{"vulnerability": "CVE-2026-10087", "sightings": [{"uuid": "471f8814-dd03-4940-8e1f-3d91fbbb332f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10087", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-16", "content": "", "creation_timestamp": "2026-06-11T01:08:31.000000Z"}, {"uuid": "f465ff79-55c9-4e99-8025-cccdeeba40ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10087", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y", "content": "\ud83d\udd17 CVE : CVE-2026-10087, CVE-2026-10733, CVE-2026-1500, CVE-2026-3553, CVE-2026-6269, CVE-2026-6277, CVE-2026-6552, CVE-2026-6976, CVE-2026-7250, CVE-2026-8589, CVE-2026-9204, CVE-2026-9694", "creation_timestamp": "2026-06-11T12:45:12.746479Z"}, {"uuid": "381119f8-68f8-4cb3-8e94-7f50fdac598b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10087", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnze6d4tg52m", "content": "CVE-2026-10087 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab\nCVE ID : CVE-2026-10087\n \n Published : June 11, 2026, 12:16 p.m. | 47\u00a0minutes ago\n \n Description : GitLab has remediated an issue in GitLab EE affecting all versions...", "creation_timestamp": "2026-06-11T13:42:39.205712Z"}, {"uuid": "15840f92-7e32-4a1f-bb8e-9ef6adf09d52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10087", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260612", "content": "", "creation_timestamp": "2026-06-11T18:00:00.000000Z"}, {"uuid": "697a815e-f920-4fa0-af7e-bafaec7290a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10087", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mocfuuljzl2e", "content": "\ud83d\udccc CVE-2026-10087 - GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under c... https://www.cyberhub.blog/cves/CVE-2026-10087", "creation_timestamp": "2026-06-15T04:07:07.160826Z"}, {"uuid": "bcc7598d-790c-489e-88f8-ff9d14cd381f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100872", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fsopnd6va4p2l", "content": "CVE-2026-100872 - Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite\nCVE ID : CVE-2026-100872\n \n Published : Sept. 27, 2026, 1:16 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalc...", "creation_timestamp": "2026-09-27T14:47:09.886081Z"}, {"uuid": "ec0fd4e9-cec3-4218-9a3e-5c91747e46e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100871", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iyucvqqipnjh6", "content": "CVE-2026-100871 - Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication\nCVE ID : CVE-2026-100871\n \n Published : Sept. 27, 2026, 1:16 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : Sylius versions before 1.12.25, 1.13....", "creation_timestamp": "2026-09-27T14:53:09.777274Z"}, {"uuid": "0f3b7e17-6fd5-4cbc-80f9-41df43d885f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jesnkemshe52w", "content": "CVE-2026-100870 - Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header\nCVE ID : CVE-2026-100870\n \n Published : Sept. 27, 2026, 1:16 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : Sylius versions before 1.12.25, 1.13.17, 1.14...", "creation_timestamp": "2026-09-27T14:59:09.711207Z"}, {"uuid": "ef00170f-b854-4937-a8cf-db5e5cfb065a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100871", "type": "seen", "source": "https://gist.github.com/ichintu/f423d36b58b96f0e6b3b72c29160f47e", "content": "On September 27, 2026, four HIGH-severity vulnerabilities were disclosed affecting Sylius e-commerce platforms (versions prior to 1.12.25/1.13.17/1.14.20 and 2.1.16/2.2.9). The flaws include:\n\u2022 **Payment Manipulation & Unauthorized Refunds** (CVE-2026-100872, CVE-2026-100869): Missing validation and API restrictions allow attackers to alter order totals or force refunds while bypassing gateway checks, leading to financial fraud.\n\u2022 **JWT Audience Confusion** (CVE-2026-100871): Malformed tokens from the Shop API can be misinterpreted by the Admin API, enabling privilege escalation to full administrative access.\n\u2022 **Host Header Poisoning** (CVE-2026-100870): Unvalidated `Host` headers allow attackers to forge admin password-reset links, facilitating account takeover.\n\n**Impact & Recommendation:** These vulnerabilities pose significant risks of financial loss and unauthorized administrative access. Users should immediately upgrade to the patched versions and apply vendor-recommended mitigations.", "creation_timestamp": "2026-09-27T16:00:35.000000Z"}, {"uuid": "32218b64-ecf4-4ada-b3c2-04191946bfc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://gist.github.com/ichintu/f423d36b58b96f0e6b3b72c29160f47e", "content": "On September 27, 2026, four HIGH-severity vulnerabilities were disclosed affecting Sylius e-commerce platforms (versions prior to 1.12.25/1.13.17/1.14.20 and 2.1.16/2.2.9). The flaws include:\n\u2022 **Payment Manipulation & Unauthorized Refunds** (CVE-2026-100872, CVE-2026-100869): Missing validation and API restrictions allow attackers to alter order totals or force refunds while bypassing gateway checks, leading to financial fraud.\n\u2022 **JWT Audience Confusion** (CVE-2026-100871): Malformed tokens from the Shop API can be misinterpreted by the Admin API, enabling privilege escalation to full administrative access.\n\u2022 **Host Header Poisoning** (CVE-2026-100870): Unvalidated `Host` headers allow attackers to forge admin password-reset links, facilitating account takeover.\n\n**Impact & Recommendation:** These vulnerabilities pose significant risks of financial loss and unauthorized administrative access. Users should immediately upgrade to the patched versions and apply vendor-recommended mitigations.", "creation_timestamp": "2026-09-27T16:00:35.000000Z"}, {"uuid": "eb6a26c8-62e8-4987-80e0-2ee533d1675a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100872", "type": "seen", "source": "https://gist.github.com/ichintu/f423d36b58b96f0e6b3b72c29160f47e", "content": "On September 27, 2026, four HIGH-severity vulnerabilities were disclosed affecting Sylius e-commerce platforms (versions prior to 1.12.25/1.13.17/1.14.20 and 2.1.16/2.2.9). The flaws include:\n\u2022 **Payment Manipulation & Unauthorized Refunds** (CVE-2026-100872, CVE-2026-100869): Missing validation and API restrictions allow attackers to alter order totals or force refunds while bypassing gateway checks, leading to financial fraud.\n\u2022 **JWT Audience Confusion** (CVE-2026-100871): Malformed tokens from the Shop API can be misinterpreted by the Admin API, enabling privilege escalation to full administrative access.\n\u2022 **Host Header Poisoning** (CVE-2026-100870): Unvalidated `Host` headers allow attackers to forge admin password-reset links, facilitating account takeover.\n\n**Impact & Recommendation:** These vulnerabilities pose significant risks of financial loss and unauthorized administrative access. Users should immediately upgrade to the patched versions and apply vendor-recommended mitigations.", "creation_timestamp": "2026-09-27T16:00:35.000000Z"}, {"uuid": "d79465ed-d976-45c6-97eb-408e12d23c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100874", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwjigzm4bu26", "content": "CVE-2026-100874 is a remotely exploitable SQL injection flaw in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A public exploit has been published per VulDB. The project ships as a rolling release and no fixed version is available.", "creation_timestamp": "2026-09-27T19:03:15.013061Z"}]}