{"vulnerability": "cve-2026-9386", "sightings": [{"uuid": "375e7d1b-99f4-4970-a4fd-8e6d3472aa38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9386", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motuntmise2z", "content": "\ud83d\udea8  ALERT: CVE-2026-9386\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nA vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command i", "creation_timestamp": "2026-06-22T02:46:57.373202Z"}, {"uuid": "c25f7044-c405-4c43-9e6c-195a78450d9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93868", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvt2v5jjpb2r", "content": "\ud83d\udfe0 CVE-2026-93868 - High (8.1)\n\nCotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93868/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-18T21:02:03.482356Z"}, {"uuid": "ae6d4878-cec2-4bab-b99d-6907e140cb2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93868", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gntdxhbaxnqn5", "content": "CVE-2026-93868 - Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG\nCVE ID : CVE-2026-93868\n \n Published : Sept. 18, 2026, 8:17 p.m. | 1\u00a0hour, 5\u00a0minutes ago\n \n Description : Cotonti through 1.0.0 derives password recovery validation tokens from md5(microti...", "creation_timestamp": "2026-09-18T22:04:31.680832Z"}, {"uuid": "a2c876b3-a622-45bc-a6f5-8d2cf102cf1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93868", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvt6pssb6j2g", "content": "\ud83d\udea8 CVE-2026-93868 \u2014 CVSS 9.2 CRITICAL\n\nCotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecove...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93868\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-18T22:10:38.027172Z"}, {"uuid": "cac0293d-d36c-4e6d-91fb-62a684c94e3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93868", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvt7snhzuc2j", "content": "CVE-2026-93868 - cotonti\nThe password reset feature in Cotonti (up to version 1.0.0) creates codes that can be guessed because they are based on the server's current time. An attacker who knows the server's clock can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cotonti #CVE #infosec", "creation_timestamp": "2026-09-18T22:30:07.364511Z"}, {"uuid": "2d744086-eb05-4edc-9291-5c9bcd09dc73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93868", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwcrox67uy2g", "content": "CVE-2026-93868: Cotonti's password reset tokens use md5(microtime()), only ~1M guesses. Unauth attackers can brute-force admin resets. CVSS 8.1, no patch. Update or mitigate now. https://www.valtersit.com/cve/CVE-2026-93868/ #CVE #infosec #Cotonti", "creation_timestamp": "2026-09-25T03:00:06.745605Z"}, {"uuid": "5d1d8e27-0198-4e36-a148-a636e14e902f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93868", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117329442012536726", "content": "CVE-2026-93868: Cotonti's password reset tokens use md5(microtime()), only ~1M guesses. Unauth attackers can brute-force admin resets. CVSS 8.1, no patch. Update or mitigate now. https://www.valtersit.com/cve/CVE-2026-93868/ #CVE #infosec #Cotonti", "creation_timestamp": "2026-09-25T03:00:12.922488Z"}]}