https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 15 Sep 2026 21:47:59 +0000 https://vulnerability.circl.lu/sighting/ba5afb7c-0e01-4458-af46-8e6336a9c43b/export {"uuid": "ba5afb7c-0e01-4458-af46-8e6336a9c43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n live-target evidence per report.\n\n\n{\n \"date\": \"2026-09-15\",\n \"count\": 3,\n \"redacted\": true,\n \"items\": [\n {\n \"cve\": \"CVE-2026-81648\",\n \"cvss\": 10.0,\n \"published\": \"2026-09-13T21:17:01.930\",\n \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90519\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:27.697\",\n \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90520\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:28.760\",\n \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n }\n ]\n}", "creation_timestamp": "2026-09-15T16:01:41.261926Z"} {"uuid": "ba5afb7c-0e01-4458-af46-8e6336a9c43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n live-target evidence per report.\n\n\n{\n \"date\": \"2026-09-15\",\n \"count\": 3,\n \"redacted\": true,\n \"items\": [\n {\n \"cve\": \"CVE-2026-81648\",\n \"cvss\": 10.0,\n \"published\": \"2026-09-13T21:17:01.930\",\n \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90519\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:27.697\",\n \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90520\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:28.760\",\n \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n }\n ]\n}", "creation_timestamp": "2026-09-15T16:01:41.261926Z"} https://vulnerability.circl.lu/sighting/ba5afb7c-0e01-4458-af46-8e6336a9c43b/export Tue, 15 Sep 2026 16:01:41 +0000 https://vulnerability.circl.lu/sighting/d6851b24-6fe0-4e16-900c-c71c6bdd0fb7/export {"uuid": "d6851b24-6fe0-4e16-900c-c71c6bdd0fb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhdhhkufz2k", "content": "\ud83d\udd34 CVE-2026-81648 - Critical (10)\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization ch...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81648/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T05:03:31.392546Z"} {"uuid": "d6851b24-6fe0-4e16-900c-c71c6bdd0fb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhdhhkufz2k", "content": "\ud83d\udd34 CVE-2026-81648 - Critical (10)\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization ch...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81648/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T05:03:31.392546Z"} https://vulnerability.circl.lu/sighting/d6851b24-6fe0-4e16-900c-c71c6bdd0fb7/export Mon, 14 Sep 2026 05:03:31 +0000 https://vulnerability.circl.lu/sighting/f5c479f1-9cda-4a5f-ba40-69f296cf0857/export {"uuid": "f5c479f1-9cda-4a5f-ba40-69f296cf0857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvgm6wkgm52n", "content": "\ud83d\udea8 CVE-2026-81648 \u2014 CVSS 10 CRITICAL\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-81648\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T22:07:08.507580Z"} {"uuid": "f5c479f1-9cda-4a5f-ba40-69f296cf0857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvgm6wkgm52n", "content": "\ud83d\udea8 CVE-2026-81648 \u2014 CVSS 10 CRITICAL\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-81648\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T22:07:08.507580Z"} https://vulnerability.circl.lu/sighting/f5c479f1-9cda-4a5f-ba40-69f296cf0857/export Sun, 13 Sep 2026 22:07:08 +0000 https://vulnerability.circl.lu/sighting/a1b5bf8f-af4a-4c9d-8786-08012c26dc05/export {"uuid": "a1b5bf8f-af4a-4c9d-8786-08012c26dc05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvgih3sbms2b", "content": "CVE-2026-81648 - cryptopayment gateway\nVersions 1.2.1 through 1.2.2 of the CryptoPayment Gateway WordPress plugin do not verify who is making certain AJAX requests. This allows anyone on the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptopaymentgateway #unknown #CVE #infosec", "creation_timestamp": "2026-09-13T21:00:06.517026Z"} {"uuid": "a1b5bf8f-af4a-4c9d-8786-08012c26dc05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvgih3sbms2b", "content": "CVE-2026-81648 - cryptopayment gateway\nVersions 1.2.1 through 1.2.2 of the CryptoPayment Gateway WordPress plugin do not verify who is making certain AJAX requests. This allows anyone on the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptopaymentgateway #unknown #CVE #infosec", "creation_timestamp": "2026-09-13T21:00:06.517026Z"} https://vulnerability.circl.lu/sighting/a1b5bf8f-af4a-4c9d-8786-08012c26dc05/export Sun, 13 Sep 2026 21:00:06 +0000