{"vulnerability": "CVE-2026-4655", "sightings": [{"uuid": "0859c927-775c-435d-9a4d-365e7e839cea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4655", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mlcyxo2xdw2i", "content": "CVE-2026-4655 bdthemes-element-pack-lite (CVSS Score 6.4) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-08T05:33:07.335814Z"}, {"uuid": "540b2532-a41c-4f4f-b0cf-89396055c159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46557", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-rcr6-g7jc-f57g", "content": "", "creation_timestamp": "2026-05-18T20:37:31.000000Z"}, {"uuid": "3846ada5-e502-4cbf-91e2-16ea49060081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46556", "type": "published-proof-of-concept", "source": "https://github.com/flaskbb/flaskbb/security/advisories/GHSA-xq32-9g7q-7297", "content": "", "creation_timestamp": "2026-05-19T12:24:55.000000Z"}, {"uuid": "e00be19a-3919-4824-9041-d5e841d48442", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46552", "type": "seen", "source": "Telegram/90RQ9hYtGaiQArsrNQjzkMS9V8ZquthAYQcfSQsotfwm9eA", "content": "", "creation_timestamp": "2026-05-30T03:00:05.000000Z"}, {"uuid": "6c7a6d41-d0fe-4936-8e88-886e0e438027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mo2ph5flk72c", "content": "\ud83d\udccc CVE-2026-46558 - Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated ... https://www.cyberhub.blog/cves/CVE-2026-46558", "creation_timestamp": "2026-06-12T02:37:06.359201Z"}, {"uuid": "e5908503-d81d-44d6-8396-1153f9a7370b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46552", "type": "seen", "source": "https://t.me/GithubRedTeam/90510", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46552\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xmrma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-25 04:06:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNocoDB Shared-Base Links Could Invite Real Base Members and Survive Share Revocation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:18.849264Z"}, {"uuid": "23106e4e-ad8b-4dd1-b720-fa84e2220004", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46552", "type": "seen", "source": "https://t.me/GithubRedTeam/90510", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46552\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xmrma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-25 04:06:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNocoDB Shared-Base Links Could Invite Real Base Members and Survive Share Revocation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:35.069231Z"}, {"uuid": "12c0e783-9832-49e3-a59e-7e66964004ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46552", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/90510", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46552\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xmrma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-25 04:06:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNocoDB Shared-Base Links Could Invite Real Base Members and Survive Share Revocation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:20.946167Z"}, {"uuid": "1070f557-4d77-4ee1-adc8-fa5db05939f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-16T19:00:30.604288Z"}, {"uuid": "a0c7af09-ca30-45e3-b9d6-0884b1cd16bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-17T00:00:47.340404Z"}, {"uuid": "a18f3649-3e1c-46e0-9ad3-7e81d6e14430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-18T03:00:03.443794Z"}, {"uuid": "5af2a2c4-2128-4848-9eed-faab8bad69a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-19T00:00:30.385561Z"}, {"uuid": "5bd3ad05-351d-45eb-8a94-3742676b2ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "https://gist.github.com/tiagovilasboas/cac04abd132dca1c34d611179e8adca5", "content": "From: Tiago Vilas Boas\nSubject: Trilha do que foi reportado \u2014 9 hunts est\u00e1ticos, sem PoC\n\nPessoal,\n\nIsto n\u00e3o \u00e9 um dump de findings. \u00c9 o e-mail que eu mandaria pra mim mesmo no fim da sess\u00e3o, antes de abrir o browser: o que saiu do hunt, por qual porta, e o link.\n\nTudo est\u00e1tico. Li fonte. N\u00e3o mandei request contra ambiente de ningu\u00e9m.\n\n---\n\n1. ISSUE P\u00daBLICA (hardening, n\u00e3o bypass)\n\nFormbricks \u2014 CORS contradit\u00f3rio (`Allow-Credentials: true` + `Allow-Origin: *` em rotas de client/capture). XSS por `dangerouslySetInnerHTML` n\u00e3o confirmado (DOMPurify no caminho).\n\nIssue: https://github.com/formbricks/formbricks/issues/9081\n\nDub \u2014 7/7 webhooks de entrada autenticam o remetente. Dois handlers (Shopify, HubSpot) comparam HMAC com `!==` em vez de `timingSafeEqual`. O pr\u00f3prio repo j\u00e1 faz o certo no Intercom. CWE-208, severidade pr\u00e1tica baixa.\n\nIssue: https://github.com/dubinc/dub/issues/4415\n\n---\n\n2. CANAL PRIVADO (autoriza\u00e7\u00e3o / quando em d\u00favida, exploitable)\n\nSaaS multi-tenant (n\u00e3o nomeado) \u2014 1 gap de isolamento entre times em 174 rotas. Sem issue no GitHub. Sem path neste arquivo.\n\nPlane \u2014 3 gaps de autoriza\u00e7\u00e3o object-level em asset amarrado a projeto. Helper j\u00e1 existia no GET vizinho; irm\u00e3os de download/restore/duplicate n\u00e3o chamam. N\u00e3o \u00e9 o CVE-2026-46558 (aquele era cross-workspace).\n\nCanal do SECURITY.md: security@plane.so\nAdvisory conhecido (outro bug, j\u00e1 coordenado): https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx\n\nDetalhe de rota e PoC n\u00e3o entram neste e-mail. Isso vai s\u00f3 no canal privado.\n\n---\n\n3. NADA (invariante manteve \u2014 n\u00e3o ocupa o tracker)\n\naxios \u2014 3/3 adaptadores cobertos. Threat model T-R2 j\u00e1 est\u00e1 no repo.\ngin \u2014 a lib entrega o controle; compliance \u00e9 da app.\nGuzzle \u2014 strip de credencial em cross-origin mantido.\nMedusa \u2014 captura de pagamento idempotente em 4/4 caminhos.\nDocumenso \u2014 acesso a PDF de envelope autorizado em 11/11 rotas.\n\n---\n\nRegra que eu usei: a sess\u00e3o que encontra n\u00e3o \u00e9 a sess\u00e3o que manda o patch. Finding de um lado. Fix de outro.\n\nTiago\n", "creation_timestamp": "2026-09-02T03:20:59.412145Z"}]}