{"vulnerability": "CVE-2026-7718", "sightings": [{"uuid": "4e7a9c78-08e2-4638-9551-333833a8cebe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7718", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkyu7b3ajc2o", "content": "CVE-2026-7718 - Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection\nCVE ID : CVE-2026-7718\n \n Published : May 4, 2026, 2:15 a.m. | 18\u00a0minutes ago\n \n Description : A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the functio...", "creation_timestamp": "2026-05-04T04:41:15.956941Z"}, {"uuid": "b6dc8bd2-ed98-4eac-be07-9942d476ffd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77189", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7p55mag5jypmt", "content": "CVE-2026-77189 - Charitable\nCVE ID : CVE-2026-77189\n \n Published : Sept. 1, 2026, 6:16 a.m. | 56\u00a0minutes ago\n \n Description : The Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerab...", "creation_timestamp": "2026-09-01T07:53:19.379375Z"}, {"uuid": "5260fa2f-f6cc-45a7-b02c-f43027696225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77180", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2047", "content": "", "creation_timestamp": "2026-09-03T08:45:16.089387Z"}, {"uuid": "092647da-39a5-4288-a284-9213bad5553e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77180", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-risolte-vulnerabilita-nei-prodotti-nginx", "content": "", "creation_timestamp": "2026-09-03T12:45:06.960476Z"}, {"uuid": "621ecba3-3967-47ff-baa7-6c7be11f86de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77180", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mumli32zq72z", "content": "\ud83d\udd17 CVE : CVE-2026-18329, CVE-2026-33278, CVE-2026-42959, CVE-2026-63020, CVE-2026-66362, CVE-2026-66842, CVE-2026-77180, CVE-2026-78222, CVE-2026-78689", "creation_timestamp": "2026-09-03T13:45:08.182527Z"}, {"uuid": "670de434-bdf3-4c96-92fa-af2fc8b12c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77180", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3muo3jxzcuk2z", "content": "nginx: CVE-2026-77180 [HIGH]\n\nWhen NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-77180", "creation_timestamp": "2026-09-04T04:05:10.666748Z"}, {"uuid": "24686ffe-cd1a-48a2-ba40-b1e6f10bdc34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77181", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvitv3uufk2t", "content": "CVE-2026-77181 - apache syncope\nIn Apache Syncope versions up to 3.0.16, 4.0.7 and 4.1.2, the system checks the wrong permission when changing a ClientApp, allowing users who can only create a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachesyncope #apachefoundation #CVE #infosec", "creation_timestamp": "2026-09-14T19:30:22.032644Z"}, {"uuid": "c0e071d3-0d99-45bb-8302-0723d8609dbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77185", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117359524453653609", "content": "Apache MINA SSHD auth bypass (CVE-2026-77185, CRITICAL, CVSS 9.1): Async public-key/hostbased auth can be skipped, risking full SSH compromise. Affected: 2.0.0 \u2013 2.19.x, 3.0.0-M1 \u2013 M5. Patch to 2.20.0/3.0.0-M6. https://radar.offseq.com/threat/cve-2026-77185-cwe-305-authentication-bypass-by-primary-weakness-in-apache-software-foundation-apache-18a51f96ab18bde1 #OffSeq #Apache #Infosec", "creation_timestamp": "2026-09-30T10:30:28.818833Z"}, {"uuid": "b7bcc8e1-1350-44d8-a6cf-62c8bd4338f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77185", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwq56wiarx22", "content": "Apache MINA SSHD hit by CRITICAL auth bypass (CVE-2026-77185). Affects 2.0.0 \u2013 2.19.x, 3.0.0-M1 \u2013 M5. Upgrade to 2.20.0/3.0.0-M6 to prevent unauthorized SSH access. https://radar.offseq.com/threat/cve-2026-77185-cwe-305-authentication-bypass-by-primary-weakness-in-apache-software-foundation-apach...", "creation_timestamp": "2026-09-30T10:30:30.772890Z"}, {"uuid": "d4b7ae3b-ba77-459e-b99e-d426cfce8852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77185", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwq6xozvdj2y", "content": "\ud83d\udd34 CVE-2026-77185 - Critical (9.1)\n\nAuthentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77185/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-30T11:02:16.319898Z"}, {"uuid": "bf408653-f142-467b-8cd6-beeff4c390fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77185", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwqcm4nenq24", "content": "\ud83d\udea8 CVE-2026-77185 \u2014 CVSS 9.1 CRITICAL\n\nAuthentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 fo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77185\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-30T12:07:21.954616Z"}, {"uuid": "5c0b008e-00fa-40f2-9047-eaebf150a748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77183", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415054665606260", "content": "CVE-2026-77183 FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint The FooSales \u2013 Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77183https://www.wordfence.com/threat-intel/vulnerabilities/id/97097d41-1d78-4db0-8ee2-70a776bd99f2?source=cvehttps://plugins.trac.wordpress.org/changeset/3719657/foosales/trunk/admin/class-foosales-rest-api.phphttps://plugins.trac.wordpress.org/changeset/3719657/foosales/trunk/admin/foosales-xmlrpc-functions.php#wordpress #foosales #FooSales\u2013PointofSale(POS)forWooCommerce#CVE_2026_77183#bot", "creation_timestamp": "2026-10-10T05:52:32.391060Z"}]}