{"vulnerability": "CVE-2026-5430", "sightings": [{"uuid": "80690c57-5a9f-4882-ae35-fbc9be6e0a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gdxntzqkx3yrb", "content": "CVE-2026-5430 - Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover\nCVE ID : CVE-2026-5430\n \n Published : Aug. 6, 2026, 7:33 a.m. | 47\u00a0minutes ago\n \n Description : The JWT authentication mechanism accepts tokens signed with algori...", "creation_timestamp": "2026-08-06T08:34:33.578188Z"}, {"uuid": "87a0b1bf-6f7f-4c44-8c3e-af7732f2bba3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117047743616861031", "content": "WSO2 Universal Gateway v4.5.0 & 4.6.0 affected by CRITICAL CVE-2026-5430 (CVSS 10.0). Improper JWT validation enables account takeover. No patch yet \u2014 apply compensating controls. https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-f913080655427dd8 #OffSeq #WSO2 #JWT #Vulnerability", "creation_timestamp": "2026-08-06T09:00:30.800898Z"}, {"uuid": "31dad500-a395-49aa-85f6-56a77d9fe2b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msfojgm2gi26", "content": "CRITICAL vuln: CVE-2026-5430 in WSO2 Universal Gateway (4.5.0/4.6.0) allows JWT auth bypass and full account takeover. No patch \u2014 restrict access & monitor logins. \ud83d\udd10 https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-...", "creation_timestamp": "2026-08-06T09:00:33.688442Z"}, {"uuid": "da1382f4-c7e7-447d-a48b-123dd2dfc59b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msfopshjtl2s", "content": "CVE-2026-5430\nThe JWT authentication in [Software Name] can accept tokens signed with unknown algorithms, allowing attackers to gain unauthorized access to the system. This could lead to the compromise of administrative\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-06T09:04:06.494696Z"}, {"uuid": "357b3317-50c0-4279-82f2-485d3006f597", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mphych4fat27", "content": "WSO2 patched seven flaws across API Manager and gateways, led by a CVSS 10 JWT auth bypass (CVE-2026-5430). Update WSO2 API Manager now.\n\n#WSO2 #APISecurity #CVE #AuthBypass #Cybersecurity #Infosec", "creation_timestamp": "2026-06-30T02:45:20.842503Z"}, {"uuid": "6929badb-9a39-436b-8c6f-1f5ccb222585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5430", "content": "", "creation_timestamp": "2026-08-06T12:15:04.860463Z"}, {"uuid": "84a48454-f233-44c8-8e37-4d1072187fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpivzdggor26", "content": "\ud83d\udccc CVE-2026-54305 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature ... https://www.cyberhub.blog/cves/CVE-2026-54305", "creation_timestamp": "2026-06-30T11:37:07.542103Z"}, {"uuid": "00d10c1f-936a-4cb0-bbf5-7895c159f991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54309", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mplesml2b72x", "content": "\ud83d\udccc CVE-2026-54309 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint ... https://www.cyberhub.blog/cves/CVE-2026-54309", "creation_timestamp": "2026-07-01T11:07:08.098988Z"}, {"uuid": "c6c0af01-a30b-4855-a821-2ec72f6dbd23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msrjqqnp7w2j", "content": "\ud83d\udccc CVE-2026-5430 - The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to... https://www.cyberhub.blog/cves/CVE-2026-5430", "creation_timestamp": "2026-08-11T02:07:06.921513Z"}, {"uuid": "ba740818-4513-4212-a89e-d43e14d230dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54307", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqm67u2njg2l", "content": "\ud83d\udccc CVE-2026-54307 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow... https://www.cyberhub.blog/cves/CVE-2026-54307", "creation_timestamp": "2026-07-14T12:07:06.248680Z"}, {"uuid": "fb15bb55-1c67-4ea1-9d63-bb0e3c65fe8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msimoieimb2n", "content": "WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside.\n\n#WSO2 #AccountTakeover #CVE #APIsecurity #CyberSecurity", "creation_timestamp": "2026-08-07T13:05:34.871245Z"}, {"uuid": "441ad4ab-37f7-4ed1-8ae8-54284faad726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4aq3wk2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:30.162014Z"}, {"uuid": "787fc6c8-848f-4078-ac53-785020325423", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl4m22m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:31.048475Z"}, {"uuid": "0dda6218-6691-4f3a-bbc8-87c274a04850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl5lc2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:31.916425Z"}, {"uuid": "fba1d04a-6503-417b-8610-74d496b69f00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl7js2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:32.797233Z"}, {"uuid": "b40bc908-df8a-4a2a-a1af-44f8cac89b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj22m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:33.694832Z"}, {"uuid": "f06ffa6b-e9da-4cab-a4e2-9b509e56c958", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj32m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:34.529646Z"}, {"uuid": "62ae6ae8-8fe4-4666-94de-f7f805aafeef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj42m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:35.373392Z"}, {"uuid": "887a547d-c0d6-4eed-b3aa-39943ff8089e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4clbie2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:36.277483Z"}, {"uuid": "feaaf757-a4e7-4184-8ee5-b9fa89c4a87c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54300", "type": "seen", "source": "https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78", "content": "# GHSA-HP3V-MFQW-H74C: GHSA-hp3v-mfqw-h74c: Missing Character Escaping in @astrojs/netlify Remote Image Pattern Configuration\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C\n\n## Summary\nA security vulnerability in @astrojs/netlify allows attackers to bypass remote image path restrictions by leveraging unescaped regular expression metacharacters. The integration adapter fails to sanitize developer-defined pathnames before interpolating them into a configuration JSON file consumed by Netlify's Edge Image CDN. This results in overly permissive matching behavior at the edge routing layer, enabling path-traversal and filter bypasses.\n\n## TL;DR\nThe @astrojs/netlify adapter fails to escape dots and other regular expression metacharacters in developer-defined image pathnames, generating insecure edge configurations that permit attackers to bypass path-level restrictions on Netlify's Image CDN.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-185: Incorrect Regular Expression / CWE-116: Improper Output Escaping\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Filter Bypass / Resource Hijacking\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Astro applications deployed on Netlify using @astrojs/netlify < 8.1.2\n- **@astrojs/netlify**: < 8.1.2 (Fixed in: `8.1.2`)\n\n## Mitigation\n\n- Upgrade @astrojs/netlify integration to version 8.1.2 or higher\n- Avoid utilizing dot characters or special regular expression symbols inside pathnames in astro.config.mjs remotePatterns\n- Restrict the configured remotePatterns hostname to highly specific subdomains or folders to limit bypass surface\n\n**Remediation Steps:**\n1. Run 'npm install @astrojs/netlify@latest' (or equivalent package manager command) to update the package to version 8.1.2 or later\n2. Verify the output by building the project locally using 'npm run build'\n3. Examine the generated '.netlify/v1/config.json' and verify that dots in pathnames are preceded by double backslashes (e.g., '\\\\.')\n\n## References\n\n- [GitHub Security Advisory GHSA-hp3v-mfqw-h74c](https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c)\n- [Related Vulnerability GHSA-529g-xq4f-cw38 (CVE-2026-54300)](https://github.com/advisories/GHSA-529g-xq4f-cw38)\n- [Astro Pull Request #17018](https://github.com/withastro/astro/pull/17018)\n- [Main Astro Repository](https://github.com/withastro/astro)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T04:31:23.737630Z"}, {"uuid": "ab61d562-0778-4e3a-8bf2-e7e86242106a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmlhm4caz2n", "content": "Patch WSO2 API Manager now \u2014 CVE-2026-5430 (CVSS 9.8) lets attackers forge admin JWTs for full account takeover. watchTowr reports active exploitation since 13 Sept. https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-16T07:10:04.860683Z"}, {"uuid": "2a21f06c-125c-4fb2-85c4-d13358dba545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvmr6nmdtr2v", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "creation_timestamp": "2026-09-16T08:52:26.547109Z"}, {"uuid": "64a0d356-9a96-4d2b-b373-a6281718c42d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://gist.github.com/ichintu/267a83b424137af67bec5f39bcd35594", "content": "This daily threat intelligence digest highlights four critical security updates from September 2026:\n\n\u2022 **Arista EOS (CVE-2026-73447):** Critical (9.4) OS command injection in gNSI Certz/Bootz services allows authenticated users to escalate privileges and fully compromise devices.\n\u2022 **WSO2 API Manager (CVE-2026-5430):** Critical (9.8) JWT signature verification flaw enables forged admin tokens for account takeover; actively exploited in the wild.\n\u2022 **Oracle September 2026 CSPU:** Major patch release addressing 673 vulnerabilities, including several rated CVSS 10.0.\n\u2022 **VeloCloud Edge (CVE-2026-86108):** High (8.0) input validation weakness in management workflows can be abused for elevated OS command execution.\n\n**Recommendation:** Organizations should prioritize immediate patching and threat monitoring for these critical flaws to prevent privilege escalation, account compromise, and active exploitation.", "creation_timestamp": "2026-09-16T08:02:29.847818Z"}, {"uuid": "c7ffe78e-4c32-4ca8-b34b-15e891a37feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvmpw6mheq2z", "content": "\ud83e\udd16 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager actively exploited in the wild. Forged admin tokens allow full account takeover. Patch now.\nhttps://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-16T08:29:47.391271Z"}, {"uuid": "a700d96c-a797-4e1c-a4ef-9441d18545b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvmr4lu2hk2p", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "creation_timestamp": "2026-09-16T08:51:16.772716Z"}, {"uuid": "6b104104-c982-4e8c-a7ef-cc2374ce1e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvmr6cq3vx22", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "creation_timestamp": "2026-09-16T08:52:14.298485Z"}, {"uuid": "787fc4fc-8796-4aba-9709-fe2bfa9673e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/thehackernews/10066", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-16T09:00:04.032868Z"}, {"uuid": "3212ecd1-c43e-4ec7-94f2-4c5cfd5440ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/CyberDispatch/2964", "content": "Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.", "creation_timestamp": "2026-09-16T10:00:05.375373Z"}, {"uuid": "98e1fbe5-1d16-43bc-90f8-974e942e936e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "content": "A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication", "creation_timestamp": "2026-09-16T10:00:45.367718Z"}, {"uuid": "52531a01-0892-4f8b-9f56-5eab0529e2bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/", "content": "The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data.\n\nThe post Enterprises Warned of Attacks Exploiting WSO2 Vulnerability appeared first on SecurityWeek.", "creation_timestamp": "2026-09-16T10:00:45.526665Z"}, {"uuid": "7acc8523-f48f-433d-9f67-72b116488951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvmzkw6otj2r", "content": "WSO2 API Manager \u306b\u3001\u7ba1\u7406\u8005\u30c8\u30fc\u30af\u30f3\u507d\u88c5\u306b\u3088\u308b JWT \u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027 (CVE-2026-5430) \u304c\u767a\u898b\u3055\u308c\u3001\u6d3b\u767a\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002(\u2026", "creation_timestamp": "2026-09-16T11:22:28.143872Z"}, {"uuid": "96e13109-4cda-459a-943b-a2be6d3fd6ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117279777014363970", "content": "\ud83e\udd16 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager under active exploitation. Attackers forge admin tokens via improper crypto signature verification, leading to full account takeover. Details by watchTowr.\ud83d\udd17 https://thehackernews.com/2026/09/active-exploitation-attempts-target.html#CVE #InfoSec #CyberSec", "creation_timestamp": "2026-09-16T13:59:15.474778Z"}, {"uuid": "1c114730-cf96-4241-9f1b-50b3fa314825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/ViralCyber/26273", "content": "\ud83d\udd34\u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0646\u0642\u0635 \u062f\u0648\u0631 \u0632\u062f\u0646 JWT \u062f\u0631 WSO2 API Manager \u0628\u0627 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc watchTowr \u0627\u0632 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 WSO2 API Manager \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-5430 (\u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f8) \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0628\u0631\u0631\u0633\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a JWT \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0628\u0627 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c\u0647\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc\u200c\u0646\u0634\u062f\u0647\u060c \u0627\u062c\u0627\u0632\u0647 \u0639\u0628\u0648\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062a\u0635\u0627\u062d\u0628 \u06a9\u0627\u0645\u0644 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n\n\u0647\u0627\u0646\u06cc\u200c\u067e\u0627\u062a\u200c\u0647\u0627\u06cc watchTowr \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f3 \u0633\u067e\u062a\u0627\u0645\u0628\u0631\u060c \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc JWT \u062c\u0639\u0644\u06cc \u062d\u0627\u0648\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u067e\u06cc\u0634 \u062a\u0639\u0628\u06cc\u0647\u200c\u0634\u062f\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f4.\u06f1.\u06f0 \u062a\u0627 \u06f4.\u06f6.\u06f0 \u0627\u0632 API Manager\u060c API Control Plane\u060c Traffic Manager \u0648 Universal Gateway \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\u0628\u0647 \u06af\u0641\u062a\u0647 \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646\u060c \u0627\u06cc\u0646 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u062a\u0645\u0627\u0645 \u0646\u0642\u0627\u0637 \u067e\u0627\u06cc\u0627\u0646\u06cc \u0628\u06a9\u200c\u0627\u0646\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0645\u0635\u0631\u0641\u200c\u06a9\u0646\u0646\u062f\u0647 \u0648 \u0627\u0633\u0631\u0627\u0631 \u062a\u0645\u0627\u0645 \u0627\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646\u200c\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0645\u06a9\u0627\u0646 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc \u062f\u0631 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u062f\u0627\u062e\u0644\u06cc \u0633\u0627\u0632\u0645\u0627\u0646 \u0631\u0627 \u0628\u062f\u0647\u0646\u062f.\n\n\n\u062c\u0647\u062a \u0645\u0637\u0627\u0644\u0639\u0647 \u06a9\u0627\u0645\u0644 \u062e\u0628\u0631 \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f\n\n\ud83c\udd94 @TakianCo\n\ud83c\uddee\ud83c\uddf7", "creation_timestamp": "2026-09-16T16:00:03.852808Z"}, {"uuid": "a29e519e-dd70-4193-9176-5b3c769a622a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjc6tadd2t", "content": "Critical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-16T16:03:54.361331Z"}, {"uuid": "9cf94fce-84c4-40c8-baa3-b36aaa23b674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117281560448148242", "content": "\ud83d\udcf0 Critical WSO2 API Flaw Under Active Attack, Exposes Enterprise Data\nCritical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-wso2-api-vulnerability-cve-2026-5430-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-16T16:03:15.299603Z"}, {"uuid": "526e3195-1b15-4d7e-9fbb-3fee8d3b21ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvo3jewp2k2d", "content": "Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.\u2026\n#hackernews #news", "creation_timestamp": "2026-09-16T21:30:03.120392Z"}, {"uuid": "f4a0409c-8e5d-425e-81a8-5f4fdf0b316a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/thehackernews/10066", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-17T01:00:04.539372Z"}, {"uuid": "8cf17ed8-5a37-447c-ba2c-f6c25a30453e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f259b169-f7e7-4be8-9dae-1a7a384eba15", "content": "", "creation_timestamp": "2026-09-17T06:01:19.506128Z"}, {"uuid": "cc55e27e-0e5e-4c93-b8bc-23c16a45410e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/pphm_HackerNews/3181", "content": "\ud83d\udd34 Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\" according to an advisory released by WSO2 in May 2026. \"Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\"", "creation_timestamp": "2026-09-17T11:00:04.435073Z"}, {"uuid": "74e9fbba-6ba9-479a-915b-47243b515f2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mvqdsjz25s2f", "content": "WSO2 CVE-2026-5430: Authentication Bypass in API Management Infrastructure via JWT with Unsupported Algorithm dev.to/anoymask/wso...", "creation_timestamp": "2026-09-17T19:03:41.190828Z"}, {"uuid": "46d7ec69-c96f-4780-b0b8-4face4347545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3181", "content": "\ud83d\udd34 Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\" according to an advisory released by WSO2 in May 2026. \"Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\"", "creation_timestamp": "2026-09-18T00:00:06.517106Z"}, {"uuid": "c66e2255-4fbe-43f5-bc72-529284abce55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "Telegram/dq3S5iEvkq3DxtfvQCt3KhtYaU_n-BFHDpC50159zutTbw", "content": "", "creation_timestamp": "2026-09-18T04:00:05.902764Z"}, {"uuid": "4feea4b4-4fbd-4381-a37f-8655bec6fede", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "Telegram/29Fa6kOu2Kkjlzr-wySBlSXFcHEZP-1nUpNSNRyD8H-deyE", "content": "", "creation_timestamp": "2026-09-18T04:00:09.892781Z"}, {"uuid": "f6c5e7e5-b9e0-4d41-b729-88e0eb9d0c29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "Telegram/29Fa6kOu2Kkjlzr-wySBlSXFcHEZP-1nUpNSNRyD8H-deyE", "content": "", "creation_timestamp": "2026-09-19T00:00:23.943038Z"}, {"uuid": "a0ec7b33-55e5-41fd-a54e-b1e536faf4b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwbyqzprjv25", "content": "\ud83d\uded1 CVE-2026-5430\nWSO2 Multiple Products\nCVSS 10.0 / EPSS 0% / KEV: No\nTL;DR: The JWT authentication mechanism accepts tokens signed with algorithms other than tho\u2026\nhttps://cvesentinel.com/report/CVE-2026-5430?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-24T19:33:52.889379Z"}, {"uuid": "f0c8275d-e935-4952-a5c1-46583daf2fd7", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8f7cfd29-507e-4803-9548-bed3f0cfe455", "content": "", "creation_timestamp": "2026-09-24T20:00:02.337118Z"}, {"uuid": "ab9c0f0d-1add-41bd-acdf-7e18482236b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwcyrsdmlq2e", "content": "CISA added CVE-2026-5430, a JWT auth bypass in WSO2 API Manager exploited since Sept 13 per watchTowr, and CVE-2026-71362, an Adobe Commerce/Magento auth flaw exploited since August per Sansec, to its KEV catalog today.", "creation_timestamp": "2026-09-25T05:06:58.758357Z"}, {"uuid": "319c39d6-2791-4c89-9302-772eb71d5a51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwd5guhoez2x", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-5430: \u26a0\ufe0f CVE-2026-5430: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-5430-the-jwt-authentication-mechanism-accepts-tokens", "creation_timestamp": "2026-09-25T06:30:19.912115Z"}, {"uuid": "089c8261-0238-47b4-b64c-ea707abfa8ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://gist.github.com/ichintu/a425ebd263532d7f7c22e2d83104242b", "content": "On September 25, 2026, three high-severity vulnerabilities were reported: **CVE-2026-97818** (phpIPAM API authorization bypass, CVSS 8.6), **CVE-2026-97735** (ITFlow SVG file upload flaw, CVSS 8.0), and **CVE-2026-5430** (WSO2 path traversal, CVSS 9.8). CISA added the WSO2 and Adobe Commerce/Magento flaws to its Known Exploited Vulnerabilities (KEV) catalog due to confirmed active exploitation. Affected organizations should prioritize patching and apply immediate mitigations.", "creation_timestamp": "2026-09-25T08:00:24.000000Z"}, {"uuid": "8b739174-470d-40e1-a9e1-8a0d9e1f3531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwdcn3sxh52a", "content": "\ud83e\udd16 CISA KEV: two flaws exploited in the wild. CVE-2026-5430 (CVSS 9.8) path traversal in WSO2 API Control Plane, plus an Adobe Commerce/Magento flaw. Patch exposed instances.\nhttps://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html", "creation_timestamp": "2026-09-25T08:03:17.816773Z"}, {"uuid": "89b88fcc-ef92-433f-bc82-4476dc520d84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-902dbb9a-d2bd1d0cae7745d0", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products [\u2026]U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog", "creation_timestamp": "2026-09-25T09:05:00.885737Z"}, {"uuid": "43db6f2e-b8f1-4786-826e-11763d588233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in  WSO2 API Control Plane,", "creation_timestamp": "2026-09-25T02:46:34.000000Z"}, {"uuid": "f49fc21a-e230-4b2a-ac36-fd77942af2ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "Telegram/TDth3IpXKH6e1Q-59ElaBLQEA0J6sHsnnXUTIp0QQIzTww", "content": "", "creation_timestamp": "2026-09-25T08:57:45.000000Z"}, {"uuid": "75a389a7-55e9-4431-8713-26cc059e4a14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "Telegram/TDth3IpXKH6e1Q-59ElaBLQEA0J6sHsnnXUTIp0QQIzTww", "content": "", "creation_timestamp": "2026-09-25T08:57:45.000000Z"}, {"uuid": "74f26d1f-876c-4712-841a-1f128832cd21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwdtazdv5p2s", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-5430 \u2013 WSO2 Multiple Products Path Traversal\u00a0Vulnerability\n\nAnalyze the technical mechanics of CVE-2026-5430 with our WSO2 TSUITE brief, covering directory traversal vectors, unrestricted file uploads, and endpoint\u2026\n\nhttps://thecybermind.co/bg2r", "creation_timestamp": "2026-09-25T13:00:46.853206Z"}, {"uuid": "ed43f396-4d5a-49c8-92d5-018d2dc67214", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwe5c3vhap2a", "content": "CISA KEV: CVE-2026-5430 (WSO2, CVSS 10.0) and CVE-2026-71362 (Adobe Commerce, CVSS 9.1) added 9/24. Federal\u2026 https://0daynews.com/articles/2026-09-25-wso2-adobe-commerce-cisa-kev-cve-2026-5430-cve-2026-71362/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3534", "creation_timestamp": "2026-09-25T16:00:21.312177Z"}, {"uuid": "685f3813-3052-40b9-a8ad-e55fc169a024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117332796561127193", "content": "CISA has updated the catalogue.\n-  CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=&field_date_added_wrapper=all&sort_by=field_date_added&items_per_page=20\n-  CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-67279\nYesterday:\n- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-71362\n-  CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-5430 #CISA #infosec #vulnerability #Microsoft #Adobe", "creation_timestamp": "2026-09-25T17:13:13.846126Z"}, {"uuid": "48848095-e9f4-470f-8065-3f8278dbb0c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mwebyvtmyb2j", "content": "The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.", "creation_timestamp": "2026-09-25T17:24:40.379178Z"}, {"uuid": "f285ef9f-0780-401b-82f6-9bdde11a5086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mweeyxsbuf2v", "content": "\ud83e\udd16 CISA added two critical bugs to its KEV catalog: CVE-2026-5430, a WSO2 auth bypass, and CVE-2026-71362, an Adobe Commerce flaw \u2014 both actively exploited in the wild.\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "creation_timestamp": "2026-09-25T18:18:23.653677Z"}, {"uuid": "acec0d5e-d51d-4913-af4f-1201295d96a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "content": "The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]", "creation_timestamp": "2026-09-25T15:24:20.000000Z"}, {"uuid": "ef12ea89-c456-4c8f-a5a9-70ffeb4c38c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwepofr5tp2c", "content": "WSO2\u88fd\u54c1\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027(CVE-2026-5430)\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002CISA\u306fSharepoint\u3001Adobe Commerce\u3082\u5f71\u97ff\u3092\u53d7\u3051\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002", "creation_timestamp": "2026-09-25T21:29:20.963622Z"}, {"uuid": "65932396-f784-4462-b468-77143707ecce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44600", "content": "CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "creation_timestamp": "2026-09-25T23:00:36.000000Z"}, {"uuid": "eca6ae3c-dcad-4aa8-9605-5e2a5dacfd1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwflyc2jmw2n", "content": "\ud83d\udee1\ufe0f Failles exploit\u00e9es : Check Point SMS (CVE-2026-93616) et F5 BIG-IP (CVE-2026-94127) \u2014 CERT-FR ; CISA : SharePoint, WSO2 (CVE-2026-5430), Adobe Commerce.\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1219/", "creation_timestamp": "2026-09-26T05:55:56.711712Z"}, {"uuid": "04b8a1b1-a06e-4f6c-b14b-bd2b2834e466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwfntnyhwa22", "content": "\ud83e\udd16 CISA KEV: CVE-2026-5430 (max sev), JWT auth bypass in WSO2 API Manager 4.1.0-4.6.0: forged tokens leak app credentials. Exploitation attempts seen. Fed deadline Sep 27.\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "creation_timestamp": "2026-09-26T06:29:08.875813Z"}, {"uuid": "56429694-b3ab-40bb-932c-150b34ec5034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/calmnewzvibez.bsky.social/post/3mwg6jblk6625", "content": "WSO2 JWT Authentication Bypass: Analyzing the CVE-2026-5430 Critical Flaw\n\nExpert analysis of CVE-2026-5430, a critical authentication bypass in WSO2 products. Explore the technical root cause, active exploitation, and CISA remediation\n\n#CISA #WSO2\n\nRead more \u2192", "creation_timestamp": "2026-09-26T11:27:34.616019Z"}, {"uuid": "6a8e4fde-19d3-4337-968b-f068159153b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwhmnvkip22d", "content": "CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise softw\u2026\n#hackernews #news", "creation_timestamp": "2026-09-27T01:13:21.787359Z"}, {"uuid": "68b3f1ba-5752-404f-97ff-430693839d13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3301", "content": "\ud83d\udd34 WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.\n\nThe vulnerabilities are listed below -\n\nCVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution.\n\nCVE-2026-71362 (CVSS score: 9.1) - An incorrect authorization vulnerability in Adobe Commerce and Magento that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.", "creation_timestamp": "2026-09-25T11:30:44.000000Z"}, {"uuid": "44a592d7-b8a6-415b-b647-2054cbfc322d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/BleepingComputer/25654", "content": "\u200aCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "creation_timestamp": "2026-09-27T09:40:05.000000Z"}, {"uuid": "73c31b04-3370-49e1-8fd4-12d99873c39d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/BleepingComputer/25654", "content": "\u200aCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "creation_timestamp": "2026-09-27T09:40:05.000000Z"}, {"uuid": "816e9fc5-26cc-4592-b944-6773efd02f9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/baseleeak/404", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "creation_timestamp": "2026-09-28T19:54:03.000000Z"}, {"uuid": "9781cdfc-94ac-4d8e-a541-4dc59ed3c1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/baseleeak/404", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "creation_timestamp": "2026-09-28T19:54:03.000000Z"}, {"uuid": "bb1c3fcc-65de-4e7e-a34f-ea995104af77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "content": "", "creation_timestamp": "2026-09-26T09:00:04.000000Z"}, {"uuid": "6b235fe1-6704-4476-be38-cdc9e31d00d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwn7wtvamv2t", "content": "Another day, another glorious flaw as CVE-2026-5430 allows anyone with a forged token to casually crown themselves admin across WSO2 API Manager and Gateway control planes. Organizations relying on these gateways are the unlucky targets who handed over digital keys because basic ...\n\nRead full story", "creation_timestamp": "2026-09-29T06:41:41.488047Z"}, {"uuid": "474a6c47-a7ed-4b78-9633-d9f1a17b94b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "published-proof-of-concept", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "content": "", "creation_timestamp": "2026-09-26T09:00:04.000000Z"}]}