{"vulnerability": "CVE-2026-10737", "sightings": [{"uuid": "7a92851a-9c08-43a3-bdac-1d07dbccd1f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mngmztd3wh22", "content": "\ud83d\udfe0 CVE-2026-10737 - High (7.5)\n\nThe SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due t...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-10737/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-04T03:00:37.918548Z"}, {"uuid": "2f15848e-df81-484e-8900-dd61c3dfb7fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mngzsdlxk324", "content": "CVE-2026-10737 - SP Project & Document Manager\nCVE ID : CVE-2026-10737\n \n Published : June 4, 2026, 2:16 a.m. | 4\u00a0hours, 16\u00a0minutes ago\n \n Description : The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability ...", "creation_timestamp": "2026-06-04T06:49:06.578209Z"}, {"uuid": "9f10f0cc-9044-4644-8526-da0889cc1c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnircqmoxk26", "content": "Unauthenticated attackers can read arbitrary file metadata and grab download links via SP Project & Document Manager. CVE-2026-10737 (CVSS 7.5) exploits missing capability checks in versions \u22644.71. Update immediately to 4.71+ \u2192 pulse-wp.com\n#WordPress #CyberSecurity #InfoSec #CVE", "creation_timestamp": "2026-06-04T23:22:30.518304Z"}, {"uuid": "c6c0b7bc-1e32-4ed7-989c-62834b85ce8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnirmpxct22x", "content": "Unauthenticated attackers can download arbitrary files from SP Project & Document Manager via missing capability checks. CVE-2026-10737 (CVSS 7.5 HIGH). Affects all versions through 4.71. Update now \u2192 pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "creation_timestamp": "2026-06-04T23:28:06.432733Z"}, {"uuid": "c8e3662b-2bd0-4249-b173-7cfbfb2a2637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnirr3vfxi26", "content": "CVE-2026-10737. CVSS 7.5. SP Project & Document Manager leaks file metadata and download links to anyone. No auth needed. Your configs, backups, API keys exposed.\n\nUpdate to 4.71. now.\n\n\u2192 pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "creation_timestamp": "2026-06-04T23:30:32.096936Z"}, {"uuid": "9a78e302-e89b-47e9-9786-cdc682625eb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnirwyoxo42a", "content": "CVE-2026-10737. CVSS 7.5. SP Project & Document Manager leaks file metadata and download links to anyone. No auth needed. Your wp-config could be next.\n\nUpdate to 4.71. now. \u2192 pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "creation_timestamp": "2026-06-04T23:33:50.308809Z"}, {"uuid": "45c11c26-00ab-4285-8525-265efa834fb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnis7ahx5p2k", "content": "CVE-2026-10737. CVSS 7.5. SP Project & Document Manager leaks file metadata and download links to unauthenticated visitors. Your wp-config. Database backups. Client files. All exposed.\n\nUpdate to 4.71 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "creation_timestamp": "2026-06-04T23:38:26.800071Z"}, {"uuid": "27bb9312-7bef-42f0-ae99-8556f00d921f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mnisbxpsiv2l", "content": "CVE-2026-10737. CVSS 7.5. SP Project & Document Manager leaks file metadata and download links to anyone. No auth needed. Your wp-config could be next.\n\nUpdate to 4.71. now. \u2192 pulse-wp.com\n#WordPress #AccessControl #PotatoSecurity", "creation_timestamp": "2026-06-04T23:39:58.520689Z"}, {"uuid": "6917f2ed-5e50-4526-824d-08bb7bb1bd05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnj3tf3oaw2f", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 136 interactions\nCVE-2026-0257: 43 interactions\nCVE-2026-48778: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-49858: 11 interactions\nCVE-2026-20230: 6 interactions\nCVE-2026-10737: 4 interactions\n", "creation_timestamp": "2026-06-05T02:30:48.004045Z"}, {"uuid": "adc2cae4-1061-4c4b-bc45-b6a3f24d2672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10737", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mormk4kdkx2u", "content": "CVE-2026-10737 sp-client-document-manager (CVSS Score 7.5) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-06-21T05:16:18.641571Z"}, {"uuid": "3c1b17d2-cebb-41b4-9d81-1bd22e170b3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107376", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxf3r7s2vp2k", "content": "\ud83d\udfe0 CVE-2026-107376 - High (8.2)\n\nwebonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, Graph...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107376/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-08T18:30:51.788545Z"}, {"uuid": "7368bafd-f16e-45ef-86e7-7b2a312127c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107377", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxf3rg7pvx2a", "content": "\ud83d\udfe0 CVE-2026-107377 - High (7.5)\n\ndatamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107377/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-08T18:30:58.126015Z"}, {"uuid": "f4cb0e3e-3166-4f6c-a373-0b9f009f08c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107375", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxf3rmgdfz23", "content": "\ud83d\udfe0 CVE-2026-107375 - High (8.8)\n\nJHipster is a development platform to quickly generate, develop, and deploy modern web applicatio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107375/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-08T18:31:04.683252Z"}, {"uuid": "605c5e65-bc29-4ddb-9d96-b7a636b218e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107377", "type": "seen", "source": "https://gist.github.com/alon710/3e22d3fd50d271868ba90ae51cdcae51", "content": "# CVE-2026-107377: CVE-2026-107377: Arbitrary File Write and Overwrite via Protobuf Weak Import Path Traversal in datamodel-code-generator\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107377\n\n## Summary\nA path traversal vulnerability in datamodel-code-generator allows remote attackers to write or overwrite arbitrary files on the local host filesystem via a manipulated Protobuf schema containing malicious weak import paths.\n\n## TL;DR\nUnsafe pathname concatenation using python's pathlib division (/) operator allows unauthenticated remote attackers to write or overwrite files outside the sandbox by supplying a crafted Protobuf schema.\n\n## Technical Details\n\n- **CWE ID**: CWE-22 / CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **Impact**: High Integrity Compromise (File Overwrite)\n- **Exploit Status**: Proof of Concept available in tests\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: >= 0.59.0, < 0.81.0 (Fixed in: `0.81.0`)\n\n## Mitigation\n\n- Upgrade datamodel-code-generator to version 0.81.0 or higher.\n- Isolate the code generation process in an unprivileged, read-only container environment.\n- Filter incoming .proto files to reject schemas containing relative pathing or absolute references in 'import weak' statements.\n\n**Remediation Steps:**\n1. Identify all deployment instances running datamodel-code-generator versions prior to 0.81.0.\n2. Update dependencies in requirements.txt or pyproject.toml to enforce 'datamodel-code-generator>=0.81.0'.\n3. Deploy the updated application and verify that validation fails when encountering weak imports pointing outside the workspace.\n4. Configure the underlying container or execution host to run the generation service with minimal system privileges.\n\n## References\n\n- [NVD - CVE-2026-107377](https://nvd.nist.gov/vuln/detail/CVE-2026-107377)\n- [GitHub Security Advisory GHSA-77xj-x4rm-935c](https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c)\n- [Official Fix Patch Commit](https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107377) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T19:30:29.000000Z"}, {"uuid": "2a1d80bb-3f95-49e2-adc8-51f58e9dbf65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107375", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mxfdotee5d2p", "content": "generator-jhipster v7.0.0, v9.2.0 generates Spring WebFlux/R2DBC applications with SQL injection in the sort parameter; CVE-2026-107375 is in the generated reactive code. #software", "creation_timestamp": "2026-10-08T20:52:41.392162Z"}]}