{"vulnerability": "cve-2026-8237", "sightings": [{"uuid": "fb3c1ef8-9063-43d4-bd8b-ad7c2ed3f072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8237", "type": "seen", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "content": "", "creation_timestamp": "2026-08-01T16:00:04.379987Z"}, {"uuid": "ba79159f-bc2b-4967-98d5-30431d5010f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8237", "type": "published-proof-of-concept", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "content": "", "creation_timestamp": "2026-08-02T00:00:41.476866Z"}, {"uuid": "6dd5bbd5-7b01-4f04-a73a-f6986b21cebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8237", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-8237.yaml", "content": "", "creation_timestamp": "2026-08-19T15:00:16.740478Z"}, {"uuid": "814677f1-4fad-44d3-b2e8-d65fec6fa8ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82370", "type": "seen", "source": "https://gist.github.com/ichintu/2e9991c851b75a7aa99639fafeaa0cae", "content": "This threat intelligence briefing highlights four critical security developments from late September 2026:\n\n\u2022 **Brocade SANnav (CVE-2026-82370, 8.6):** An unauthenticated remote command injection flaw in versions <3.0.1a allows attackers to execute administrative CLI and container commands, risking Fibre Channel fabric manipulation.\n\u2022 **Check Point Zero-Days (CVE-2026-85102 & CVE-2026-93616, both 9.8):** Two actively exploited, pre-authentication vulnerabilities compromise the Spark firewall and management service. With functional exploits reverse-engineered in ~3 days, immediate patching, management console isolation, and proactive threat hunting are strongly advised.\n\u2022 **EthPress WordPress Plugin (CVE-2026-19125, 8.1):** A missing `return` statement in versions \u22642.3.5 causes an unauthenticated authentication bypass, allowing attackers to impersonate any wallet-linked user and achieve full site takeover.\n\u2022 **Loopjacking:** A newly documented attack vector (arXiv) that hijacks human-in-the-loop approval mechanisms, introducing novel risks to manual security workflows.\n\n**Overall:** The current landscape emphasizes urgent remediation of high-severity, unauthenticated flaws in critical infrastructure and web plugins, alongside emerging threats targeting procedural and human-centric security controls.", "creation_timestamp": "2026-09-24T04:01:56.879795Z"}]}