{"vulnerability": "CVE-2026-8886", "sightings": [{"uuid": "e24ddad3-14b7-48b3-bc8b-0950e4f6e696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88864", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv66hk7skw2p", "content": "CVE-2026-88864 - capgo.app\nCapgo\u2019s public interface lets anyone with a standard access code add a record that tells the system a domain uses single sign\u2011on, even though the domain has not been verified. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#capgoapp #capgo #CVE #infosec", "creation_timestamp": "2026-09-10T13:40:06.503297Z"}, {"uuid": "1bc1395e-2f01-4385-b69d-25f8ceb547fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88869", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv66zfdl5t2t", "content": "CVE-2026-88869 - avideo\nThe AVideo software\u2019s AD_Server add\u2011on stores a piece of data called a label without cleaning it first. If someone supplies malicious code in that label, it will be shown later in the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-10T13:50:05.233512Z"}, {"uuid": "ddfed3ae-7e1e-40cc-9d03-898a1690ff87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88866", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpesrgf2y", "content": "\ud83d\udea8 CVE-2026-88866 \u2014 CVSS 9.3 CRITICAL\n\nWWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88866\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T16:07:38.781623Z"}, {"uuid": "7939244b-5d77-4cfd-b9c8-6e3dc9ec2ec9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88866", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6bayo5gl2t", "content": "CVE-2026-88866 - avideo\nThe AVideo system stores the browser information you send when you log in, but it does not clean it properly. A user who can log in could put harmful code into that information, and when\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-10T14:30:07.753617Z"}, {"uuid": "e4c8dd21-553f-44e9-a678-e6bfbe499d7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88867", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpnjiyh22", "content": "\ud83d\udea8 CVE-2026-88867 \u2014 CVSS 9.3 CRITICAL\n\nWWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a st...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88867\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T16:07:47.950899Z"}, {"uuid": "10b2d6ef-e557-4aa9-8873-97124b07f94c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88860", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6bavqhlm22", "content": "CVE-2026-88860 - capgo.app\nWhen a user\u2019s organization role is removed, Capgo does not delete the extra channel permissions that were granted to them. This means the user can still act on those channels, such\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#capgoapp #capgo #CVE #infosec", "creation_timestamp": "2026-09-10T14:30:04.725400Z"}, {"uuid": "f9eb3332-c441-4e9c-a739-2a869e08236b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88867", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6bsrhhbr2y", "content": "CVE-2026-88867 - avideo\nIn AVideo, any logged\u2011in user who can upload can create a video category with a name or icon that contains hidden code. That code runs in the browser of anyone who later views a page\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-10T14:40:04.311051Z"}, {"uuid": "2c4c1c93-d47c-4d90-a19a-6bfcb95cc6b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88868", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6bstzdrx2b", "content": "CVE-2026-88868 - avideo\nThe LiveLinks feature in AVideo does not clean up the text entered for titles and descriptions. This means someone with streaming rights could add hidden code that runs on every page\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-10T14:40:07.017052Z"}, {"uuid": "bdb6da03-53fe-4bd6-8a2e-68a4880c741b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88868", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpws3p425", "content": "\ud83d\udea8 CVE-2026-88868 \u2014 CVSS 9.3 CRITICAL\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulne...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88868\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T16:07:58.106757Z"}, {"uuid": "71776686-dfbf-42a3-9969-45bd5b306179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88860", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6gotlnd722", "content": "\ud83d\udea8 CVE-2026-88860 \u2014 CVSS 9.3 CRITICAL\n\nCapgo fails to clean up channel permission overrides when a user's last organization role binding is delete...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88860\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T16:07:21.766760Z"}, {"uuid": "882b4f45-cc8e-420c-960a-3ec9d99dd301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88864", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6gp44tk22t", "content": "\ud83d\udea8 CVE-2026-88864 \u2014 CVSS 9.3 CRITICAL\n\nCapgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through S...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88864\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T16:07:29.679946Z"}, {"uuid": "8404c661-2ab0-456c-a9dc-7a7671718e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88869", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6gqat32v2y", "content": "\ud83d\udea8 CVE-2026-88869 \u2014 CVSS 9.3 CRITICAL\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulne...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88869\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T16:08:08.551610Z"}, {"uuid": "156e0571-ab71-4c29-b386-2e703dd9bb15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88862", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvcbroayk42y", "content": "CVE-2026-88862 - capgo.app\nCapgo's backend does not properly check a special header, so a user who has a limited API key can tell the system to use the ID of a more powerful key that belongs to the same\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#capgoapp #capgo #CVE #infosec", "creation_timestamp": "2026-09-12T04:50:06.422875Z"}, {"uuid": "99a2fd60-0564-4f36-ab32-ab784bc79728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88861", "type": "seen", "source": "Telegram/0phjcISM7xaEvPyzzbSiHps9Ynh5NA4Z3_XacHD49buP-a4", "content": "", "creation_timestamp": "2026-09-14T03:00:15.091953Z"}, {"uuid": "fbe1fb6c-3c1d-4224-899d-b46c1d07e1cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88861", "type": "published-proof-of-concept", "source": "Telegram/0phjcISM7xaEvPyzzbSiHps9Ynh5NA4Z3_XacHD49buP-a4", "content": "", "creation_timestamp": "2026-09-15T00:00:21.416941Z"}]}