{"vulnerability": "cve-2026-4505", "sightings": [{"uuid": "14c4c467-8983-4787-96a0-83892ae8f803", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-4505", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4505", "content": "", "creation_timestamp": "2026-03-20T19:16:50.000000Z"}, {"uuid": "1c9e2012-9b8a-48cc-a97b-3ecf8c4b3ce7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45055", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlrinfohog2k", "content": "CVE-2026-45055 - CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header\nCVE ID : CVE-2026-45055\n \n Published : May 13, 2026, 9:16 p.m. | 15\u00a0minutes ago\n \n Description : CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x \u2013 6.7.1 b...", "creation_timestamp": "2026-05-13T23:50:58.852771Z"}, {"uuid": "bf0d2644-f8f5-4187-8054-b36344703f0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45053", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlrmkdeov42p", "content": "CVE-2026-45053 - CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API\nCVE ID : CVE-2026-45053\n \n Published : May 13, 2026, 9:16 p.m. | 15\u00a0minutes ago\n \n Description : CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File ...", "creation_timestamp": "2026-05-14T01:00:51.229650Z"}, {"uuid": "2b4092a3-6004-4c40-be05-4a960650e009", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45058", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmwum6exuo2e", "content": "CVE-2026-45058 - electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark\nCVE ID : CVE-2026-45058\n \n Published : May 28, 2026, 6:16 p.m. | 54\u00a0minutes ago\n \n Description : electerm is an open-sourced terminal/ssh/sftp/telnet/serialport...", "creation_timestamp": "2026-05-28T20:33:32.880605Z"}, {"uuid": "5eb0b374-ad93-40cc-b130-b9ae2d7db92b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45051", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mpmvm2tqhx23", "content": "A critical OpenAM WebAuthn RCE flaw (CVE-2026-45051) allows code execution via Java deserialization. Update OpenAM to 16.1.1 to stay protected.\n\n#OpenAM #WebAuthn #RCE #CVE202645051 #CyberSecurity #InfoSec", "creation_timestamp": "2026-07-02T01:40:21.191031Z"}, {"uuid": "c248db7a-c3c4-416d-9537-7b519a05895a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2lbrim24", "content": "CVE-2026-45052 - org.openidentityplatform.openam:openam-federation-library\nOpenAM Community Edition versions 16.0.6 and below have a vulnerability that allows an unauthenticated attacker to modify\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openidentityplatform #Java #CVE #infosec", "creation_timestamp": "2026-09-15T10:10:04.601899Z"}, {"uuid": "cd858298-7829-43cb-b6ac-4d7662089b7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45051", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvkfmhs3kc2r", "content": "CVE-2026-45051 - org.openidentityplatform.openam:openam-auth-webauthn\nOpenAM's WebAuthn authentication module allows an attacker to run malicious code if they can write data to a specific storage\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openidentityplatform #Java #CVE #infosec", "creation_timestamp": "2026-09-15T10:20:04.623073Z"}, {"uuid": "26c98a45-f4c7-4086-8295-e6e33a518e89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-45051", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvkg72icoh2x", "content": "CRITICAL: OpenAM <16.1.1 has a deserialization flaw (CVE-2026-45051, CVSS 9.2) allowing remote code execution via WebAuthn. Upgrade to 16.1.1+ immediately. https://radar.offseq.com/threat/cve-2026-45051-cwe-502-deserialization-of-untrusted-data-in-openidentityplatform-openam-946ad921c23871b6 #Off...", "creation_timestamp": "2026-09-15T10:30:28.776556Z"}, {"uuid": "4a61b9c8-8dbc-4a2c-b094-fb27f2a1b582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45051", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvkllz7sl32j", "content": "\ud83d\udea8 CVE-2026-45051 \u2014 CVSS 9.2 CRITICAL\n\nOpen Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication l...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-45051\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:07:11.660982Z"}, {"uuid": "e20a2829-849f-41fe-b7fd-f4406ee52408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvklmb5fi32g", "content": "\ud83d\udea8 CVE-2026-45052 \u2014 CVSS 9.3 CRITICAL\n\nOpen Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-45052\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:07:20.011181Z"}, {"uuid": "1713effe-2751-4177-812c-d77dce37a57e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://gist.github.com/ichintu/6579574f2d6f7759d85ca961b532236a", "content": "This cybersecurity briefing highlights three primary trends:\n\n\u2022 **AI & Agent Security:** New platforms (ELITZE, Exaforce) focus on governing AI agent identities, permissions, and runtime access. Researchers also demonstrate OpenAI Codex sandbox escapes and note AI-accelerated exploitation (e.g., Marimo RCE compromising an SSH bastion in seconds).\n\u2022 **Active Threats & Vulnerabilities:** Attackers are mass-scanning exposed Vite development servers to harvest cloud credentials (exploiting CVE-2026-39364). Critical unauthenticated flaws were disclosed for TrxTimeATTENDANCE (RCE, CVE-2026-89308) and OpenAM (SOAP auth bypass, CVE-2026-45052). Additionally, the BambooToken malware continues targeting Windows/Linux systems via MQTT.\n\u2022 **Community & Tools:** Practitioners are sharing practical resources, including a verification tool for leaked cloud secrets and a low-cost guide to entering the EMFI hacking competition.\n\n**Overall:** The threat landscape is increasingly defined by AI workload governance challenges, automated credential harvesting from misconfigured dev servers, and rapidly exploited critical vulnerabilities.", "creation_timestamp": "2026-09-15T16:01:41.028250Z"}]}