{"vulnerability": "CVE-2026-84741", "sightings": [{"uuid": "21190b96-3b34-4c3b-ab60-6a0ac521c3c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84741", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwblotvh452u", "content": "CVE-2026-84741: broken access control in The Events Calendar WordPress plugin (600k+ installs) exposing non-public venue and organizer data via REST API, CVSS 5.3. A researcher shares the process: weeks of dead ends, duplicate rejections, and a false positive first.", "creation_timestamp": "2026-09-24T15:42:44.976361Z"}]}