{"uuid": "fdf10ff7-dd82-46f8-a008-92fa88c3e86d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d", "content": "This threat intelligence brief covers two unauthenticated vulnerabilities published in September 2026:\n\n\u2022 **CVE-2026-18351 (CRITICAL, 9.8):** Affects the WordPress plugin *Drag and Drop File Upload for Elementor Forms* (\u22641.6.0). Flawed MIME validation allows unauthenticated arbitrary file uploads, enabling remote code execution (RCE).\n\n\u2022 **CVE-2026-59160 (HIGH, 8.8):** Affects the Node.js package *@yeger/turbo-graph* v2.8.8. Combines insecure network binding (`0.0.0.0`) with an unauthenticated API endpoint, allowing adjacent-network attackers to execute arbitrary tasks via CLI argument injection, potentially resulting in RCE and infrastructure compromise.\n\nBoth vulnerabilities require no authentication, though CVE-2026-59160 is limited to attackers on the same local network segment.", "creation_timestamp": "2026-09-10T04:01:24.927169Z"}