{"vulnerability": "cve-2026-9222", "sightings": [{"uuid": "71378d25-2fae-4ba2-8f1e-012d152d5ecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9222", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mp5naf23d32g", "content": "CVE-2026-9222 (CRITICAL, CVSS 9.2): Setracker2 Android app (com.tgelec.setracker) uses password hash for authentication \u2014 attackers with the hash may gain full access. Monitor for vendor updates. https://radar.offseq.com/threat/cve-2026-9222-cwe-836-use-of-password-hash-instead-9894d1554efb5333 #...", "creation_timestamp": "2026-06-26T00:00:43.981981Z"}, {"uuid": "d2d09a94-aedc-40cc-9eee-1fc790af9232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9222", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116813466196592988", "content": "Setracker2 Android app (com.tgelec.setracker) hit by CRITICAL vuln (CVE-2026-9222, CVSS 9.2): uses password hash for authentication. Anyone with the hash can access backend services. Update guidance pending. https://radar.offseq.com/threat/cve-2026-9222-cwe-836-use-of-password-hash-instead-9894d1554efb5333 #OffSeq #AndroidSec #CVE20269222", "creation_timestamp": "2026-06-26T00:00:45.604270Z"}, {"uuid": "618a59d4-33ec-4cf4-81dd-aa74c27837ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9222", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5uudbgny27", "content": "CVE-2026-9222 - Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication\nCVE ID : CVE-2026-9222\n \n Published : June 25, 2026, 11:29 p.m. | 1\u00a0hour, 42\u00a0minutes ago\n \n Description : Setracker2 Android Companion App com.tgelec.setracke...", "creation_timestamp": "2026-06-26T02:17:08.228637Z"}, {"uuid": "80e4e5fe-b3a7-4725-82b9-90c00de1d853", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92229", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvtso26brn2b", "content": "\ud83d\udea8 CVE-2026-92229 \u2014 CVSS 9.1 CRITICAL\n\nThe The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnera...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92229\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-19T04:07:33.569490Z"}, {"uuid": "9125e82e-33a1-428f-9c56-3c3c212f07cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-92229", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117295823161676364", "content": "CVE-2026-92229: CRITICAL code injection in wpmudev Forminator Forms plugin (\u22641.57.2). Unauthenticated attackers can execute arbitrary shortcodes, risking full WordPress site compromise. Restrict or disable plugin now. https://radar.offseq.com/threat/cve-2026-92229-cwe-94-improper-control-of-generation-of-code-code-injection-in-wpmudev-forminator-8ac627c2b84841fc #OffSeq #WordPress #CVE202692229", "creation_timestamp": "2026-09-19T04:30:24.251891Z"}, {"uuid": "c2259acb-58c8-420e-8242-a79bd5ff07cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-92229", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvttwwno3z2e", "content": "CRITICAL: wpmudev Forminator Forms plugin (\u22641.57.2) vulnerable to code injection \u2014 unauthenticated attackers can execute arbitrary shortcodes. Restrict or disable until patched. https://radar.offseq.com/threat/cve-2026-92229-cwe-94-improper-control-of-generation-of-code-code-injection-in-wpmudev-...", "creation_timestamp": "2026-09-19T04:30:27.309488Z"}, {"uuid": "7da7d550-85a3-472c-95b5-dad30326a91d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92229", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvu36tepbc2r", "content": "CVE-2026-92229\nThe Forminator Forms plugin for WordPress (all versions up to 1.57.2) can let anyone on the internet cause the site to run hidden code snippets called shortcodes. This could let attackers display unwanted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-19T06:40:06.746002Z"}]}