{"vulnerability": "CVE-2026-87911", "sightings": [{"uuid": "772d1a0b-0280-4735-a7bd-ac1656037c2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87911", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4gnlpu7723", "content": "\ud83d\udd34 CVE-2026-87911 - Critical (9.6)\n\nAn OS command injection weakness in the read-only enforcement of the SQL validation component in ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-87911/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-09T21:01:20.914402Z"}, {"uuid": "ab04d177-2976-4815-947c-82f1ba4408c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87911", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fesvv2zo64rnp", "content": "CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server\nCVE ID : CVE-2026-87911\n \n Published : Sept. 9, 2026, 8:21 p.m. | 38\u00a0minutes ago\n \n Description : An OS command injec...", "creation_timestamp": "2026-09-09T21:05:52.199312Z"}, {"uuid": "97a42590-43dc-4350-9970-3d1cebc472b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87911", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv4nttvkrj2g", "content": "CVE-2026-87911 - aws labs postgres mcp server\nThe PostgreSQL management component can be tricked into running system commands when a specially crafted request is processed. This could let an attacker control the server\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#aws #CVE #infosec", "creation_timestamp": "2026-09-09T23:10:05.559879Z"}, {"uuid": "881f42b9-11a3-40ce-bb34-c8bd2d3cfc66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-87911", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mv5ermslaz2f", "content": "CRITICAL: AWS Labs postgres MCP Server (<1.1.7) hit by OS command injection (CVE-2026-87911) \ud83d\udea8. Unauthenticated attackers can execute OS commands. Upgrade to v1.1.7+ now. https://radar.offseq.com/threat/cve-2026-87911-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-com...", "creation_timestamp": "2026-09-10T06:00:28.372809Z"}, {"uuid": "481e3c1e-901f-43df-914c-8705c6a06ff6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-87911", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117245216364198610", "content": "CVE-2026-87911 (CVSS 9.6): CRITICAL OS command injection in AWS Labs postgres MCP Server (<1.1.7). Unauthenticated attackers can execute OS commands via crafted SQL. Upgrade to 1.1.7+ ASAP. https://radar.offseq.com/threat/cve-2026-87911-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-5896283731c57124 #OffSeq #AWS #PostgreSQL #Vuln", "creation_timestamp": "2026-09-10T06:00:35.828500Z"}, {"uuid": "3a401e97-c397-41bb-91e3-d8679ebfa7e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87911", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n  zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n  live-target evidence per report.\n\n\n{\n  \"date\": \"2026-09-15\",\n  \"count\": 3,\n  \"redacted\": true,\n  \"items\": [\n    {\n      \"cve\": \"CVE-2026-81648\",\n      \"cvss\": 10.0,\n      \"published\": \"2026-09-13T21:17:01.930\",\n      \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90519\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:27.697\",\n      \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90520\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:28.760\",\n      \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    }\n  ]\n}", "creation_timestamp": "2026-09-15T16:01:41.328619Z"}]}