{"vulnerability": "CVE-2026-4984", "sightings": [{"uuid": "6b321be5-5482-4faf-bfa3-70cffdbea516", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4984", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116302518672297608", "content": "", "creation_timestamp": "2026-03-27T18:20:00.642902Z"}, {"uuid": "37310cd9-d996-463a-b9d0-7a9627723f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4984", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi37whkhvq2j", "content": "", "creation_timestamp": "2026-03-27T23:00:50.927832Z"}, {"uuid": "ceb79078-8b49-4a18-ae77-6eb8d3ce827c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4984", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi37wrf75q2r", "content": "", "creation_timestamp": "2026-03-27T23:01:00.909535Z"}, {"uuid": "76cb4f1c-df30-4369-a46d-8e9029030b87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4984", "type": "published-proof-of-concept", "source": "Telegram/pyEIr0Ko2hoCavwas1rlZ1K5Q5ZdrBNaOpK3idLXyAytNFs", "content": "", "creation_timestamp": "2026-03-27T17:22:52.000000Z"}, {"uuid": "aa07d1b7-6ad1-4f02-9248-de93a9240575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmui26nmb2m", "content": "\ud83d\udd34 CVE-2026-49849 - Critical (9.1)\n\nxShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in x...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49849/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T23:00:58.987892Z"}, {"uuid": "e186074f-71a0-4575-88db-bcda5785ca04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49847", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnuoqjlq7b2s", "content": "CVE-2026-49847 - FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON\nCVE ID : CVE-2026-49847\n \n Published : June 9, 2026, 4:05 p.m. | 31\u00a0minutes ago\n \n Description : FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from p...", "creation_timestamp": "2026-06-09T17:08:28.674659Z"}, {"uuid": "6a3d7983-fe2c-402f-ab13-8f768af5c565", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49848", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnup22pzwp2x", "content": "CVE-2026-49848 - FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`\nCVE ID : CVE-2026-49848\n \n Published : June 9, 2026, 4:05 p.m. | 30\u00a0minutes ago\n \n Description : FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from pro...", "creation_timestamp": "2026-06-09T17:13:48.916395Z"}, {"uuid": "229909e0-c9ff-4039-878b-a7daf89731f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49843", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnupugl5ma2v", "content": "CVE-2026-49843 - FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`\nCVE ID : CVE-2026-49843\n \n Published : June 9, 2026, 4:04 p.m. | 31\u00a0minutes ago\n \n Description : FreeSWITCH is a Software Defined Telecom Stack enabling the digital tra...", "creation_timestamp": "2026-06-09T17:28:42.015874Z"}, {"uuid": "deab1782-698b-4bd0-85cf-8e274d165d10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49840", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnx5hdfrqi2f", "content": "\ud83d\udccc CVE-2026-49840 - FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that... https://www.cyberhub.blog/cves/CVE-2026-49840", "creation_timestamp": "2026-06-10T16:37:05.930862Z"}, {"uuid": "d5388abf-a9f8-4b78-9897-e7c51110c690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/br5ilubnsqhf7", "content": "CVE-2026-49849 - xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution\nCVE ID : CVE-2026-49849\n \n Published : Aug. 21, 2026, 10:16 p.m. | 17\u00a0minutes ago\n \n Description : xShop is an open-source shop developed in Laravel. An ...", "creation_timestamp": "2026-08-21T23:58:42.774250Z"}, {"uuid": "c1dfb0ee-0d7c-46bf-a16d-31bbf5ed3365", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtoflysfli25", "content": "CVE-2026-49849\nIn xShop version 3.0.3, an admin user can upload any type of file, including executable scripts, through the file attachment feature. A malicious file could be used to take control of the server and compromise\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T13:40:04.531140Z"}, {"uuid": "5b055040-752e-44c3-9c6b-7de4dc7ae112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49849", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtmxsrnra62x", "content": "4xmen xShop <3.0.4 has a CRITICAL vuln (CVE-2026-49849): admins can upload malicious files, enabling remote code execution. Upgrade to 3.0.4+ now. https://radar.offseq.com/threat/cve-2026-49849-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-4xmen-xshop-bbb8f71dbe4a15a6 #OffSeq #CVE202...", "creation_timestamp": "2026-08-22T00:00:40.173539Z"}, {"uuid": "f09d0e05-97f7-40ff-a20e-838e13802761", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49849", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117136217697075693", "content": "CVE-2026-49849 (CRITICAL): 4xmen xShop <3.0.4 lets authenticated admins upload dangerous files, leading to remote code execution \ud83d\udee1\ufe0f. Patch to 3.0.4 now. https://radar.offseq.com/threat/cve-2026-49849-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-4xmen-xshop-bbb8f71dbe4a15a6 #OffSeq #CVE202649849 #remotecodeexecution #infosec", "creation_timestamp": "2026-08-22T00:00:38.154000Z"}, {"uuid": "f6245e5e-f8a7-47a3-9d82-9ae428e4adec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtmy7gnomw2b", "content": "\ud83d\udea8 CVE-2026-49849 \u2014 CVSS 9.1 CRITICAL\n\nxShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop versi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-49849\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-22T00:07:44.486063Z"}, {"uuid": "d60395fd-e10b-4513-9985-79e279debd8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmyviypir23", "content": "CVE-2026-49849 - xshop\nThe online store software xShop version 3.0.3 lets a logged\u2011in administrator upload files without checking their type. An attacker could place a specially crafted script and run it on the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#xshop #4xmen #CVE #infosec", "creation_timestamp": "2026-08-22T00:20:04.865043Z"}, {"uuid": "aa06a60c-d79a-4c0a-8616-45e0129d7655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49844", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mqdgqliloj24", "content": "CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()", "creation_timestamp": "2026-07-11T00:45:40.058034Z"}, {"uuid": "b85998d7-5abc-4d21-8fbf-e9d5e9f9a31e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49844", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqifb46f5g27", "content": "A new Apache Log4j flaw, CVE-2026-49844, makes log4j-api emit invalid JSON from non-finite numbers. Patch to 2.25.5 or 2.26.1 now.\n\n#Log4j #CVE202649844 #ApacheLog4j #Vulnerability #CyberSecurity", "creation_timestamp": "2026-07-13T00:02:26.044222Z"}, {"uuid": "58eefc5b-8ebd-4031-8d64-5256577aacf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49845", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwozpdfy323", "content": "CVE-2026-49845 - apache hive\nIf you run Apache Hive version earlier than 4.2.1, a user who can access Hive\u2019s metadata services could trick the system with specially crafted partition names and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachehive #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-25T20:50:07.945916Z"}, {"uuid": "0e3a7dbc-711e-4361-b1ea-56dbbf5b32ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49845", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mu4ddztdz72x", "content": "\ud83d\udccc CVE-2026-49845 - SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with acce... https://www.cyberhub.blog/cves/CVE-2026-49845", "creation_timestamp": "2026-08-28T02:37:06.594469Z"}]}