{"vulnerability": "CVE-2026-7998", "sightings": [{"uuid": "d3f6f567-d763-4440-bd35-f4c999404505", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79988", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muaaot76bt2m", "content": "CVE-2026-79988\nIf someone can log into your Craft CMS site, they could make the system run their own commands, potentially taking control of the server. This happens because a safety feature meant to block risky actions is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-29T16:00:12.331395Z"}, {"uuid": "5ece4fa9-93db-47c5-80ca-8617e8f6f678", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7998", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260507", "content": "", "creation_timestamp": "2026-05-06T18:00:00.000000Z"}, {"uuid": "b9f204aa-9c66-44f0-8794-a04bb298c84e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79989", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mulnldoai725", "content": "CVE-2026-79989 - cms\nThis vulnerability in Craft CMS allows any authenticated user to change their own password without needing to know their current password. Additionally, users with permission to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cms #craftcms #composer #CVE #infosec", "creation_timestamp": "2026-09-03T04:50:05.034412Z"}, {"uuid": "011a78f6-6c82-48a8-ad6a-275b45ab86d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79988", "type": "seen", "source": "https://bsky.app/profile/fortrabbit.com/post/3muwwfckc672y", "content": "Patch week. Craft CMS: two authenticated RCEs, CVE-2026-78416 and CVE-2026-79988, fixed in 5.10.14 and 4.18.7. Phalcon: critical Volt injection, fixed in 5.16.0. Winter CMS: six advisories, fixed in 1.2.14. github.com/advisories?q...", "creation_timestamp": "2026-09-07T16:27:03.816873Z"}, {"uuid": "2787c369-a676-4845-bcb5-7555c1a69baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79987", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7336jpbf7nxhm", "content": "CVE-2026-79987 - Low-privilege RCE through element-search eager loading\nCVE ID : CVE-2026-79987\n \n Published : Sept. 10, 2026, 4:05 p.m. | 23\u00a0minutes ago\n \n Description : A remote, authenticated, non-admin Craft CMS Control Panel user with only the\u00a0accessCp\u00a0permission can exec...", "creation_timestamp": "2026-09-10T17:30:55.433739Z"}, {"uuid": "ecc57ab4-0a44-44b0-a689-d9ad68d487dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79987", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mv6wvho74f2b", "content": "Craft CMS Control Panel\u306b\u304a\u3044\u3066\u3001`accessCp`\u6a29\u9650\u3092\u6301\u3064\u8a8d\u8a3c\u6e08\u307f\u975e\u7ba1\u7406\u8005\u30e6\u30fc\u30b6\u30fc\u306f\u3001PHP\u30a6\u30a7\u30d6\u30ef\u30fc\u30ab\u30fc\u3068\u3057\u3066OS\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u8106\u5f31\u6027\u304c\u3042\u308a\u307e\u3059\u3002\nCVE-2026-79987 CVSS 8.8 | HIGH", "creation_timestamp": "2026-09-10T20:57:23.284406Z"}, {"uuid": "441d55c0-b13a-442c-8e7c-1fe5a7ff03d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79987", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv7u46jqdt2b", "content": "CVE-2026-79987 - cms\nA user who only has basic control\u2011panel access in Craft CMS can cause the web server to execute operating\u2011system commands. This could let an insider or compromised account perform actions\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cms #craftcms #CVE #infosec", "creation_timestamp": "2026-09-11T05:40:07.484697Z"}]}