated media upload API.\n\nImmediate patching or version updates are strongly recommended to mitigate these critical risks.", "creation_timestamp": "2026-10-04T04:00:28.000000Z"}, {"uuid": "c46ed481-9913-46c4-9877-472a239c3a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105126", "type": "seen", "source": "https://gist.github.com/ichintu/1d0f62e7f5bbc80cb4372e1a7110c679", "content": "On October 4, 2026, three high-severity vulnerabilities were disclosed:\n\u2022 **CVE-2026-88779 (8.7):** Memory overflow in older NetScaler ADC/Gateway versions, causing Denial of Service.\n\u2022 **CVE-2026-105126 (8.6):** Privilege escalation in LaraDashboard (<1.4.8) allowing admins to gain Superadmin rights, risking account takeover and code execution.\n\u2022 **CVE-2026-105123 (8.8):** Remote Code Execution and arbitrary file manipulation in W CMS (\u22643.18.0) via an unvalidated media upload API.\n\nImmediate patching or version updates are strongly recommended to mitigate these critical risks.", "creation_timestamp": "2026-10-04T04:00:28.000000Z"}, {"uuid": "f6e8fd4c-44a7-4b27-b283-a048359bfb63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105123", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwzontqtmc22", "content": "wcms 3.18.0\u4ee5\u4e0b\u3067\u3001\u8a8d\u8a3c\u3055\u308c\u305f\u30a8\u30c7\u30a3\u30bf\u30fc\u304c\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\uff08php\u30d5\u30a1\u30a4\u30eb\u542b\u3080\uff09\u3092\u66f8\u304d\u63db\u3048\u308b\u3001\u307e\u305f\u306f\u524a\u9664\u3067\u304d\u308b\u8106\u5f31\u6027\u304c\u3042\u308b\u3002\nCVE-2026-105123 CVSS 8.8 | HIGH", "creation_timestamp": "2026-10-04T05:37:03.141871Z"}, {"uuid": "70dc9211-ea1e-452e-bff7-10e6ca3e0c1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105129", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117382881287899504", "content": "CVE-2026-105129 | LaraDashboard <1.4.8 HIGH severity: settings.view users can access plaintext secrets (API keys, mail creds, tokens) via API. Patch to 1.4.8+ recommended. https://radar.offseq.com/threat/laradashboard-before-148-contains-an-incorrect-authorization-vulnerability-that-allows-authenticated-16249131d2f6c23b #OffSeq #Vulnerability #LaraDashboard #AppSec", "creation_timestamp": "2026-10-04T13:30:25.930845Z"}]}