{"vulnerability": "CVE-2026-8206", "sightings": [{"uuid": "ab0cddee-4248-4828-93ce-311c241b6ab3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/GithubRedTeam/86883", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-8206-Poc-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a O99099O\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-01 19:46:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-01T20:00:04.000000Z"}, {"uuid": "e413c6cd-cf20-45e5-9248-737f14f64e14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8206", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mnbr4mqu6h2j", "content": "Kirki Page Builder plugin (v6.0.0 \u2013 6.0.6) hit by CRITICAL flaw: Unauth users can reset any account password & take over sites. No fix yet \u2014 disable plugin or monitor resets! https://radar.offseq.com/threat/cve-2026-8206-cwe-269-improper-privilege-managemen-ac423059 #OffSeq #WordPress #Security", "creation_timestamp": "2026-06-02T04:30:27.982939Z"}, {"uuid": "775e9808-64e3-4f15-92f1-56f72c95a555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8206", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116678631405525902", "content": "\ud83d\udea9 CRITICAL: CVE-2026-8206 in Kirki Page Builder (v6.0.0 \u2013 6.0.6) lets unauth attackers reset any user password & hijack WordPress accounts. No patch yet \u2014 admins should disable or monitor plugin. Details: https://radar.offseq.com/threat/cve-2026-8206-cwe-269-improper-privilege-managemen-ac423059 #OffSeq #WordPress #Infosec", "creation_timestamp": "2026-06-02T04:30:38.597309Z"}, {"uuid": "0d93e295-c6d9-4441-804f-661d40e99067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbsamjawx2w", "content": "CVE-2026-8206 - Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'\nCVE ID : CVE-2026-8206\n \n Published : June 2, 2026, 4:17 a.m. | 15\u00a0minutes ago\n \n Description : The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin fo...", "creation_timestamp": "2026-06-02T04:50:34.806390Z"}, {"uuid": "0024db7b-3d08-437d-b38f-2fab9b1161c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnbsrflkei27", "content": "\ud83d\udd34 CVE-2026-8206 - Critical (9.8)\n\nThe Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnera...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-8206/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-02T04:59:59.237693Z"}, {"uuid": "e17d6926-540c-4d01-a7b3-863346475063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mnbtflchmo2q", "content": "CVE-2026-8206 - Critical Privilege Escalation in Kirki WordPress plugin (v6.0.0-6.0.6). Unauthenticated account takeover via password reset email manipulation. CVSS 9.8. No patch available\u2014disable immediately. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-8206/", "creation_timestamp": "2026-06-02T05:11:15.222203Z"}, {"uuid": "d4b3d6bb-93e4-4406-9507-8f45e41cbf0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/GithubRedTeam/86963", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-8206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Jenderal92\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-02 10:58:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMass exploitation tool for CVE-2026-8206 \u2013 Unauthenticated Privilege Escalation via 'handle_forgot_password' in Kirki WordPress plugin (\u22646.0.6).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-02T11:00:04.000000Z"}, {"uuid": "afea9632-2442-4859-9026-dfe3f065d59c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/hGWk8MIih0D3DxUwNWRe3y8KubP65D3PuLH-MA53N78330U", "content": "", "creation_timestamp": "2026-06-02T15:00:07.000000Z"}, {"uuid": "e584ed5a-26ab-4c9a-977c-3d96455345df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/0RWgeXgDd8FuhlsxGHTZmZulVERW9VznQ2KUM8It_wSr4u8", "content": "", "creation_timestamp": "2026-06-02T15:00:17.000000Z"}, {"uuid": "41692f00-0f23-44f0-8466-155fca64242d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/WmCsGmCxw3llm8l2PpPL4_TbSd7NmUffJbXR2OZgq87qhTE", "content": "", "creation_timestamp": "2026-06-01T23:00:14.000000Z"}, {"uuid": "055abc24-cf51-4178-8072-8c10d65be566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mndmizugrm2q", "content": "Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators.", "creation_timestamp": "2026-06-02T22:13:14.334318Z"}, {"uuid": "9f9a2ca6-ec81-47ee-91e1-18dca7f4bcee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mndmxoxsqz2j", "content": "\u91cd\u5927\u306aKirki\u8106\u5f31\u6027\u3001WordPress\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306b\u60aa\u7528\n\nWordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cKirki\u300d\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u306a\u6a29\u9650\u6607\u683c\u8106\u5f31\u6027\uff08CVE-2026-8206\uff09\u3092\u60aa\u7528\u3057\u3001\u7ba1\u7406\u8005\u3092\u542b\u3080\u4efb\u610f\u306e\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4e57\u3063\u53d6\u308b\u653b\u6483\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u653b\u6483\u306f\u3001WordPress\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696dDefiant\u306b\u3088\u3063\u3066\u691c\u51fa\u3055\u308c\u307e\u3057\u305f\u3002\u540c\u793e\u306eWordfence\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306f\u3001\u904e\u53bb...", "creation_timestamp": "2026-06-02T22:21:26.277392Z"}, {"uuid": "d2e9493b-1c37-4b2f-8933-8d9bbd1b7518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mndnnwahh3p2", "content": "Critical Kirki flaw exploited to hijack WordPress admin accounts BleepingComputer Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPr...\n\n#Security #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-02T22:34:00.276396Z"}, {"uuid": "1b018d01-6182-4d66-ac87-2fa88e391509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mndocmfy2s24", "content": "CRITICAL WORDPRESS TAKEOVER ALERT: CVE-2026-8206 IN KIRKI PLUGIN LETS HACKERS HIJACK ADMIN ACCOUNTS IN MINUTES +\u00a0Video\n\nIntroduction: A Silent WordPress Disaster Unfolding in Real Time A dangerous security crisis is currently shaking the WordPress ecosystem, where millions of websites rely on\u2026", "creation_timestamp": "2026-06-02T22:45:26.898754Z"}, {"uuid": "482f9349-8606-40d7-b632-358c681c3565", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mndp2iqmgr2w", "content": "Kirki\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027(CVE-2026-8206)\u304cWordPress\u3067\u60aa\u7528\u3055\u308c\u3001\u7ba1\u7406\u8005\u3092\u542b\u3080\u5168\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u4e57\u3063\u53d6\u3089\u308c\u308b\u3002", "creation_timestamp": "2026-06-02T22:58:47.607774Z"}, {"uuid": "75c9f952-2cde-4ae7-8e01-bb1ea725a093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mndpy6svam2a", "content": "Critical Kirki flaw CVE-2026-8206 lets unauthenticated attackers hijack WordPress admin accounts by redirecting password resets. Wordfence blocked 222+ attempts in 24 hours. #WordPress #Kirki #CVE20268206", "creation_timestamp": "2026-06-02T23:15:24.043334Z"}, {"uuid": "c8a4e422-5ffa-4861-8cbf-ffe0538cd11b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/BleepingComputer/24804", "content": "\u200aCritical Kirki flaw exploited to hijack WordPress admin accounts\n\nHackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. [...]\n\nhttps://www.bleepingcomputer.com/news/security/critical-kirki-flaw-exploited-to-hijack-wordpress-admin-accounts/", "creation_timestamp": "2026-06-02T22:16:28.000000Z"}, {"uuid": "9f639f29-3a71-49cf-9bcf-a01ffa0fdf30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mndzr6arsv2v", "content": "CYBERSTORM UNFOLDING: CRITICAL WORDPRESS KIRKI FLAW AND IRAN\u2019S EXPANDING HANDALA THREAT NETWORK SIGNAL A MULTI-LAYER GLOBAL ESCALATION +\u00a0Video\n\nBREAKING CYBERSECURITY ALERT OVERVIEW A new critical vulnerability tracked as CVE-2026-8206 has emerged in the WordPress ecosystem, affecting the widely\u2026", "creation_timestamp": "2026-06-03T02:10:26.882578Z"}, {"uuid": "a3ad4107-a7c9-488d-bf13-c8bd0c91c468", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8206", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mne5kpxqtj2l", "content": "\ud83d\udcf0 Manipulasi REST API Kirki: Peretas Eksploitasi Celah Kritis untuk Ambil Alih Akun Admin WordPress\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/06/03/celah-kritis-plugin-kirki-dieksploitasi-bajak-admin-wordpress/\n\n#akunAdminDibajak #backdoor #choigyengmin #cve-2026-8206 #defian", "creation_timestamp": "2026-06-03T03:18:24.736797Z"}, {"uuid": "659829dc-2fc8-4eb2-9f70-727a8bd52ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8206", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mneasbpyvu26", "content": "Critical Kirki WordPress Plugin Flaw Actively Exploited to Hijack Admin Accounts\n\nhttps://blindthoughts.com/kirki-wordpress-plugin-cve-2026-8206-exploited\n\n#wordpress #vulnerability #cve #privilegeescalation #activeexploitation", "creation_timestamp": "2026-06-03T04:16:19.470992Z"}, {"uuid": "5595ef30-641c-458a-bc9f-bcf2f980d40a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mneypa4rtl2h", "content": "CRITICAL WORDPRESS TAKEOVER ALERT: CVE-2026-8206 IN KIRKI BUILDER TURNS WEBSITES INTO OPEN DOORS FOR FULL ADMIN HIJACKING +\u00a0Video\n\nIntroduction: A Silent Security Failure Turning Half a Million Websites Into Easy Targets A newly discovered and actively exploited vulnerability in the widely used\u2026", "creation_timestamp": "2026-06-03T11:24:07.672155Z"}, {"uuid": "2666623c-631e-4b91-b530-159a7fc2a741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mnf5no6ifee2", "content": "CVE-2026-8206 Kirki Plugin Exploited; 500,000 WordPress Sites at Risk CVE-2026-8206 in the Kirki WordPress plugin is under active attack, with Wordfence detecting 222 exploitation attempts targetin...\n\n#Cybersecurity #Application #Security #CVE [\u2026] \n\n[Original post on dailysecurityreview.com]", "creation_timestamp": "2026-06-03T12:53:22.205976Z"}, {"uuid": "35098cc4-227b-4e29-a559-22bf75263733", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/true_secator/8277", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. Acer \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 0-day \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u0435\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0441 mesh-\u0441\u0435\u0442\u044c\u044e Wave 7, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0432\u0435\u0440\u0441\u0438\u0438 T7c_GBL_1.01.000055 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439.\n\n\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0413\u0435\u0440\u0433\u043e \u041f\u0430\u043f. \u041f\u0435\u0440\u0432\u0430\u044f CVE-2026-49200 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0432\u0430\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-49201 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043a\u043b\u044e\u0447\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0443 \u0447\u0435\u0440\u0435\u0437 \u0431\u044d\u043a\u0434\u043e\u0440.\n\n2. \u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (CVE-2026-8206) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Kirki - Freeform Page Builder, Website Builder & Customizer \u0434\u043b\u044f WordPress \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b Defiant, \u0447\u0435\u0439 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d Wordfence \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b \u0431\u043e\u043b\u0435\u0435 222 \u043f\u043e\u043f\u044b\u0442\u043e\u043a\u00a0\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 24 \u0447\u0430\u0441\u0430. CVE-2026-8206 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 REST API \u0434\u043b\u044f \u0441\u0431\u0440\u043e\u0441\u0430 \u043f\u0430\u0440\u043e\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e 'handle_forgot_password()'.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u043d\u0430 500 000 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432, \u043e\u0431\u044a\u0435\u043c\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f. \n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Wordfence, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0432 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u043c \u043a\u0440\u0443\u043f\u043d\u043e\u043c \u0440\u0435\u043b\u0438\u0437\u0435, \u0432\u0435\u0440\u0441\u0438\u0438 6.0.0, \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0434\u043e 6.0.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a\u00a0\u0441 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u043e\u0447\u0442\u0438 40% \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430.\n\n3. \u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043c\u043c\u0430\u0440 \u0410\u0441\u043a\u0430\u0440 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 (GitHub), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438 \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b GitHub \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440 Visual Studio Code.\n\n\u041f\u0440\u0438\u0447\u0435\u043c, \u043a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u0438\u044f.\n\n4. BishopFox \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438\u00a0\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f CVE-2026-22557, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Ubiquiti UniFi.\n\n5. HP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0438\u0445 VoIP-\u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u0441\u0435\u0440\u0438\u0438 VVX, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-0826, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430\u0445 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Rapid7, \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0433\u0434\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f.\n\n6. Positive Technologies \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043c\u0430\u0439\u0441\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0412 \u0442\u0440\u0435\u043d\u0434\u0435 VM, \u0443\u043a\u0430\u0437\u0430\u0432 \u0433\u0440\u043e\u043c\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux (CVE-2026-31431), ActiveMQ (CVE-2026-34197), SharePoint (CVE-2026-32201) \u0438 Acrobat Reader (CVE-2026-34621).\n\n7. CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Linux CVE-2022-0492 (CVSS 7,8) \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0432\u044b\u0445\u043e\u0434\u0443 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041e\u043d\u0430 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n8. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0430 HTTP/2 Bomb \u0432\u044b\u0432\u043e\u0434\u0438\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Calif \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442, \u0447\u0442\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b DoS-\u0430\u0442\u0430\u043a \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0432 \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\nHTTP/2 Bomb \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Codex \u043e\u0442 OpenAI \u0438 \u0441\u043e\u0447\u0435\u0442\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u0435 \u0431\u043e\u043c\u0431\u0443 \u0441\u0436\u0430\u0442\u0438\u044f, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0441\u0445\u0435\u043c\u0443 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP/2 (HPACK), \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432 \u0441\u0442\u0438\u043b\u0435 Slowloris, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 880 000 \u0441\u0430\u0439\u0442\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 HTTP/2 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 NGINX, Apache HTTPD, Microsoft IIS, Envoy \u0438\u043b\u0438 Cloudflare Pingora.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043f\u0440\u0438 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f 100 \u041c\u0431\u0438\u0442/\u0441 \u0438 \u0432 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043b\u044e\u0431\u043e\u0439 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.", "creation_timestamp": "2026-06-03T18:30:06.000000Z"}, {"uuid": "d8295e3a-3848-4af9-a2e8-5cedf368bcab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mnfydurlxt2l", "content": "Critical 98 Kirki Plugin Flaw Exploited in the Wild \u2014 Over 150K WordPress Sites at Risk of Complete Admin Takeover +\u00a0Video\n\nIntroduction: A critical vulnerability designated CVE-2026-8206 with a CVSS score of 9.8 has been discovered in the Kirki \u2013 Freeform Page Builder, Website Builder & Customizer\u2026", "creation_timestamp": "2026-06-03T20:50:26.079215Z"}, {"uuid": "16788b4c-517a-41a6-b04a-5b940230a297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mng4d727q22h", "content": "Critical Kirki flaw exploited to hijack WordPress admin accounts\n\nHackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. [...]\n#hackernews #news", "creation_timestamp": "2026-06-03T22:01:38.344644Z"}, {"uuid": "e4ca24da-bd26-4712-b3da-c45afd3fa6fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://dnsc.ro/citeste/alerta-vulnerabilitate-critica-la-nivelul-plugin-ului-wordpress-kirki", "content": "", "creation_timestamp": "2026-06-04T03:19:04.000000Z"}, {"uuid": "8619856f-8124-4dee-b64c-8c971d10182c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/cwealthsentinel.bsky.social/post/3mnitm35b7o2x", "content": "Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators.", "creation_timestamp": "2026-06-05T00:03:31.248603Z"}, {"uuid": "41c415a1-0bb0-4973-8207-43e7f7eb29b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/RwJKjP0hmLSY4_8--kRvPD8WFGr06KWtQNe3VA43hzgYOlg", "content": "", "creation_timestamp": "2026-06-05T11:00:12.000000Z"}, {"uuid": "48af6220-1bfb-40a1-90fc-1bb82945c088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/eatransform.bsky.social/post/3mno6lo36g42c", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3Kirki\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\u30fb50\u4e07\u30b5\u30a4\u30c8\u304c\u7ba1\u7406\u8005\u4e57\u3063\u53d6\u308a\u306e\u30ea\u30b9\u30af\u3010CVE-2026-8206\u3011", "creation_timestamp": "2026-06-07T03:03:27.425702Z"}, {"uuid": "0d742038-4a23-4282-a38f-361ed774cf51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mnrvn345pz2g", "content": "A critical vulnerability (CVE-2026-8206) in the Kirki WordPress plugin affects over 500,000 websites, with around 150,000 actively vulnerable. The flaw, with a CVSS score of 9.8, allows unauthenticated attackers to escalate privileges via a flawed password reset mechanism.", "creation_timestamp": "2026-06-08T14:33:51.358147Z"}, {"uuid": "1098d651-9c02-479f-aa9d-9d19da7ac6a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mo4ny3b3ob2f", "content": "CVE-2026-8206 kirki (CVSS Score 9.8) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept #kirki", "creation_timestamp": "2026-06-12T21:16:06.729244Z"}, {"uuid": "ee6036fb-1341-4c67-9f66-a00bcef1dc9a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/345b6811-3cdc-4037-ba3a-7ebeb5e8a04a", "content": "", "creation_timestamp": "2026-06-19T12:45:10.873386Z"}, {"uuid": "ede73c0b-a2a6-4f83-aa96-0573390dff90", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/66744c07-8d93-4754-917a-e13e9c33ca75", "content": "", "creation_timestamp": "2026-06-23T14:03:02.454391Z"}, {"uuid": "31d14d1b-7ca7-433b-9b70-866dfd79fc00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/LZ9ED4U6EpHlAR8ILwkyN3vub00OYKn1E-RvQUQ-ZsejQtlX", "content": "", "creation_timestamp": "2026-08-30T12:00:05.324013Z"}, {"uuid": "b6306def-5f9d-4fa3-b674-238847c50876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/ggudchhw-cKlYRdDxQ9gbkTOs8jRDcDau10NPckcI1JYfQyT", "content": "", "creation_timestamp": "2026-08-30T12:00:05.579913Z"}, {"uuid": "fc9a429f-7689-46f1-b0c7-625005c460c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/zq8LXtmJ4ADO5sAhVV7AVvyQIqvaWYaoup_EYkZWQtaoTXw", "content": "", "creation_timestamp": "2026-07-16T19:00:17.165720Z"}, {"uuid": "acfdbd6b-d552-4f51-8f34-f3f8d427d2e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/MCIVjT2wGlOhNzGxxI4_zyvBHRQPD_Tsyc6A30C1dkLHGvM", "content": "", "creation_timestamp": "2026-07-16T19:00:17.257717Z"}, {"uuid": "9edf649a-08c7-4c52-8c1a-4e546d9a218c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/zq8LXtmJ4ADO5sAhVV7AVvyQIqvaWYaoup_EYkZWQtaoTXw", "content": "", "creation_timestamp": "2026-07-17T00:00:32.609875Z"}, {"uuid": "f8348512-1fcb-45e6-a741-06e0cd01a0d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/MCIVjT2wGlOhNzGxxI4_zyvBHRQPD_Tsyc6A30C1dkLHGvM", "content": "", "creation_timestamp": "2026-07-17T00:00:32.690781Z"}, {"uuid": "e6eb2003-6d95-4eac-bed6-0d25162dd7a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/zq8LXtmJ4ADO5sAhVV7AVvyQIqvaWYaoup_EYkZWQtaoTXw", "content": "", "creation_timestamp": "2026-07-18T00:00:33.207305Z"}, {"uuid": "46655e2e-7024-4607-a30c-35f9c8fecba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/MCIVjT2wGlOhNzGxxI4_zyvBHRQPD_Tsyc6A30C1dkLHGvM", "content": "", "creation_timestamp": "2026-07-18T00:00:33.410427Z"}, {"uuid": "86f21b32-095e-498a-82b7-ce75eef8965d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/436", "content": "CVE-2026-8206\n\nThe Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.", "creation_timestamp": "2026-08-28T00:00:33.663220Z"}, {"uuid": "783cc003-d558-4428-ad1c-9c51aeffe343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/cve0day/436", "content": "CVE-2026-8206\n\nThe Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.", "creation_timestamp": "2026-08-27T15:00:06.822911Z"}, {"uuid": "d4bb154f-3ec7-43d6-9d81-f6118e5e2ae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/GithubRedTeam/95467", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-8206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Dungsocool\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PowerShell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 04:48:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-8206: Kirki Customizer Framework - Unauthenticated Account Takeover (CVSS 9.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T06:00:04.031628Z"}, {"uuid": "11ec1ccb-2f24-4019-b118-629adf47474d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/TTDc5m9rjxOF-FLNkY4srXBXmccnJEZ8Ua1WlC6sUt3lKgo", "content": "", "creation_timestamp": "2026-07-28T14:00:05.004512Z"}, {"uuid": "baee9161-c07d-4647-80c0-2cce5185ea76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "Telegram/sy-gY02N2vY61unP8KTQmhG6Lrt3BtaNuULshxLDg-pvnZw", "content": "", "creation_timestamp": "2026-07-28T14:00:05.182540Z"}, {"uuid": "4aeefe9a-147a-4f51-9072-70d85a9d6a0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/sy-gY02N2vY61unP8KTQmhG6Lrt3BtaNuULshxLDg-pvnZw", "content": "", "creation_timestamp": "2026-07-29T00:00:34.198224Z"}, {"uuid": "1b8d3a06-2c64-4f83-a3c9-77e618436935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/TTDc5m9rjxOF-FLNkY4srXBXmccnJEZ8Ua1WlC6sUt3lKgo", "content": "", "creation_timestamp": "2026-07-29T00:00:34.304863Z"}, {"uuid": "7a09ded2-adc0-4484-b3b6-527bc44c9521", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95467", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-8206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Dungsocool\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PowerShell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 04:48:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-8206: Kirki Customizer Framework - Unauthenticated Account Takeover (CVSS 9.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T00:00:45.215007Z"}, {"uuid": "e8171009-82ef-4ff5-ab4e-1f6bdcc0658b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/LZ9ED4U6EpHlAR8ILwkyN3vub00OYKn1E-RvQUQ-ZsejQtlX", "content": "", "creation_timestamp": "2026-08-31T00:00:24.124031Z"}, {"uuid": "d20f8fd2-8809-4e0d-9837-0976d115180a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "Telegram/ggudchhw-cKlYRdDxQ9gbkTOs8jRDcDau10NPckcI1JYfQyT", "content": "", "creation_timestamp": "2026-08-31T00:00:24.244479Z"}, {"uuid": "9cc02056-dcdf-4a9f-b3d5-7fac9be30b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82067", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muzmjw5edt2g", "content": "\ud83d\udea8 CVE-2026-82067 \u2014 CVSS 9.2 CRITICAL\n\nImproper handling of case sensitivity in the configuration validation component of MongoDB Server may cause...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-82067\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-08T18:08:40.056004Z"}, {"uuid": "31f89bca-8003-4ed4-87bf-30762c5a7016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82067", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muzsr6ive22r", "content": "CVE-2026-82067 - mongodb server\nWhen MongoDB checks its startup settings, it can ignore the case of the word that turns security on. If the setting is written with different capitalization, the server\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mongodbserver #mongodb #CVE #infosec", "creation_timestamp": "2026-09-08T20:00:05.729969Z"}, {"uuid": "917ea80d-a480-4f16-ae49-5e5faa436c66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82067", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mv4u3wxgsn25", "content": "MongoDB fixed 24 MongoDB Server vulnerabilities, including a critical auth bypass (CVE-2026-82067) and unauthenticated denial of service flaws. Patch now.\n\n#MongoDB #Vulnerability #CVE #DatabaseSecurity #DenialOfService #InfoSec #PatchNow #CyberSecurity #MongoDBServer #AppSec", "creation_timestamp": "2026-09-10T01:02:00.227218Z"}, {"uuid": "076a5bd1-06ea-4569-93df-c12e5ec8057b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82066", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:15.785234Z"}, {"uuid": "5f49372f-fbb0-493e-bdea-739639a0e563", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82060", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:02.234265Z"}, {"uuid": "ca08ac55-a9c6-42d5-a8c7-c0d90d92d9bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82061", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:04.480375Z"}, {"uuid": "31eaa316-9fe6-4f0a-bad4-8017227c2cbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82062", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:06.679546Z"}, {"uuid": "287766ea-51c5-4776-b6ef-2f47a39e6624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82067", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:17.973752Z"}, {"uuid": "20b1436e-42a8-4183-805e-892b06d19c7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82068", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:20.407943Z"}, {"uuid": "7461f1b9-e78e-4376-a840-e53ba36bd4dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82063", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:08.870079Z"}, {"uuid": "e94c5b94-8875-401f-849b-99227013908e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82064", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:11.075151Z"}, {"uuid": "44a2b266-f8aa-4463-8b6b-f53cae3b0c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82065", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:13.592297Z"}, {"uuid": "fdb168a7-8064-49e5-86d3-4a681ba163e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82069", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities_20260910", "content": "", "creation_timestamp": "2026-09-10T05:17:22.598786Z"}, {"uuid": "720fdf41-e720-43d7-9bab-503ad908a12c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42788", "content": "Critical Kirki flaw exploited to hijack WordPress admin accounts\n\nHackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-kirki-flaw-exploited-to-hijack-wordpress-admin-accounts/", "creation_timestamp": "2026-09-18T05:00:04.198886Z"}]}