{"vulnerability": "cve-2026-1076", "sightings": [{"uuid": "34b15b29-653d-420a-b5b6-6deea639ce2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1076", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3md63ihrv252t", "content": "", "creation_timestamp": "2026-01-24T11:13:26.840909Z"}, {"uuid": "b6d15959-fe2a-4d34-bfe1-1907b0056ff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10766", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mng26gc5iq2c", "content": "CVE-2026-10766 - mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash\nCVE ID : CVE-2026-10766\n \n Published : June 3, 2026, 8:16 p.m. | 16\u00a0minutes ago\n \n Description : A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the f...", "creation_timestamp": "2026-06-03T21:23:09.985684Z"}, {"uuid": "d21e376a-fceb-4d52-a112-d4ef6e87bd62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10768", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-10768.yaml", "content": "", "creation_timestamp": "2026-08-14T18:00:14.201591Z"}, {"uuid": "589cd50b-6e5a-441a-b8d0-9cc8cc34a98e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10763", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpiqk3kwkp2d", "content": "CVE-2026-10763 - PROMOD V Insecure HTTP Communication\nCVE ID : CVE-2026-10763\n \n Published : June 30, 2026, 9:37 a.m. | 9\u00a0minutes ago\n \n Description : PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd...", "creation_timestamp": "2026-06-30T09:59:06.582526Z"}, {"uuid": "3ea998ca-7966-4d7e-96ce-ab59e0ecd871", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10764", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwqwpiqmgk2t", "content": "BVMS 4.5\uff5e12.3\u3067\u306f\u3001\u60c5\u5831\u6f0f\u6d29\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u4e2d\u9593\u8005\u653b\u6483\u3067\u6a5f\u5bc6\u30c7\u30fc\u30bf\u3078\u306e\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-10764 CVSS 8.7 | HIGH", "creation_timestamp": "2026-09-30T18:07:17.223580Z"}, {"uuid": "6fda5665-8971-4df2-9ab5-b63aab289f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107640", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxetrvcez42r", "content": "\ud83d\udea8 CVE-2026-107640 \u2014 CVSS 9.3 CRITICAL\n\nIntegrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/passw...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107640\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-08T16:08:04.236527Z"}, {"uuid": "72fbc90f-8de8-4c5d-9bbf-69945e205a4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107640", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxetvjycyt2q", "content": "CVE-2026-107640 - enswitch\nVersions 3.13 through 4.4 of Integrics Enswitch let anyone call the password\u2011reset API without proving they are the user. By sending a request that omits a required flag, an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#enswitch #integrics #CVE #infosec", "creation_timestamp": "2026-10-08T16:10:05.905673Z"}, {"uuid": "103e0645-8740-4424-85e5-20ece78c0c43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107640", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxeznhiooc2g", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-107640: Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthentic\u2026\nCVSS 9.1\nhttps://beta.vulnsea.com/cve/CVE-2026-107640\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-10-08T17:52:57.622093Z"}, {"uuid": "efaae069-8a27-4239-9b5b-3c7fb89fcdaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107699", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxf77gglae2h", "content": "\ud83d\udd34 CVE-2026-107699 - Critical (9.8)\n\nppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to exe...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107699/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-08T19:32:29.386928Z"}, {"uuid": "9aa26296-80a6-404b-906e-1c9d7b8992b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107699", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxfa6vtsmr22", "content": "CVE-2026-107699 - ppt2png\nThe ppt2png tool (versions up to 0.0.6) can run any operating\u2011system command when a malicious file name or folder path is supplied. This occurs because the program passes those names\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ppt2png #tzwm #CVE #infosec", "creation_timestamp": "2026-10-08T19:50:05.556422Z"}, {"uuid": "694f934f-79cb-47f5-a942-16ab2308a99e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107699", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxfb6orial2r", "content": "\ud83d\udea8 CVE-2026-107699 \u2014 CVSS 9.3 CRITICAL\n\nppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute opera...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107699\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-08T20:07:51.783444Z"}, {"uuid": "29a6cb8c-7ffd-4464-97cf-9583979a60e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107639", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxgg6uhycu22", "content": "CVE-2026-107639 - ilias\nIn older versions of the ILIAS e\u2011learning platform, a teacher can upload an image for a question and include special characters in the filename that the system does not properly clean. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ilias #CVE #infosec", "creation_timestamp": "2026-10-09T07:10:05.956611Z"}, {"uuid": "25270376-4754-4a60-8f5d-5145dd3e8a8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107645", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117414564739319764", "content": "CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account \u2014 including sites where the Dokan vendor signup is explicitly turned off \u2014 and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107645https://www.wordfence.com/threat-intel/vulnerabilities/id/7757f41d-c1f1-4df1-8048-b1c78a897548?source=cvehttps://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L241https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L181https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L24https://plugins.trac.wordpress.org/changeset/3735192/blocksy-companion/tags/2.1.59/framework/features/account-auth.php?old=3723693&old_path=blocksy-companion%2Ftags%2F2.1.58%2Fframework%2Ffeatures%2Faccount-auth.php#wordpress #creativethemeshq #BlocksyCompanion#CVE_2026_107645#bot", "creation_timestamp": "2026-10-10T03:47:56.840885Z"}, {"uuid": "e7418455-5949-4a76-8d59-442393207c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107645", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5qot7f2z", "content": "\ud83d\udea8 CVE-2026-107645 \u2014 CVSS 9.1 CRITICAL\n\nThe Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and inc...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107645\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T06:07:26.670693Z"}, {"uuid": "9edd7924-eb12-4429-8738-b0cb51e5efa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107645", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxitcgygww2z", "content": "CVE-2026-107645\nThe Blocksy Companion add\u2011on for WordPress (versions up to 2.1.58) can be tricked into creating a vendor account without proper checks. An attacker could sign up as a seller and be logged in automatically,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-10T06:10:04.203583Z"}, {"uuid": "1a455184-c55b-4d2f-84fc-70bb6b0f7e1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107657", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415694095528171", "content": "CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form The HivePress \u2013 Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href=\"%value%\">Custom link</a>), and for front-end user profiles to be enabled \u2014 both of which reflect the plugin's standard, documented configuration.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107657https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=cvehttps://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/components/class-attribute.php#L1298https://github.com/hivepress/hivepress/releases/tag/1.7.32#wordpress #hivepress #HivePress\u2013BusinessDirectory,Listings&ClassifiedAdsPlugin#CVE_2026_107657#bot", "creation_timestamp": "2026-10-10T08:35:09.341769Z"}, {"uuid": "071987bb-b578-4dc7-930b-8f2416a62710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107657", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/j5c45raqvce2t", "content": "CVE-2026-107657 - HivePress\nCVE ID : CVE-2026-107657\n \n Published : Oct. 10, 2026, 8:26 a.m. | 54\u00a0minutes ago\n \n Description : The HivePress \u2013 Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '&a...", "creation_timestamp": "2026-10-10T10:05:49.465707Z"}, {"uuid": "2f7cf39b-b120-4b82-b06f-a4eef9925e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107694", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420869798450189", "content": "CVE-2026-107694 Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107694https://wpscan.com/vulnerability/ddce69ff-5325-432c-9f3a-66ec9a19bcb4/#CVE_2026_107694#bot", "creation_timestamp": "2026-10-11T06:31:24.335595Z"}]}