{"vulnerability": "CVE-2026-8910", "sightings": [{"uuid": "4215c38f-6b22-4fae-8dd1-767a1ef35fdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8910", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mntq4wmvv32k", "content": "CVE-2026-8910 - WP Emoticon Rating\nCVE ID : CVE-2026-8910\n \n Published : June 9, 2026, 5:16 a.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This ...", "creation_timestamp": "2026-06-09T08:00:39.708836Z"}, {"uuid": "700abbdf-177b-4cae-a95e-13056520a201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8910", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mnzthcjos52w", "content": "CVE-2026-8910 wp-emoticon-rating (CVSS Score 6.1) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept #wp-emoticon-rating", "creation_timestamp": "2026-06-11T18:16:06.790137Z"}, {"uuid": "f7bf40ee-9e12-45cd-a857-7b2f5440903e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89102", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/inam7gd3h64pa", "content": "CVE-2026-89102 - OCSP stapling v2 multi accepts non-CA chain certificates as issuers\nCVE ID : CVE-2026-89102\n \n Published : Sept. 27, 2026, 9:22 a.m. | 24\u00a0minutes ago\n \n Description : In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 696...", "creation_timestamp": "2026-09-27T10:30:08.243131Z"}, {"uuid": "537b685c-48b7-469a-bbba-25e3fe831992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89102", "type": "seen", "source": "https://gist.github.com/ichintu/295c47a4fdd1542fe1dda3872969c6bd", "content": "This daily threat intelligence update covers emerging AI security practices and critical software vulnerabilities:\n\n\u2022 **AI Guardrails:** Teams are developing adaptable, general-purpose proxy-layer frameworks to detect LLM threats like prompt injection and jailbreaks. Implementation faces a trade-off between evaluation metrics and documented capabilities, particularly regarding jailbreak detection and language support.\n\n\u2022 **wolfSSL (3 HIGH/8.3 CVEs):** Multiple flaws undermine TLS/DTLS certificate verification and authentication. Issues include ignoring public keys in trusted peer validation (CVE-2026-93302), accepting unsolicited RawPublicKey certificates (CVE-2026-89136), and incorrectly validating OCSP stapling issuers (CVE-2026-89102), all enabling authentication bypasses and certificate forgery.\n\n\u2022 **hMailServer (CRITICAL/9.8):** An Eval Injection vulnerability (CVE-2026-100741) allows unauthenticated remote code execution via JScript event scripting when exploited through specific SMTP/POP3/IMAP login sequences.\n\n\u2022 **Citrix NetScaler:** Two unpatched zero-day RCE flaws are actively exploited in the wild, prompting some administrators to preemptively take affected appliances offline.", "creation_timestamp": "2026-09-27T12:00:40.000000Z"}, {"uuid": "7c52c695-2ecf-4588-a025-00073662c689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89102", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mwr537e44f2u", "content": "New MEDIUM CVE for wolfSSL: CVE-2026-89102\n\nIn wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables\u2026\n\nMore: nvd.nist.gov/vuln/detail/CVE-2026-89102", "creation_timestamp": "2026-09-30T20:01:05.631077Z"}, {"uuid": "f36a5a7c-ae95-4dce-8d34-92c68308db3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89102", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwuzhnyese2m", "content": "\ud83d\udccc CVE-2026-89102 - In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to cer... https://www.cyberhub.blog/cves/CVE-2026-89102", "creation_timestamp": "2026-10-02T09:07:07.193583Z"}, {"uuid": "f5053c64-6f0f-4cd4-83b2-04617f1ff17c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89100", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415364046399533", "content": "CVE-2026-89100 Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 'Generic Errors' setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89100https://www.wordfence.com/threat-intel/vulnerabilities/id/57c64bb5-4849-4166-9792-c079b9cbbc17?source=cvehttps://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/controllers.js#L1https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/utils.js#L1https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/dom-events.js#L1https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/gateways.js#L1https://plugins.trac.wordpress.org/changeset/3726506/woo-stripe-payment/trunk/assets/build/controllers.js#wordpress #paymentplugins #PaymentPluginsforStripeWooCommerce#CVE_2026_89100#bot", "creation_timestamp": "2026-10-10T07:11:13.290004Z"}]}