{"vulnerability": "CVE-2026-1186", "sightings": [{"uuid": "4209d2f3-28be-4daf-beba-d9b5096e37c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-1186", "type": "seen", "source": "https://cert.pl/en/posts/2026/02/CVE-2026-1186/", "content": "", "creation_timestamp": "2026-02-02T10:55:00.000000Z"}, {"uuid": "00254877-9b30-4509-b28d-2b60a326a7a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11861", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtj4bxi2an23", "content": "CVE-2026-11861 - red hat enterprise linux 10\nFreeIPA has a flaw that allows Active Directory users to bypass authentication for certain FreeIPA services when a trust relationship is set up between the two systems.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#redhat #CVE #infosec", "creation_timestamp": "2026-08-20T11:10:05.054991Z"}, {"uuid": "b3f51880-55d7-42b8-9554-b7819bb2d8b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11861", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtj7ielzru2p", "content": "\ud83d\udea8 CVE-2026-11861 \u2014 CVSS 9.6 CRITICAL\n\nA flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-11861\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-20T12:07:21.394494Z"}, {"uuid": "bd9f3d41-1b48-44b4-9bcf-2c477eda13b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11861", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtjd677vpb2h", "content": "FreeIPA\u3067\u3001Active Directory\u3068\u306e\u4fe1\u983c\u95a2\u4fc2\u8a2d\u5b9a\u6642\u306b\u3001PAC\u691c\u8a3c\u4e0d\u5099\u306b\u3088\u308aAD\u30e6\u30fc\u30b6\u30fc\u304cFreeIPA\u30b5\u30fc\u30d3\u30b9\u3067\u8a8d\u8a3c\u3092\u56de\u907f\u3067\u304d\u308b\u8106\u5f31\u6027\u3002AD\u30e6\u30fc\u30b6\u30fc\u306f\u7279\u6a29\u6607\u683c\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-11861 CVSS 9.6 | CRITICAL", "creation_timestamp": "2026-08-20T13:13:15.637575Z"}, {"uuid": "a53170a9-91b0-4906-af60-2b1957978d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-11860", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mod3ccvqf22h", "content": "OpenSolution Quick.CMS faces a HIGH severity deserialization flaw \u2014 admins using HTTP risk remote code execution. Upgrade to v6.8+ ASAP and avoid HTTP for admin access. https://radar.offseq.com/threat/cve-2026-11860-cwe-502-deserialization-of-untruste-3d43127c #OffSeq #security #patchnow", "creation_timestamp": "2026-06-15T10:30:27.285265Z"}, {"uuid": "89f11902-b754-4241-ab47-8ba8e1dc5839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-11860", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116753657025172840", "content": "\u26a0\ufe0f CVE-2026-11860 (HIGH): OpenSolution Quick.CMS vulnerable to deserialization of untrusted data over HTTP. Remote code execution possible if admin accesses panel. Upgrade to v6.8+ to enforce HTTPS and mitigate risk. https://radar.offseq.com/threat/cve-2026-11860-cwe-502-deserialization-of-untruste-3d43127c #OffSeq #infosec #vuln #php", "creation_timestamp": "2026-06-15T10:30:32.298314Z"}, {"uuid": "10954e3c-b3aa-4fde-a493-213258d9efb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11860", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3modaybnvpg2h", "content": "CVE-2026-11860 - Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS\nCVE ID : CVE-2026-11860\n \n Published : June 15, 2026, 10:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : Quick.CMS deserializes user-controlled data received over plain...", "creation_timestamp": "2026-06-15T12:12:12.544180Z"}, {"uuid": "beda8bc9-8f4f-488c-aaa3-7ec44c7d2124", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-11860", "type": "seen", "source": "https://cert.pl/en/posts/2026/06/CVE-2026-11860", "content": "", "creation_timestamp": "2026-06-15T03:55:00.000000Z"}, {"uuid": "36e0a3d0-02dd-4a54-b10c-21c1b4c572fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11861", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtn34yo64l2j", "content": "CVE-2026-11861 - freeipa\nIf you link FreeIPA with a Microsoft Active Directory, users from the AD side can log into FreeIPA services without proving who they are. This lets them access the web\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#freeipa #debian #Debian12 #CVE #infosec", "creation_timestamp": "2026-08-22T01:00:04.151140Z"}, {"uuid": "3fd3e208-62a8-42f2-a0be-9d1b4603d99b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11869", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq766nzxj42g", "content": "CVE-2026-11869 - WP DSGVO Tools (GDPR)\nCVE ID : CVE-2026-11869\n \n Published : July 9, 2026, 7:16 a.m. | 32\u00a0minutes ago\n \n Description : The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data...", "creation_timestamp": "2026-07-09T08:01:59.236510Z"}, {"uuid": "0beb187a-f23b-4f5d-aca3-5c1383d3178e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11866", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqwv3udz2h", "content": "CVE-2026-11866 - LatePoint\nCVE ID : CVE-2026-11866\n \n Published : July 16, 2026, 7:16 a.m. | 18\u00a0minutes ago\n \n Description : The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central req...", "creation_timestamp": "2026-07-16T07:52:45.355927Z"}, {"uuid": "4971b378-be7c-405b-9b11-aea12956988f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11868", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr2uguacm52g", "content": "CVE-2026-11868 - WP Travel\nCVE ID : CVE-2026-11868\n \n Published : July 20, 2026, 7:16 a.m. | 28\u00a0minutes ago\n \n Description : The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed t...", "creation_timestamp": "2026-07-20T08:22:00.086971Z"}, {"uuid": "9a3b2f48-e407-4d02-95db-08814aae4f79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11861", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mtvti6ezez24", "content": "\ud83d\udccc CVE-2026-11861 - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentic... https://www.cyberhub.blog/cves/CVE-2026-11861", "creation_timestamp": "2026-08-25T12:37:06.769520Z"}]}