{"vulnerability": "cve-2026-9387", "sightings": [{"uuid": "396effa2-05e0-4b0f-9a5a-d3e28c19880d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9387", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motuo2fcjb2n", "content": "\ud83d\udea8  ALERT: CVE-2026-9387\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nA security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument res", "creation_timestamp": "2026-06-22T02:47:03.349610Z"}, {"uuid": "94f2158e-d684-4bbc-b733-1715f3715b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93872", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvt2uopbkq2m", "content": "\ud83d\udfe0 CVE-2026-93872 - High (7.5)\n\nCotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes res...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93872/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-18T21:01:47.889028Z"}, {"uuid": "e052cccb-dc14-4ab4-97a2-25910f4282d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93872", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117313399497837624", "content": "CVE-2026-93872 Cotonti 1.0.0: PHP object injection via unserialize() in comments EditAction lets registered users hit RCE through gadget chains. CVSS 7.5, no patch yet. Restrict access or update immediately. https://www.valtersit.com/cve/CVE-2026-93872/ #CVE #infosec", "creation_timestamp": "2026-09-22T07:00:36.954514Z"}, {"uuid": "e0f33364-3ffd-4343-a38a-a0c33959d9e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93871", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwhsmvhwqd27", "content": "CVE-2026-93871 Cotonti through 1.0.0 open redirect lets authenticated page editors store redirects to malicious hosts for phishing. CVSS 5.4, no patch yet. Restrict page permissions now. https://www.valtersit.com/cve/CVE-2026-93871/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-27T03:00:10.348347Z"}, {"uuid": "e8f62e28-9900-4545-bd27-8157f2ab8598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93871", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117340766688072334", "content": "CVE-2026-93871 Cotonti through 1.0.0 open redirect lets authenticated page editors store redirects to malicious hosts for phishing. CVSS 5.4, no patch yet. Restrict page permissions now. https://www.valtersit.com/cve/CVE-2026-93871/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-27T03:00:11.093935Z"}]}