{"vulnerability": "CVE-2026-1222", "sightings": [{"uuid": "ebc97cc2-3495-4bf9-9d61-67fb7d592cbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-1222", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10643-2f8d7-2.html", "content": "", "creation_timestamp": "2026-01-20T06:08:00.000000Z"}, {"uuid": "f0ffd4a2-0b21-48d8-ad33-e99071abd0e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1222", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mcto5rhcok2m", "content": "", "creation_timestamp": "2026-01-20T07:48:11.761082Z"}, {"uuid": "bc0ad49a-163c-4017-97cc-2b38c53ecb3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116748855026545149", "content": "The severity is increased for this new vulnerability affecting Yealink SIP-T46U (CVE-2026-12221) https://vuldb.com/vuln/370864", "creation_timestamp": "2026-06-14T14:09:12.981478Z"}, {"uuid": "254ae388-3eb7-4585-9897-7ae3dab58bee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12222", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116748909958194636", "content": "We have just added an important vulnerability affecting Yealink SIP-T46U (CVE-2026-12222) https://vuldb.com/vuln/370865", "creation_timestamp": "2026-06-14T14:23:10.926171Z"}, {"uuid": "857a65f4-5607-4c7a-acda-0e3aaf0df7d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12220", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mocpkfa5of2w", "content": "\ud83d\udfe0 CVE-2026-12220 - High (8)\n\nA vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_up...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12220/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-15T07:00:14.183007Z"}, {"uuid": "5cb51ded-533c-4c60-9359-4c38ea5102d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mocpkmlj2e2o", "content": "\ud83d\udfe0 CVE-2026-12221 - High (8)\n\nA vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12221/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-15T07:00:21.446137Z"}, {"uuid": "0bac874d-038e-4ea2-8110-990cda7e8fb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12222", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mocpktp47b26", "content": "\ud83d\udfe0 CVE-2026-12222 - High (8)\n\nA vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_web...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12222/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-15T07:00:28.829184Z"}, {"uuid": "5b3eb47f-2fa3-4329-af2c-2abaf7c164f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12222", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116752949593372358", "content": "Yealink SIP-T46U v108.86.0.118 hit by HIGH-severity stack-based buffer overflow (CVE-2026-12222). Exploitable via local network \u2014 no patch, vendor unresponsive. Restrict access & monitor. https://radar.offseq.com/threat/cve-2026-12222-stack-based-buffer-overflow-in-yeal-f1394c98 #OffSeq #Yealink #VoIP #Vuln", "creation_timestamp": "2026-06-15T07:30:32.633645Z"}, {"uuid": "399c22dd-c559-433a-991f-c230bc7ac439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12222", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mocramggko2a", "content": "Yealink SIP-T46U (v108.86.0.118) faces HIGH-severity stack buffer overflow \u2014 no fix yet. Limit local network access & monitor for threats. Vendor hasn\u2019t responded. https://radar.offseq.com/threat/cve-2026-12222-stack-based-buffer-overflow-in-yeal-f1394c98 #OffSeq #Yealink #Vulnerability", "creation_timestamp": "2026-06-15T07:30:32.868888Z"}, {"uuid": "8689b079-0dc7-4bc7-a76d-ab00149bdd88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12222", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mocse4yapw2h", "content": "CVE-2026-12222 - Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow\nCVE ID : CVE-2026-12222\n \n Published : June 15, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. A...", "creation_timestamp": "2026-06-15T07:50:41.467270Z"}, {"uuid": "ea694762-4ba2-4858-8a0e-08996da4f7fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moct5visew2b", "content": "CVE-2026-12221 - Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow\nCVE ID : CVE-2026-12221\n \n Published : June 15, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the f...", "creation_timestamp": "2026-06-15T08:04:48.533785Z"}, {"uuid": "db35b453-e11e-4058-b348-12515b4c5bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12220", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moctguavyj2e", "content": "CVE-2026-12220 - Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow\nCVE ID : CVE-2026-12220\n \n Published : June 15, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : A vulnerability has been found in Yeali...", "creation_timestamp": "2026-06-15T08:09:49.371607Z"}, {"uuid": "f55a67a7-51f1-44bd-ae51-d528d82a1082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12223", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mocukowlju2p", "content": "CVE-2026-12223 - Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection\nCVE ID : CVE-2026-12223\n \n Published : June 15, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : A vulnerability was identified in Yealink SIP-T46U 108.86....", "creation_timestamp": "2026-06-15T08:30:12.967781Z"}, {"uuid": "d7d7453e-6a51-461d-a68b-dfbf7aabd918", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12221", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mocwbh6jag2l", "content": "Yealink SIP-T46U (ver. 108.86.0.118) hit by HIGH severity stack buffer overflow. Local network attackers could execute code or crash device. No patch \u2014 limit access & watch for updates. https://radar.offseq.com/threat/cve-2026-12221-stack-based-buffer-overflow-in-yeal-97330930 #OffSeq #VoIP", "creation_timestamp": "2026-06-15T09:00:33.962611Z"}, {"uuid": "6641de5c-d260-4784-bbe9-c488cae28487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12221", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116753303263866173", "content": "\ud83d\udd0e CVE-2026-12221: HIGH severity stack-based buffer overflow in Yealink SIP-T46U (108.86.0.118). Exploitable via local network \u2014 potential code execution or DoS. No fix yet; restrict device access & monitor updates. https://radar.offseq.com/threat/cve-2026-12221-stack-based-buffer-overflow-in-yeal-97330930 #OffSeq #VoIP #Infosec", "creation_timestamp": "2026-06-15T09:00:37.453492Z"}, {"uuid": "f9ca4fac-a3a3-413c-bdde-9f49a1e6f0ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mocza5ns2v2u", "content": "CVE-2026-12221:", "creation_timestamp": "2026-06-15T09:53:26.803464Z"}, {"uuid": "cabe4334-0cc0-49cb-aa5c-20c297628398", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mocza5ovnq26", "content": "CVE-2026-12221:", "creation_timestamp": "2026-06-15T09:53:27.349046Z"}, {"uuid": "1e28cc32-335a-4a43-9e90-f3da8599867c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3moczlpepmr2x", "content": "CVE-2026-12221:", "creation_timestamp": "2026-06-15T09:59:54.461240Z"}, {"uuid": "77715eef-5439-46e9-a9a1-48ac89b05b06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3moczlum32k2d", "content": "# Daily IT Security Digest \u2013 2026-06-15\n=== IT Security Data Collection \u2014 2026-06-15 ===\n\n--- #infosec (5 posts) ---\n@offseq@infosec.exchange: \ud83d\udd0e CVE-2026-12221: HIGH severity stack-based buffer overflow in Yealink SIP-T46U (108.86.0.118). Exploitable via local network \u2014 potential code execution or", "creation_timestamp": "2026-06-15T09:59:59.744901Z"}, {"uuid": "93533d99-4834-4e31-92df-928c55b39249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mod2m5kovl26", "content": "CVE-2026-12221:", "creation_timestamp": "2026-06-15T10:18:06.669820Z"}, {"uuid": "459a7597-09cf-4350-9630-31019fe14195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3moeqyf377y2r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-35273: 57 interactions\nCVE-2026-11645: 30 interactions\nCVE-2025-10263: 25 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-39987: 18 interactions\nCVE-2026-0257: 7 interactions\nCVE-2026-12221: 6 interactions\n", "creation_timestamp": "2026-06-16T02:31:16.968863Z"}, {"uuid": "00a38f74-476d-4669-9827-c7c9b28698c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12225", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mofvwytyu62f", "content": "CVE-2026-12225 - syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent\nCVE ID : CVE-2026-12225\n \n Published : June 16, 2026, 12:16 p.m. | 52\u00a0minutes ago\n \n Description : syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3....", "creation_timestamp": "2026-06-16T13:32:37.805515Z"}, {"uuid": "c2e4bcd8-0fea-4cba-8efa-4ee101fec49c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12225", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3motvk57rgk2h", "content": "SEC Consult SA-20260616-0 :: Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket #CVE-2026-12225\n\nPosted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 20SEC Consult Vulnerability Lab Security Advisory < 20260616-0 > \n====\u2026\n#hackernews #news", "creation_timestamp": "2026-06-22T03:03:17.316967Z"}, {"uuid": "50d1b13f-f0a3-4ce0-a663-1cac39b27d3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12224", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6f64vmw2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-12224 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Dokan Pro \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439\n\n\n\nhttps://kripta.biz/posts/CEFA36DF-70BE-4515-81FC-8DA34559A304", "creation_timestamp": "2026-07-01T09:12:13.319472Z"}, {"uuid": "e60fed24-f809-474e-aece-1786473608fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12224", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mpl6f6frm32l", "content": "WordPress Dokan Pro \u63d2\u4ef6\u6f0f\u6d1e\u5206\u6790:CVE-2026-12224 \u6743\u9650\u63d0\u5347\u98ce\u9669\u53ca\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/530E42A6-D08F-47FC-BD95-F51E5E85C4C9", "creation_timestamp": "2026-07-01T09:12:13.805746Z"}, {"uuid": "10433f81-edb8-43df-bc19-6775a4b61a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12224", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mplgml62he2m", "content": "WordPress Dokan Pro \u63d2\u4ef6\u6f0f\u6d1e\u5206\u6790:CVE-2026-12224 \u6743\u9650\u63d0\u5347\u98ce\u9669\u53ca\u5b89\u5168\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/0FE6831D-2485-4680-9C21-3C4F674665BD", "creation_timestamp": "2026-07-01T11:39:31.780291Z"}, {"uuid": "1f594a5a-64ea-4fd5-94a3-10a8cd61fa33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12224", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgmlu4h32q", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-12224 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Dokan Pro: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 WordPress\n\n\n\nhttps://kripta.biz/posts/55C740A8-C99C-4DC9-A72C-3DB8C36668DD", "creation_timestamp": "2026-07-01T11:39:36.000218Z"}, {"uuid": "7dd65fda-54f8-4655-ae6d-79689c3f211a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12224", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mpmpzafsou2j", "content": "Any user becomes admin. CVE-2026-12224. Dokan Pro \u22645.0.4 lets attackers escalate privileges via REST endpoint\u2014no validation on capability strings. CVSS 8.8. Update to 5.0.4+ immediately. Scan your WordPress site: pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "creation_timestamp": "2026-07-02T00:00:20.120318Z"}, {"uuid": "ebfa798b-fbba-4210-927f-b70de8eecfb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/116943308400000440", "content": "\ud83d\udd77 Bugs Alerts\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udea8 New Vulnerability!\n\ud83c\udd94 CVE ID:CVE-2026-12228\ud83d\udcca Severity: \ud83d\udfe0 HIGH\ud83d\udcc8 CVSS Score: 8.7\ud83d\udcc5 Published: 2026-07-18 21:17 UTC\n\ud83d\udcdd Description:A stored cross-site scripting (XSS) vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled prompt_content into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through MessageContentRenderer, which uses v-html...\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\ud83d\udc68\u200d\ud83d\udcbb", "creation_timestamp": "2026-07-18T22:21:15.497066Z"}, {"uuid": "f4dc444d-4599-4bf3-8608-cd3a0936c821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqxgbznwv727", "content": "CVE-2026-12228 - Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms\nCVE ID : CVE-2026-12228\n \n Published : July 18, 2026, 9:17 p.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/sha...", "creation_timestamp": "2026-07-18T23:30:46.399226Z"}, {"uuid": "955c4258-242f-47ad-9467-a649887ac5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116943698895820998", "content": "CVE-2026-12228: parisneo/lollms suffers HIGH severity stored XSS (CVSS 8.7) via POST /api/prompts/share. Authenticated users can execute JS in victims' browsers, risking account takeover. Patch status unknown \u2014 check vendor updates. https://radar.offseq.com/threat/cve-2026-12228-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-9a447d2fa5ce8bc8 #OffSeq #XSS #Vuln #InfoSec", "creation_timestamp": "2026-07-19T00:00:34.448171Z"}, {"uuid": "ff50b1a0-9149-4edf-a750-d0e1316ae058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12228", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqxhxek3hj2i", "content": "parisneo/lollms hit by HIGH severity stored XSS (CVE-2026-12228, CVSS 8.7). Authenticated users can execute JS in victims\u2019 browsers. Check vendor for fixes \u2014 limit prompt sharing for now. https://radar.offseq.com/threat/cve-2026-12228-cwe-79-improper-neutralization-of-input-during-web-page-genera...", "creation_timestamp": "2026-07-19T00:00:36.686356Z"}, {"uuid": "3d54a5ce-57ac-42c3-8ac8-e9aee0f76553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqy42wqik62g", "content": "\ud83d\udfe0 CVE-2026-12228 - High (8.7)\n\nA stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoin...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12228/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-19T06:00:31.037339Z"}, {"uuid": "af50ec7e-246c-4b88-bd3d-2193bbbb27cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116948731053893657", "content": "It is possible to see elevated activities targeting parisneo lollms (CVE-2026-12228) https://vuldb.com/vuln/380097/cti", "creation_timestamp": "2026-07-19T21:20:18.718350Z"}, {"uuid": "00e55c70-1b6b-4767-bdc2-e3dfd62c5770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12223", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mrcsoohd7i2j", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-12223](http://cdn2.v50to.cc/T46U/T46U_mod_webd_TFTPUploadIperf_system_exec.zip)\nA vulne...\nhttp://cdn2.v50to.cc/T46U/T46U_mod_webd_TFTPUploadIperf_system_exec.zip #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-07-23T12:11:52.810945Z"}, {"uuid": "708d5e96-0cc2-46d4-be1b-6c977484c592", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12222", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mrcsrasnqm2k", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-12222](http://cdn2.v50to.cc/T46U/T46U_mod_webd_BlueToothTest_off_by_one.zip)\nA vulnerab...\nhttp://cdn2.v50to.cc/T46U/T46U_mod_webd_BlueToothTest_off_by_one.zip #CVE #ZeroDay #PatchManagement", "creation_timestamp": "2026-07-23T12:13:19.206976Z"}, {"uuid": "cd34ceef-0bb1-4cc0-86b3-3ea956c99011", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12221", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mrcstzlpd42y", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-12221](http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrade_chunk_stack_overflow.zip)\nA v...\nhttp://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrade_chunk_stack_overflow.zip #Vulnerability #CVE #ZeroDay", "creation_timestamp": "2026-07-23T12:14:52.236982Z"}, {"uuid": "6eeed55d-7a87-4009-be00-743c277582b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwazax65vk2u", "content": "CVE-2026-12227 - visual composer website builder\nThe Visual Composer Website Builder plugin for WordPress lets anyone on the internet cause the server to load files it should not. By sending a specially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#visualcomposer #CVE #infosec", "creation_timestamp": "2026-09-24T10:10:06.930465Z"}, {"uuid": "f2f145d3-15a8-49cc-98b2-920627491fdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12227", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117325550570551615", "content": "Visual Composer Website Builder plugin \u226445.16.0 hit by CRITICAL LFI (CVE-2026-12227). Unauthenticated attackers can execute arbitrary PHP files via 'vcv-template'. Patch unconfirmed. Mitigate & monitor now: https://radar.offseq.com/threat/cve-2026-12227-cwe-98-improper-control-of-filename-for-includerequire-statement-in-php-program-php-ed037e731eb4a3e7 #OffSeq #WordPress #Vuln #LFI", "creation_timestamp": "2026-09-24T10:30:28.496142Z"}, {"uuid": "2afcc085-c912-44b1-a2b4-25d3e2ab7fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12227", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwb2ffhzta2w", "content": "CVE-2026-12227: Visual Composer Website Builder \u226445.16.0 faces CRITICAL LFI \u2014 remote attackers can gain code execution. Patch status unconfirmed; restrict access & monitor activity. Full details: https://radar.offseq.com/threat/cve-2026-12227-cwe-98-improper-control-of-filename-for-includerequire...", "creation_timestamp": "2026-09-24T10:30:30.729114Z"}, {"uuid": "3b40f7fa-4667-4665-8e3d-55a0f9a73519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwb7sf3xdg2u", "content": "\ud83d\udea8 CVE-2026-12227 \u2014 CVSS 9.8 CRITICAL\n\nThe Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-12227\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-24T12:07:14.823622Z"}, {"uuid": "5ee87da2-9e25-499f-b79b-685b14216e97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwbamk45uy24", "content": "\ud83d\udd34 CVE-2026-12227 - Critical (9.8)\n\nThe Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12227/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-24T12:21:53.304008Z"}, {"uuid": "045afa6e-e699-497e-bbdc-9aa55ec27daf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103268", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:12:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder \u226445.16.0 \u2014 unauthenticated local file inclusion via vcv-template. Educational PoC only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T19:00:06.000000Z"}, {"uuid": "89caf823-3a81-4948-acdf-2f76316635d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103264", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227-visualcomposer-lfi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:48:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T18:00:08.000000Z"}, {"uuid": "8885e693-aa14-4516-8ba3-6560dfe2dd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103268", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:12:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder \u226445.16.0 \u2014 unauthenticated local file inclusion via vcv-template. Educational PoC only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T19:00:06.000000Z"}, {"uuid": "5c409a31-da5a-44ae-9080-c837cf0a6781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103264", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227-visualcomposer-lfi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:48:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T18:00:08.000000Z"}, {"uuid": "8523036d-33ef-4129-b878-d516e60123c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/qZC90S3reg2BYBoeaZDLMoqfl021M9e_UnMBthvWa2cdvlY", "content": "", "creation_timestamp": "2026-09-25T03:00:05.000000Z"}, {"uuid": "735c2ae6-9944-47d4-87a6-702a08209bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/XmZSdpY4T0rmzyootlW7VMaseMzYz4SaH1hTXJ2jQLx35-A", "content": "", "creation_timestamp": "2026-09-24T19:00:17.000000Z"}, {"uuid": "d3731f02-0ca6-4a36-9fdb-c5249f4d36a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/qZC90S3reg2BYBoeaZDLMoqfl021M9e_UnMBthvWa2cdvlY", "content": "", "creation_timestamp": "2026-09-25T03:00:05.000000Z"}, {"uuid": "9fb8726a-f0e5-4355-a968-0e39d0ef5658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/XmZSdpY4T0rmzyootlW7VMaseMzYz4SaH1hTXJ2jQLx35-A", "content": "", "creation_timestamp": "2026-09-24T19:00:17.000000Z"}, {"uuid": "12daa694-16c9-4ccc-81e1-068f3d60bf62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103511", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a be-keb\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 09:10:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T10:00:08.000000Z"}, {"uuid": "e0c44fc8-4358-472f-b15a-ba370d07d22b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-12227.yaml", "content": "", "creation_timestamp": "2026-09-25T02:01:53.000000Z"}, {"uuid": "d7dc1973-8f49-41ef-b921-4289d80fdd34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "d9a63071-0e14-45b2-8ef4-414e98dca7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/Xs5RSNf8dUoer362h3C47eE9d4XRs66xIhTCunAO4l08ziA", "content": "", "creation_timestamp": "2026-09-27T11:00:15.000000Z"}, {"uuid": "a0eb79f4-2393-431f-b806-723a921f39ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "1811fd7a-28ea-4056-81a8-da23d0c73b24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/Xs5RSNf8dUoer362h3C47eE9d4XRs66xIhTCunAO4l08ziA", "content": "", "creation_timestamp": "2026-09-27T11:00:15.000000Z"}]}