{"vulnerability": "CVE-2026-8237", "sightings": [{"uuid": "fb3c1ef8-9063-43d4-bd8b-ad7c2ed3f072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8237", "type": "seen", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "content": "", "creation_timestamp": "2026-08-01T16:00:04.379987Z"}, {"uuid": "ba79159f-bc2b-4967-98d5-30431d5010f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8237", "type": "published-proof-of-concept", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "content": "", "creation_timestamp": "2026-08-02T00:00:41.476866Z"}, {"uuid": "6dd5bbd5-7b01-4f04-a73a-f6986b21cebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8237", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-8237.yaml", "content": "", "creation_timestamp": "2026-08-19T15:00:16.740478Z"}, {"uuid": "814677f1-4fad-44d3-b2e8-d65fec6fa8ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82370", "type": "seen", "source": "https://gist.github.com/ichintu/2e9991c851b75a7aa99639fafeaa0cae", "content": "This threat intelligence briefing highlights four critical security developments from late September 2026:\n\n\u2022 **Brocade SANnav (CVE-2026-82370, 8.6):** An unauthenticated remote command injection flaw in versions <3.0.1a allows attackers to execute administrative CLI and container commands, risking Fibre Channel fabric manipulation.\n\u2022 **Check Point Zero-Days (CVE-2026-85102 & CVE-2026-93616, both 9.8):** Two actively exploited, pre-authentication vulnerabilities compromise the Spark firewall and management service. With functional exploits reverse-engineered in ~3 days, immediate patching, management console isolation, and proactive threat hunting are strongly advised.\n\u2022 **EthPress WordPress Plugin (CVE-2026-19125, 8.1):** A missing `return` statement in versions \u22642.3.5 causes an unauthenticated authentication bypass, allowing attackers to impersonate any wallet-linked user and achieve full site takeover.\n\u2022 **Loopjacking:** A newly documented attack vector (arXiv) that hijacks human-in-the-loop approval mechanisms, introducing novel risks to manual security workflows.\n\n**Overall:** The current landscape emphasizes urgent remediation of high-severity, unauthenticated flaws in critical infrastructure and web plugins, alongside emerging threats targeting procedural and human-centric security controls.", "creation_timestamp": "2026-09-24T04:01:56.879795Z"}, {"uuid": "48be52d7-f56b-4817-bab3-9636c41c5a5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82378", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwkvjqvig626", "content": "CVE-2026-82378 - apache roller\nIf your Roller site uses a site\u2011wide OAuth connection, an attacker who discovers a pending request token can attach that token to any user account, even an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheroller #apachefoundation #CVE #infosec", "creation_timestamp": "2026-09-28T08:30:04.865623Z"}, {"uuid": "a31dd995-644b-4274-9b78-09ab728e1cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82377", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwkvk2egqw26", "content": "CVE-2026-82377 - apache roller\nApache Roller version 6.1.5 lets anyone who can log in use the old XML\u2011RPC interface to view, change or delete posts that belong to other blogs, because it does\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheroller #apachefoundation #CVE #infosec", "creation_timestamp": "2026-09-28T08:30:14.992669Z"}, {"uuid": "e7682075-1a2b-4efc-b83f-13cdcf89cb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82378", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2pcmjgabilevb", "content": "CVE-2026-82378 - Apache Roller: OAuth authorization endpoint trusts request-supplied identity\nCVE ID : CVE-2026-82378\n \n Published : Sept. 28, 2026, 7:45 a.m. | 44\u00a0minutes ago\n \n Description : Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6....", "creation_timestamp": "2026-09-28T08:52:20.162261Z"}, {"uuid": "4ff44df2-e949-4b8d-b2f6-c2130e77e3c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82377", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/esx645bycj73o", "content": "CVE-2026-82377 - Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers\nCVE ID : CVE-2026-82377\n \n Published : Sept. 28, 2026, 7:45 a.m. | 44\u00a0minutes ago\n \n Description : Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to r...", "creation_timestamp": "2026-09-28T08:58:20.409158Z"}, {"uuid": "6627f97a-9a19-41ea-98f6-c1cf40f493a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82377", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwl2xlhqek2i", "content": "\ud83d\udea8 CVE-2026-82377 \u2014 CVSS 9.9 CRITICAL\n\nMissing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-82377\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-28T10:07:17.825463Z"}]}