{"vulnerability": "cve-2026-4986", "sightings": [{"uuid": "3ab4cc8b-ea52-4c2a-a5bb-6dac760d38c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49865", "type": "seen", "source": "Telegram/A5dzmxNNpgXG6imsEkmIRw7rqHzvuUDwkzq5yMgxpcxN0a0", "content": "", "creation_timestamp": "2026-07-30T10:00:02.432474Z"}, {"uuid": "d4cae805-3a3a-46b1-9980-8737c1651805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49865", "type": "seen", "source": "https://t.me/GithubRedTeam/95796", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Kimai-CVE-2026-49865-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cyeezy08\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-30 05:51:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) \u2014 Kimai time-tracking default APP_SECRET authentication bypass affecting versions \u2264 2.57.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T07:00:03.889488Z"}, {"uuid": "bacbebb6-5cf4-46fd-b399-a8feab813385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49865", "type": "seen", "source": "Telegram/47AGWfAWFIwZKzQcl_sisfXazYjpo74QYaHVlY-riLjwoTE", "content": "", "creation_timestamp": "2026-07-30T14:00:04.679467Z"}, {"uuid": "c66ffffd-9470-434a-b305-77d1fbaa2856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49865", "type": "published-proof-of-concept", "source": "Telegram/47AGWfAWFIwZKzQcl_sisfXazYjpo74QYaHVlY-riLjwoTE", "content": "", "creation_timestamp": "2026-07-31T00:00:29.463347Z"}, {"uuid": "ffc3cea8-829d-43b8-b871-f3d5c38cb21d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49865", "type": "published-proof-of-concept", "source": "Telegram/A5dzmxNNpgXG6imsEkmIRw7rqHzvuUDwkzq5yMgxpcxN0a0", "content": "", "creation_timestamp": "2026-07-31T00:00:34.657537Z"}, {"uuid": "1363d789-2995-4e4c-b766-04ccc8ef1d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49865", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95796", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Kimai-CVE-2026-49865-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cyeezy08\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-30 05:51:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) \u2014 Kimai time-tracking default APP_SECRET authentication bypass affecting versions \u2264 2.57.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T00:00:38.536999Z"}, {"uuid": "a6eb240a-28fe-4310-8e55-1532fd23a337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4986", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mntmxrwj352e", "content": "CVE-2026-4986 - WPForms Lite\nCVE ID : CVE-2026-4986\n \n Published : June 9, 2026, 6:16 a.m. | 18\u00a0minutes ago\n \n Description : The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthe...", "creation_timestamp": "2026-06-09T07:04:06.752177Z"}, {"uuid": "bd52435e-3ef5-41aa-90aa-039fd495fc64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wpquuw42c", "content": "CVE-2026-49869 - Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`\nCVE ID : CVE-2026-49869\n \n Published : June 26, 2026, 8:58 p.m. | 46\u00a0minutes ago\n \n Description : Kestra is an open-source, event-driven orchestration platform. P...", "creation_timestamp": "2026-06-26T21:55:41.631803Z"}, {"uuid": "e225e57b-239f-4315-9319-2c618c895b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7znrg3ri2v", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-49869](https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx)\nKes...\nhttps://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-06-26T22:48:16.088392Z"}, {"uuid": "599e78fb-f7b3-4100-b808-4aae4800fb81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpbwpqyb652n", "content": "\ud83d\udd34 CVE-2026-49869 - Critical (10)\n\nKestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, Authen...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49869/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-27T17:01:02.742503Z"}, {"uuid": "eff8f45e-c639-46ab-8fee-333a4c2d62f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgqbxkzns2t", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49869 \u0432 Kestra: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/B5BA2AC2-AEE2-43C7-B38D-479BC9C26EDB", "creation_timestamp": "2026-06-29T14:49:14.264859Z"}, {"uuid": "46389396-009b-45ca-bcdd-0d38ec1f42c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49860", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpguopfyi62y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49860 \u0432 Deno: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/A1FF0A71-1CBD-445B-8472-3F498D112100", "creation_timestamp": "2026-06-29T16:07:56.944996Z"}, {"uuid": "50e03134-1742-40ce-934e-29bb1cd722a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mph7jszwvg2o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49869 \u0432 Kestra: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/83FCFA8E-72B3-469A-BC78-6B5124D0024E", "creation_timestamp": "2026-06-29T19:22:04.184884Z"}, {"uuid": "5d51b0c3-7887-406b-a45b-eebedc6b2cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplme3jqxl2p", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49869 \u0432 Kestra: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8374666B-B449-4CD6-8B6D-525D26AA803B", "creation_timestamp": "2026-07-01T13:22:09.249092Z"}, {"uuid": "f8ad0fd9-c465-4a67-bde6-018540419f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49864", "type": "published-proof-of-concept", "source": "https://github.com/butlerx/wetty/security/advisories/GHSA-p26j-h7wj-r568", "content": "", "creation_timestamp": "2026-07-01T20:35:13.846284Z"}, {"uuid": "70fbf907-33e5-4873-9d46-4130f79731df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpn2haequf2t", "content": "\ud83d\udccc CVE-2026-49869 - Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().e... https://www.cyberhub.blog/cves/CVE-2026-49869", "creation_timestamp": "2026-07-02T03:07:08.191672Z"}, {"uuid": "1984cf06-697c-46a1-bcf4-59a838866fe3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-4986", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msxpkreuhq24", "content": "\ud83d\udccc WPForms PayPal Webhook Vulnerability Disclosed (CVE-2026-4986) https://www.cyberhub.blog/article/29546-wpforms-paypal-webhook-vulnerability-disclosed-cve-2026-4986", "creation_timestamp": "2026-08-13T13:07:06.585911Z"}, {"uuid": "24934b9b-dd23-489f-af48-182e5488af03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49866", "type": "seen", "source": "https://gist.github.com/alon710/9eaabfe8d7f17c883b344ecc760d4947", "content": "# CVE-2026-49866: CVE-2026-49866: CPU-Based Denial of Service in @libp2p/gossipsub Protobuf Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49866\n\n## Summary\nA high-severity denial-of-service vulnerability in @libp2p/gossipsub prior to version 16.0.0 allows unauthenticated remote attackers to trigger event loop starvation and complete node freeze by exploiting unbounded protobuf decoding limits and nested synchronous array iteration loops.\n\n## TL;DR\nUnbounded protobuf limits and synchronous array loops in @libp2p/gossipsub allow unauthenticated remote attackers to block the single-threaded Node.js event loop, causing a complete denial of service.\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00446\n- **Exploit Status**: poc\n- **KEV Status**: not-listed\n\n## Affected Systems\n\n- @libp2p/gossipsub prior to 16.0.0\n- js-libp2p installations using vulnerable @libp2p/gossipsub modules\n\n## Mitigation\n\n- Upgrade dependency @libp2p/gossipsub to version 16.0.0 or above\n- Configure explicit decodeRpcLimits in GossipSub initialization option block\n- Implement event loop lag monitoring in the application infrastructure\n\n**Remediation Steps:**\n1. Identify vulnerable @libp2p/gossipsub references in package.json or package-lock.json\n2. Execute the upgrade to version 16.0.0 or higher\n3. Alternatively, modify instantiation properties to override default limits manually\n4. Deploy telemetry to capture event loop blocking spikes\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49866) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T16:41:48.965515Z"}, {"uuid": "cf830453-574e-45a3-b136-eaad73d2186a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49866", "type": "published-proof-of-concept", "source": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv", "content": "", "creation_timestamp": "2026-07-10T18:35:05.732724Z"}, {"uuid": "bcd471e3-428e-43e6-b355-6c192350e850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://t.me/GithubRedTeam/91304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49869\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ap0dexMe0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 14:53:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKestra Auth-Bypass Vulnerability Checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:16.436084Z"}, {"uuid": "af566096-140c-4efa-9e29-c33ef4eec0a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://t.me/GithubRedTeam/91304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49869\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ap0dexMe0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 14:53:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKestra Auth-Bypass Vulnerability Checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:33.020711Z"}, {"uuid": "98af1e89-8fd0-47ab-92db-cef9dde81edd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49869\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ap0dexMe0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 14:53:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKestra Auth-Bypass Vulnerability Checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:25.368549Z"}, {"uuid": "61ea37b9-1f39-45d4-9bcd-cc466adbcddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-16T19:00:25.590335Z"}, {"uuid": "8d4db5c7-a66b-4035-8295-f1d1b9a9ae7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-16T19:00:26.029998Z"}, {"uuid": "f6ce31ab-4034-46dc-b63c-31fc9c475d9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-17T00:00:41.829799Z"}, {"uuid": "793252dd-1e8c-4c77-ae61-37171a2ea2d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-17T00:00:42.262457Z"}, {"uuid": "805b9836-8544-482a-95cc-48515d9f91ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "published-proof-of-concept", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-18T00:00:09.137221Z"}, {"uuid": "1ed38e14-1038-49ad-ba91-2ae1a47de75c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "published-proof-of-concept", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-18T00:00:09.483067Z"}, {"uuid": "ef7d0c54-8b82-4de6-b307-f32223b0378a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4986", "type": "seen", "source": "https://bsky.app/profile/noob.bsky.social/post/3mrajkrjjxk24", "content": "I found a WPForms PayPal webhook flaw, then learned ten researchers had already reported it.\nThe code bug was small but the rediscovery signal was not.\n\nCVE-2026-4986\n\nblog.himanshuanand.com/2026/07/repo...", "creation_timestamp": "2026-07-22T14:23:18.780234Z"}, {"uuid": "b2ef758c-19f9-4778-894b-0de667d975f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4986", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mralj2lvlj2s", "content": "I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)", "creation_timestamp": "2026-07-22T14:58:09.342701Z"}, {"uuid": "c276cef5-5fee-4781-b805-32efa33485c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4986", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mraqdkpmmo2g", "content": "I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)", "creation_timestamp": "2026-07-22T16:24:32.764971Z"}, {"uuid": "31e4f5da-c09e-4b59-857f-b213da08849b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4986", "type": "seen", "source": "https://bsky.app/profile/ttek2.bsky.social/post/3mrbs6hve2s2z", "content": "A PayPal webhook vulnerability in WPForms has been assigned CVE-2026-4986.\n\nhttps://ttek2.com/topics/paypal", "creation_timestamp": "2026-07-23T02:30:10.141234Z"}, {"uuid": "c318fb72-d49e-484b-adc8-109d933d147c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukhl7mjd524", "content": "\ud83d\uded1 CVE-2026-49869\nKestra Kestra OSS\nCVSS 10.0 / EPSS 1% / KEV: No\nTL;DR: Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.2\u2026\nhttps://cvesentinel.com/report/CVE-2026-49869?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T17:29:58.530119Z"}, {"uuid": "c683880f-96b7-49b4-8d7c-b14c5641642f", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c35b7361-b19f-4856-b966-3809c4a93ad6", "content": "", "creation_timestamp": "2026-09-02T18:00:02.148418Z"}, {"uuid": "204d97d0-b0cf-4cea-a27d-e4b6c479ca15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukjsxudsw2i", "content": "\ud83d\uded1 CVE-2026-49869\nKestra Kestra OSS\nCVSS 10.0 / EPSS 1% / KEV \u2705\nTL;DR: Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21,\u2026\nhttps://cvesentinel.com/report/CVE-2026-49869?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T18:10:06.723696Z"}, {"uuid": "837fdab7-43ab-4999-b9f6-549602e790af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117202988713449046", "content": "Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.\n- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549\n- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548\n- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586\n- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329\n- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869\n- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710\n- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability", "creation_timestamp": "2026-09-02T19:01:24.604279Z"}, {"uuid": "9a7ff6b3-bd50-41d8-8d32-e07636960028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mukyxxiulz23", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-49869: Kestra OSS OS Command Injection Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-49869", "creation_timestamp": "2026-09-02T22:41:19.998702Z"}, {"uuid": "be1b7266-3f51-4c15-b266-ca834dd87a44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mulsjf56h327", "content": "Critical vulnerability CVE-2026-49869 strikes Kestra OSS with active CISA KEV exploitation. Unauthenticated attackers can execute arbitrary OS commands. Read our strategic T-Suite brief for telemetry analysis, CrowdStrike detection queries, and rapid perimeter hardening steps.\u2026", "creation_timestamp": "2026-09-03T06:18:28.315190Z"}, {"uuid": "4f528b48-25dd-462e-ac33-acd9a94c9494", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mult7vbtlp2e", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-49869: \u26a0\ufe0f CVE-2026-49869: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.0%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-49869-kestra-is-an-open-source-event-driven-orchestration", "creation_timestamp": "2026-09-03T06:31:03.324819Z"}, {"uuid": "0018d05b-daf9-4a7a-8caf-f083bb1d56ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mumtkjrgaw2c", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-49869 \u2013 Kestra OSS OS Command Injection\u00a0Vulnerability\n\nActive CISA KEV exploitation of CVE-2026-49869 exposes Kestra OSS to remote OS command injection. Explore board-ready governance, asset enumeration, and risk\u2026\n\nhttps://thecybermind.co/f58i", "creation_timestamp": "2026-09-03T16:09:40.534769Z"}, {"uuid": "d42799b6-a522-4946-ae72-e3e57630e865", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e8759eae-7c56-40c5-a594-d6c77d172beb", "content": "", "creation_timestamp": "2026-09-03T18:00:29.627567Z"}, {"uuid": "5d8c3841-1258-4f1d-b6b7-6a4e160a4eb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3muo3xzxe5k2t", "content": "Patch Kestra now: CVE-2026-49869 (CVSS 10.0) is an unauthenticated code-execution flaw under active exploitation and on CISA KEV. Upgrade to 1.0.45 or 1.3.21. https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html", "creation_timestamp": "2026-09-04T04:13:02.666475Z"}, {"uuid": "27f85d10-0c31-4abb-8d47-35597814ed7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muo4kovoba2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-49869: Kestra is an open-source, event-driven orchestration platform\nCVSS 10 \u00b7 EPSS 1.9% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2026-49869\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-04T04:23:28.635307Z"}]}