{"vulnerability": "cve-2026-9051", "sightings": [{"uuid": "8de8427b-d007-4c94-8a9e-749f3b142109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9051", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzd7piucp2i", "content": "\ud83d\udd34 CVE-2026-9051 - Critical (9.1)\n\nThere is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard applica...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9051/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T20:00:21.536799Z"}, {"uuid": "280df1a8-19ba-4538-a8e6-bf00aeeef7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90510", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfr27cacw22", "content": "\ud83d\udfe0 CVE-2026-90510 - High (8.3)\n\nA security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the f...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90510/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T14:01:19.757249Z"}, {"uuid": "82d2b9b3-86b4-4733-99c4-2c089eba5c09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90515", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvfy5yz7432n", "content": "SourceCodester School Registration and Fee System 1.0\u306e/bilal/normal/delete_stud.php\u3067SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u2026\nCVE-2026-90515 CVSS 7.3 | HIGH", "creation_timestamp": "2026-09-13T16:08:44.767895Z"}, {"uuid": "387bea91-abd1-44e8-97e3-8023b5be310a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90516", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvfy7hwzyh2l", "content": "SourceCodester School Registration and Fee System 1.0 \u306e /bilal/normal/pay_report.php \u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u2026\nCVE-2026-90516 CVSS 7.3 | HIGH", "creation_timestamp": "2026-09-13T16:09:37.680259Z"}, {"uuid": "0fb3d96e-c6d9-46fb-a024-68fa7c994b86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90510", "type": "seen", "source": "https://gist.github.com/ichintu/ccd66f14a97ed0726d9247eeed3e2e87", "content": "This update covers two high-severity vulnerabilities and a career guidance request:\n\n* **CVE-2026-90776 (8.7/HIGH):** Affects Nodemailer 9.1.0\u201310.0.4. Inefficient quadratic parsing of email headers can trigger CPU exhaustion and Denial of Service.\n* **CVE-2026-90510 (8.3/HIGH):** Impacts dromara orion-visor \u22642.5.7 due to a hard-coded encryption key. The flaw is remotely exploitable with a public exploit available; the vendor has not responded.\n* **Career Request:** A 22-year-old IT graduate from Asia pursuing a US cybersecurity MS seeks feedback on a SOC analyst learning roadmap (SIEM/SOAR, MITRE/NIST frameworks, Wireshark/Nessus, and certifications) and advice on navigating the OPT job market, securing remote roles, and obtaining employer visa sponsorship.", "creation_timestamp": "2026-09-13T16:50:43.259369Z"}, {"uuid": "3e402bfa-7d05-4131-ae38-0b93872b98a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90515", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mvhzltdp5f2j", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-90515\n\nA vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /b...", "creation_timestamp": "2026-09-14T11:39:38.882595Z"}, {"uuid": "597c8357-e01c-4343-97e5-a4a64019bfb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90519", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n  zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n  live-target evidence per report.\n\n\n{\n  \"date\": \"2026-09-15\",\n  \"count\": 3,\n  \"redacted\": true,\n  \"items\": [\n    {\n      \"cve\": \"CVE-2026-81648\",\n      \"cvss\": 10.0,\n      \"published\": \"2026-09-13T21:17:01.930\",\n      \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90519\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:27.697\",\n      \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90520\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:28.760\",\n      \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    }\n  ]\n}", "creation_timestamp": "2026-09-15T16:01:41.449673Z"}]}