{"vulnerability": "CVE-2026-1456", "sightings": [{"uuid": "80471e9f-f63f-420b-929f-2aef40872f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1456", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3melmweqeno2j", "content": "", "creation_timestamp": "2026-02-11T13:55:16.681049Z"}, {"uuid": "af2af23b-47a9-4a68-81f2-9685d4ad3888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14561", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzq4bs6742i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14561: \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 WordPress \u0447\u0435\u0440\u0435\u0437 Authora - Easy Login \u0441 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u043c \u043d\u043e\u043c\u0435\u0440\u043e\u043c\n\n\n\nhttps://kripta.biz/posts/559CD1C2-BF2D-4C52-B221-023BDD87600F", "creation_timestamp": "2026-08-01T14:57:01.943123Z"}, {"uuid": "1f884f62-44ff-474b-a1f9-d1f29d7e6466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14561", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzq4wfpwa2n", "content": "CVE-2026-14561: \u05e4\u05e8\u05e6\u05ea \u05d0\u05d1\u05d8\u05d7\u05d4 \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1- Authora - Easy Login \u05e2\u05dd Mobile Number \u05d1\u05d5\u05d5\u05e8\u05d3\u05e4\u05e8\u05e1 - \u05db\u05d9\u05e6\u05d3 \u05dc\u05d4\u05d2\u05df \u05e2\u05dc \u05d4\u05d0\u05ea\u05e8 \u05e9\u05dc\u05da\n\n\n\nhttps://khesef.xyz/posts/8C3FEE36-F663-468A-BBC0-2D70CA328784", "creation_timestamp": "2026-08-01T14:57:23.615887Z"}, {"uuid": "1a5ab1a6-e7ba-4d77-971d-074eec050ce9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14561", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzqxaqnim2m", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14561 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Authora: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0442 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\n\n\nhttps://kripta.biz/posts/05EF151E-C095-445D-8BCB-4B847C44761F", "creation_timestamp": "2026-08-01T15:12:06.823437Z"}, {"uuid": "fa6a7360-1d5a-438e-9179-03b39d9a5c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14561", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzqxp6czm23", "content": "\u05d7\u05e9\u05d9\u05e4\u05ea \u05e4\u05e8\u05e6\u05ea \u05d4\u05d0\u05d1\u05d8\u05d7\u05d4 \u05d4\u05d7\u05de\u05d5\u05e8\u05d4 \u05d1\u05d5\u05d5\u05e8\u05d3\u05e4\u05e8\u05e1: \u05de\u05d4 \u05e9\u05d0\u05ea\u05dd \u05d7\u05d9\u05d9\u05d1\u05d9\u05dd \u05dc\u05d3\u05e2\u05ea \u05e2\u05dc CVE-2026-14561 \u05d1\u05e4\u05dc\u05d0\u05d2\u05d9\u05df 'Easy login with mobile number'\n\n\n\nhttps://khesef.xyz/posts/43D14D73-0840-46B8-8E1F-DF6A2C5A152D", "creation_timestamp": "2026-08-01T15:12:22.036334Z"}, {"uuid": "80896ff8-f048-4d04-b6f4-4acdfa5d3528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14561", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mryx5qayy72o", "content": "CRITICAL flaw in Authora: Easy login with mobile number (WordPress <1.7.7): attackers can log in as any user if they know a mobile number. Restrict plugin endpoints & monitor for abuse. https://radar.offseq.com/threat/cve-2026-14561-cwe-287-improper-authentication-in-authora-easy-login-with-mobil...", "creation_timestamp": "2026-08-01T07:30:27.999398Z"}, {"uuid": "11d3bd1f-ebd1-4c1f-8a1b-4e3eec43d0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14564", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117111090589446281", "content": "CVE-2026-14564: CRITICAL vuln in Logsign SIEM (6.4.97 \u2013 <6.4.114) due to insufficiently protected credentials (CWE-522). High-priv users can retrieve sensitive data. Patch status unknown \u2014 restrict access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-14564-cwe-522-insufficiently-protected-credentials-in-innotim-software-telecommunications-and-42bf4f857150f859 #OffSeq #SIEM #Vuln", "creation_timestamp": "2026-08-17T13:30:28.946368Z"}, {"uuid": "13e67329-8120-4d46-ba85-689c2de732cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14564", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtbsqbx47y2e", "content": "CRITICAL flaw in Logsign SIEM (6.4.97 \u2013 <6.4.114): CVE-2026-14564 enables high-priv users to extract embedded credentials. Restrict access & track vendor guidance. https://radar.offseq.com/threat/cve-2026-14564-cwe-522-insufficiently-protected-credentials-in-innotim-software-telecommunications-an...", "creation_timestamp": "2026-08-17T13:30:30.964757Z"}, {"uuid": "7568a02b-9a77-429a-979a-067c2077ec55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14564", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtbzs6dbgj2z", "content": "Logsign SIEM\u306e\u8a8d\u8a3c\u60c5\u5831\u4fdd\u8b77\u4e0d\u5099\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u306f\u57cb\u3081\u8fbc\u307e\u308c\u305f\u6a5f\u5bc6\u30c7\u30fc\u30bf\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\nCVE-2026-14564 CVSS 9.0 | CRITICAL", "creation_timestamp": "2026-08-17T15:36:49.752880Z"}, {"uuid": "2cb1f9d8-b373-4532-b933-b4cd21a8436a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14564", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtchf4m3xk2m", "content": "CVE-2026-14564 - logsign siem\nThe Logsign SIEM software stores sensitive information insecurely. This means that if an attacker gains access to the system, they may be able to view confidential data such as\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#logsignsiem #CVE #infosec", "creation_timestamp": "2026-08-17T19:40:04.195378Z"}, {"uuid": "74a21bec-c8bc-42ab-8b23-0b6049edb009", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14560", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ga4bpigi3qvrk", "content": "CVE-2026-14560 - Teddy Bear Customize Addon\nCVE ID : CVE-2026-14560\n \n Published : Sept. 11, 2026, 7:16 a.m. | 17\u00a0minutes ago\n \n Description : The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied ...", "creation_timestamp": "2026-09-11T07:50:57.080241Z"}, {"uuid": "80b76dd3-d296-47e3-8dc5-3f34a0a7ef0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14560", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvafymud4p2t", "content": "CVE-2026-14560 - teddy-bear-customize-addon\nThe teddy-bear-customize-addon WordPress plugin (versions up to 1.0.5) does not properly check files that are uploaded. This means anyone can place a malicious file on your\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "creation_timestamp": "2026-09-11T11:00:16.470828Z"}, {"uuid": "41de18ce-d947-4f96-aa24-b3a8d6e62de1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14563", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvagk7ocua2j", "content": "CVE-2026-14563 - advanced-customized-prompts\nThe WordPress plugin advanced-customized-prompts up to version 1.0.1 does not verify a password when it creates a login session for a supplied email address. As a result,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "creation_timestamp": "2026-09-11T11:10:06.930467Z"}, {"uuid": "2a0eeaef-2a8b-4526-95f9-a2421db34725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14560", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvajqiielq2p", "content": "\ud83d\udea8 CVE-2026-14560 \u2014 CVSS 10 CRITICAL\n\nThe teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, re...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-14560\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T12:07:16.978119Z"}, {"uuid": "6b1bf6d4-5a44-4c04-8798-61365582245c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14563", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvajqqoelg2b", "content": "\ud83d\udea8 CVE-2026-14563 \u2014 CVSS 9.8 CRITICAL\n\nThe advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-14563\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T12:07:25.519145Z"}, {"uuid": "206b5456-bcd4-4a4f-aa52-0524df98f2e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1456", "type": "seen", "source": "https://t.me/poxek/6361", "content": "\u0421\u043e\u0431\u0440\u0430\u043b GitLab \u0432\u0438\u0434\u0435\u043e PoC's  \ud83d\udd0d\n\n\u041f\u0440\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 CVE \u043f\u043e\u0434 GitLab \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e\u0439 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 PoC \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437 \u043d\u0438\u0445. \u0417\u0430\u043b\u0438\u043b \u0442\u0430\u043a\u0438\u0435 \u043a\u0435\u0439\u0441\u044b \u043a \u0441\u0435\u0431\u0435 \u043d\u0430 YouTube, \u0432\u0434\u0440\u0443\u0433 \u043a\u043e\u043c\u0443-\u0442\u043e \u0442\u043e\u0436\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u0438\u0442\u0441\u044f. \n\n\u0418\u0418\u0448\u043a\u0438 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043a\u0441\u0442\u0430\u0442\u0438, \u0432\u043e\u043e\u0431\u0449\u0435 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e \u043d\u0430 \u044d\u0442\u0438 CVE \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e proof of concept. \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f)\n\nRCE / command injection\n\u27a1\ufe0f CVE-2022-0751 - \u041d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f, \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u0430\u044f \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Gitlab.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0436\u0435\u0440\u0442\u0432\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\u27a1\ufe0f CVE-2023-1708 - \u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u0431\u043c\u0435\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434\n\u27a1\ufe0f CVE-2024-8402 - Maintainer \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e Google integration, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438.\n\u27a1\ufe0f CVE-2024-9773 - shell injection \u0447\u0435\u0440\u0435\u0437 Harbor project name / helper scripts\n\u27a1\ufe0f CVE-2024-8640 - Reverse shell with root access to analytics Cube instance\n\nSSRF\n\u27a1\ufe0f CVE-2024-9870 - Full SSRF \u0447\u0435\u0440\u0435\u0437 Workspaces\n\u27a1\ufe0f CVE-2022-4335 - Blind SSRF \u043d\u0430 repository mirroring (DNS rebinding)\n\u27a1\ufe0f CVE-2021-22179 - SSRF \u0432 webhook / outbound requests\n\u27a1\ufe0fCVE-2025-6454 - CRLF Injection in Webhook custom header could lead to blind SSRF\n\u27a1\ufe0fCVE-2024-8977 - Full read SSRF\n\nXSS\n\u27a1\ufe0f CVE-2024-8312 - Stored XSS with CSP bypass\n\u27a1\ufe0f CVE-2025-7734 - Stored XSS in blob viewer\n\nDoS\n\u27a1\ufe0f CVE-2026-1456 - DoS \u0447\u0435\u0440\u0435\u0437 tasks / GraphQL-ish \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443\n\u27a1\ufe0f CVE-2026-1458 - DoS + path traversal \u0432 \u0442\u043e\u043c \u0436\u0435 \u0434\u0443\u0445\u0435\n\u27a1\ufe0f CVE-2024-8177 - Harbor DoS\n\u27a1\ufe0f CVE-2024-12379 - \u0441\u0435\u0440\u0438\u044f screen recordings \u043f\u043e\u0434 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439\n\n\u041f\u0440\u043e\u0447\u0435\u0435\n\u27a1\ufe0f CVE-2026-1230 - \u041d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u044b\u043c\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438\n\u27a1\ufe0f CVE-2024-6502 - \u0412\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 GitLab \u043d\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u0437 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.\n\u27a1\ufe0f CVE-2024-8970 - Account takeover\n\u27a1\ufe0f CVE-2021-22203 - Arbitrary file read\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-10-07T09:16:13.000000Z"}]}