https://vulnerability.circl.lu/sightings/feed 2026-09-12T19:17:34.176986+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ab4c4c18-2816-4535-9ecb-898134ff93db/export 2026-09-12T19:17:34.197226+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ab4c4c18-2816-4535-9ecb-898134ff93db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-18351 \u2014 Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:47.936760Z"} 2026-09-12T00:00:47.936760+00:00 https://vulnerability.circl.lu/sighting/0fb9633b-a8d4-411e-94eb-7206e96c8377/export 2026-09-12T19:17:34.297299+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0fb9633b-a8d4-411e-94eb-7206e96c8377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101987", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:30:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDrag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.\ud83d\udd25\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:47.888348Z"} 2026-09-12T00:00:47.888348+00:00 https://vulnerability.circl.lu/sighting/fe45ed95-f018-44ff-917c-ee0d14f1484d/export 2026-09-12T19:17:34.297448+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fe45ed95-f018-44ff-917c-ee0d14f1484d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-18351 \u2014 Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T08:00:08.420473Z"} 2026-09-11T08:00:08.420473+00:00 https://vulnerability.circl.lu/sighting/81bc6cd2-1077-4c81-b5ba-b417d3cab937/export 2026-09-12T19:17:34.297560+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "81bc6cd2-1077-4c81-b5ba-b417d3cab937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101987", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:30:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDrag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.\ud83d\udd25\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T08:00:08.368945Z"} 2026-09-11T08:00:08.368945+00:00 https://vulnerability.circl.lu/sighting/23d74c6d-03c4-4c16-bcf8-1ca5e7c90d91/export 2026-09-12T19:17:34.297661+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "23d74c6d-03c4-4c16-bcf8-1ca5e7c90d91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv56hq45s22f", "content": "\ud83d\udea8 CVE-2026-18351 \u2014 CVSS 9.8 CRITICAL\n\nThe Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Uplo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-18351\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T04:07:32.712923Z"} 2026-09-10T04:07:32.712923+00:00 https://vulnerability.circl.lu/sighting/fdf10ff7-dd82-46f8-a008-92fa88c3e86d/export 2026-09-12T19:17:34.297759+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fdf10ff7-dd82-46f8-a008-92fa88c3e86d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d", "content": "This threat intelligence brief covers two unauthenticated vulnerabilities published in September 2026:\n\n\u2022 **CVE-2026-18351 (CRITICAL, 9.8):** Affects the WordPress plugin *Drag and Drop File Upload for Elementor Forms* (\u22641.6.0). Flawed MIME validation allows unauthenticated arbitrary file uploads, enabling remote code execution (RCE).\n\n\u2022 **CVE-2026-59160 (HIGH, 8.8):** Affects the Node.js package *@yeger/turbo-graph* v2.8.8. Combines insecure network binding (`0.0.0.0`) with an unauthenticated API endpoint, allowing adjacent-network attackers to execute arbitrary tasks via CLI argument injection, potentially resulting in RCE and infrastructure compromise.\n\nBoth vulnerabilities require no authentication, though CVE-2026-59160 is limited to attackers on the same local network segment.", "creation_timestamp": "2026-09-10T04:01:24.927169Z"} 2026-09-10T04:01:24.927169+00:00 https://vulnerability.circl.lu/sighting/a29a0bdb-9e0a-492e-acce-f2375696cd8b/export 2026-09-12T19:17:34.297860+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a29a0bdb-9e0a-492e-acce-f2375696cd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv54wlmxuv2f", "content": "CVE-2026-18351 - drag and drop file upload for elementor forms\nThe Drag and Drop File Upload feature in the Elementor Forms plugin for WordPress, up through version 1.6.0, does not correctly verify the type of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#addonsorg #CVE #infosec", "creation_timestamp": "2026-09-10T03:40:03.849005Z"} 2026-09-10T03:40:03.849005+00:00 https://vulnerability.circl.lu/sighting/52e9c55f-4e02-461c-95cf-2dff82a0b74a/export 2026-09-12T19:17:34.297957+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "52e9c55f-4e02-461c-95cf-2dff82a0b74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18351", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mv52pwtwai25", "content": "Drag and Drop File Upload for Elementor Forms <=1.6.0 hit by CRITICAL CVE-2026-18351. Unauthenticated attackers can upload files & achieve RCE. Restrict plugin until patch confirmed. https://radar.offseq.com/threat/cve-2026-18351-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addonsor...", "creation_timestamp": "2026-09-10T03:00:33.579856Z"} 2026-09-10T03:00:33.579856+00:00 https://vulnerability.circl.lu/sighting/bfb687c8-f135-4e6a-85b3-497187843505/export 2026-09-12T19:17:34.298051+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bfb687c8-f135-4e6a-85b3-497187843505", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18351", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117244508969713610", "content": "CVE-2026-18351 (CRITICAL): addonsorg Drag and Drop File Upload for Elementor Forms <=1.6.0 lets unauthenticated attackers upload arbitrary files \u2014 enabling RCE. Restrict or disable plugin use until remediation. https://radar.offseq.com/threat/cve-2026-18351-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addonsorg-drag-and-drop-file-158dc74bccbdf605 #OffSeq #WordPress #Vuln #RCE", "creation_timestamp": "2026-09-10T03:00:32.011643Z"} 2026-09-10T03:00:32.011643+00:00