{"vulnerability": "cve-2026-1835", "sightings": [{"uuid": "69b69d4b-f61c-4a59-84da-948251bb9a13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18358", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrzgpafqsv2j", "content": "CVE-2026-18358 - DoS in Gnome-Remote-Desktop on RHEL. Unauthenticated RDP flood exhausts resources, blocking legit sessions. CVSS 7.5. No patch yet; restrict RDP access. #CVE #infosec #Linux\n\nhttps://www.valtersit.com/cve/CVE-2026-18358/", "creation_timestamp": "2026-08-01T12:08:40.927236Z"}, {"uuid": "c77e18a7-e77d-4b69-9801-c63413e7725e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18358", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrx4j26lsv2f", "content": "\ud83d\udfe0 CVE-2026-18358 - High (7.5)\n\nA flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18358/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-31T14:01:09.642200Z"}, {"uuid": "779a0fbd-c759-4e5f-a291-3817bdb34d48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18352", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtsjy6e2z", "content": "\ud83d\udfe0 CVE-2026-18352 - High (7.5)\n\nThe User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18352/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T01:00:45.705438Z"}, {"uuid": "a05bb7c3-7c4b-40c7-a17b-a0ecde3eaa48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18352", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3jrvygge2p", "content": "CVE-2026-18352: \u05e4\u05d2\u05d9\u05e2\u05ea Directory Traversal \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1-User Access Manager \u05d1\u05d5\u05d5\u05e8\u05d3\u05e4\u05e8\u05e1 - \u05de\u05d4 \u05e2\u05d5\u05e9\u05d9\u05dd?\n\n\n\nhttps://khesef.xyz/posts/1100059D-6788-4017-99F0-26558BD6AA4A", "creation_timestamp": "2026-08-02T08:09:11.221698Z"}, {"uuid": "5bfffd0e-bf7f-4cd7-b564-acabec891afc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18352", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3lbkaffp25", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-18352 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 User Access Manager: \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0441\u0430\u0439\u0442\u0435 WordPress\n\n\n\nhttps://kripta.biz/posts/D4BFCCE7-8BE7-4441-B4CB-3C80A2828DB5", "creation_timestamp": "2026-08-02T08:35:49.409728Z"}, {"uuid": "4e667b72-d219-4b43-a376-91c064c76583", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18352", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3lbk5vc62c", "content": "CVE-2026-18352: \u05e4\u05e8\u05e6\u05ea \u05d0\u05d1\u05d8\u05d7\u05d4 \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1-User Access Manager \u05e9\u05dc \u05d5\u05d5\u05e8\u05d3\u05e4\u05e8\u05e1 - \u05db\u05d9\u05e6\u05d3 \u05dc\u05d4\u05d2\u05df \u05e2\u05dc \u05d4\u05d0\u05ea\u05e8 \u05e9\u05dc\u05da\n\n\n\nhttps://khesef.xyz/posts/6F3D9A05-49F8-4A2D-B0D7-F58A8998B557", "creation_timestamp": "2026-08-02T08:35:49.901201Z"}, {"uuid": "ec7cdeab-e01d-458c-bc50-ebbbedad13b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18359", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msgpzom4fi2z", "content": "\ud83d\udfe0 CVE-2026-18359 - High (8.5)\n\nServer-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium thro...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18359/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-06T19:00:12.109932Z"}, {"uuid": "8aa1cad7-8e9f-4351-bcd3-62339004b4bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18355", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117230305202564673", "content": "We have just added an important vulnerability affecting Red Hat Directory Server and Enterprise Linux (CVE-2026-18355) https://vuldb.com/vuln/399605", "creation_timestamp": "2026-09-07T14:48:21.009089Z"}, {"uuid": "54191461-206a-4a9b-bdb5-a4a484ee4c79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18355", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117233891642545152", "content": "CRITICAL vulnerabilities in Red Hat 389-ds-base (>=9.4 <9.4.5) incl. heap overflow (CVE-2026-18355), privilege escalation, and ACI bypass. Patch ASAP via RHSA-2026:64781. Details: https://radar.offseq.com/threat/red-hat-security-advisory-389-ds-base-security-bug-fix-and-enhancement-update-c933f76430be2c96 #OffSeq #RedHat #LDAP #Vuln #SysAdmin", "creation_timestamp": "2026-09-08T06:00:24.299142Z"}, {"uuid": "d4eb7cf9-5909-401c-94cc-46e49c2c8d18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18355", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117234245668128550", "content": "Red Hat 389-ds-base faces CRITICAL flaws (CVE-2026-18355 & more): heap buffer overflow, pre-auth NULL dereference, privilege escalation, and ACI bypass in RHEL 9.2 (<9.2.4). Patch ASAP. https://radar.offseq.com/threat/red-hat-security-advisory-389-ds-base-security-bug-fix-and-enhancement-update-0c583247a0fb050c #OffSeq #RedHat #CVE #LDAP", "creation_timestamp": "2026-09-08T07:30:26.320979Z"}, {"uuid": "bfb687c8-f135-4e6a-85b3-497187843505", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18351", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117244508969713610", "content": "CVE-2026-18351 (CRITICAL): addonsorg Drag and Drop File Upload for Elementor Forms <=1.6.0 lets unauthenticated attackers upload arbitrary files \u2014 enabling RCE. Restrict or disable plugin use until remediation. https://radar.offseq.com/threat/cve-2026-18351-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addonsorg-drag-and-drop-file-158dc74bccbdf605 #OffSeq #WordPress #Vuln #RCE", "creation_timestamp": "2026-09-10T03:00:32.011643Z"}, {"uuid": "52e9c55f-4e02-461c-95cf-2dff82a0b74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18351", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mv52pwtwai25", "content": "Drag and Drop File Upload for Elementor Forms <=1.6.0 hit by CRITICAL CVE-2026-18351. Unauthenticated attackers can upload files & achieve RCE. Restrict plugin until patch confirmed. https://radar.offseq.com/threat/cve-2026-18351-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addonsor...", "creation_timestamp": "2026-09-10T03:00:33.579856Z"}, {"uuid": "a29a0bdb-9e0a-492e-acce-f2375696cd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv54wlmxuv2f", "content": "CVE-2026-18351 - drag and drop file upload for elementor forms\nThe Drag and Drop File Upload feature in the Elementor Forms plugin for WordPress, up through version 1.6.0, does not correctly verify the type of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#addonsorg #CVE #infosec", "creation_timestamp": "2026-09-10T03:40:03.849005Z"}, {"uuid": "fdf10ff7-dd82-46f8-a008-92fa88c3e86d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d", "content": "This threat intelligence brief covers two unauthenticated vulnerabilities published in September 2026:\n\n\u2022 **CVE-2026-18351 (CRITICAL, 9.8):** Affects the WordPress plugin *Drag and Drop File Upload for Elementor Forms* (\u22641.6.0). Flawed MIME validation allows unauthenticated arbitrary file uploads, enabling remote code execution (RCE).\n\n\u2022 **CVE-2026-59160 (HIGH, 8.8):** Affects the Node.js package *@yeger/turbo-graph* v2.8.8. Combines insecure network binding (`0.0.0.0`) with an unauthenticated API endpoint, allowing adjacent-network attackers to execute arbitrary tasks via CLI argument injection, potentially resulting in RCE and infrastructure compromise.\n\nBoth vulnerabilities require no authentication, though CVE-2026-59160 is limited to attackers on the same local network segment.", "creation_timestamp": "2026-09-10T04:01:24.927169Z"}, {"uuid": "23d74c6d-03c4-4c16-bcf8-1ca5e7c90d91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv56hq45s22f", "content": "\ud83d\udea8 CVE-2026-18351 \u2014 CVSS 9.8 CRITICAL\n\nThe Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Uplo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-18351\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T04:07:32.712923Z"}, {"uuid": "81bc6cd2-1077-4c81-b5ba-b417d3cab937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101987", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:30:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDrag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.\ud83d\udd25\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T08:00:08.368945Z"}, {"uuid": "fe45ed95-f018-44ff-917c-ee0d14f1484d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-18351 \u2014 Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T08:00:08.420473Z"}, {"uuid": "0fb9633b-a8d4-411e-94eb-7206e96c8377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101987", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:30:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDrag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.\ud83d\udd25\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:47.888348Z"}, {"uuid": "ab4c4c18-2816-4535-9ecb-898134ff93db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-18351 \u2014 Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:47.936760Z"}, {"uuid": "bf3358e5-be20-4469-8a3e-f38d94c60286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "Telegram/DdYTYSDe8lvqixn7SsuHC2cVYP8OwvHWnrdarY89A6zETG4", "content": "", "creation_timestamp": "2026-09-14T03:00:15.247591Z"}, {"uuid": "1ca16e4f-43b9-4d6a-aaea-db6767a6b4e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "Telegram/DdYTYSDe8lvqixn7SsuHC2cVYP8OwvHWnrdarY89A6zETG4", "content": "", "creation_timestamp": "2026-09-15T00:00:21.183317Z"}]}