{"vulnerability": "cve-2026-10586", "sightings": [{"uuid": "5d323a04-6b74-4c78-861e-e0311120e435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10586", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mniyhk3bqm2d", "content": "HIGH severity SSRF in Gutenberg Essential Blocks (WordPress plugin) lets Authors+ send arbitrary server requests. No patch yet \u2014 restrict Author access & monitor activity. https://radar.offseq.com/threat/cve-2026-10586-cwe-918-server-side-request-forgery-f1206b69 #OffSeq #WordPress #SSRF", "creation_timestamp": "2026-06-05T01:30:28.744138Z"}, {"uuid": "4244681f-08ee-4b77-9640-b485285c6212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10586", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116694910594929909", "content": "\u26a0\ufe0f CVE-2026-10586: HIGH severity SSRF in Gutenberg Essential Blocks for WordPress (\u22646.1.3). Authors+ can send arbitrary server requests via save_ai_generated_image(). No patch yet \u2014 restrict access & monitor. https://radar.offseq.com/threat/cve-2026-10586-cwe-918-server-side-request-forgery-f1206b69 #OffSeq #WordPress #SSRF", "creation_timestamp": "2026-06-05T01:30:40.994823Z"}, {"uuid": "587c84e6-830a-4859-b938-a3d787f8d28c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10586", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnjhjxnha72r", "content": "Gutenberg Essential Blocks lets authenticated users make arbitrary web requests from your server. SSRF at 7.2/10 (CVE-2026-10586). They grab wp-config, internal APIs, cloud metadata. Update to 6.1.3 now. Scan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "creation_timestamp": "2026-06-05T06:00:15.181956Z"}, {"uuid": "d11198bf-ee05-4150-b1cc-c74c16e5756f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10586", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3moejgwkx2q2e", "content": "CVE-2026-10586 essential-blocks (CVSS Score 7.2) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-06-16T00:16:14.210923Z"}, {"uuid": "582950a3-f833-42cb-9d92-b40aec4405f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105862", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx7x4stfmy2n", "content": "\ud83d\udfe0 CVE-2026-105862 - High (8.7)\n\nPayload is a free and open source headless content management system. In versions before 3.90.0 a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105862/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T17:24:33.053753Z"}, {"uuid": "5bdfd08f-ae56-4675-9e0b-6165855ce403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105865", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx7ximjgig2y", "content": "\ud83d\udfe0 CVE-2026-105865 - High (8.1)\n\nPayload is a free and open source headless content management system. In versions before 3.90.0 a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105865/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T17:31:09.374329Z"}, {"uuid": "51da0b58-db45-4dc7-b247-17e5c8dbbb79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105863", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zlzpe2x27", "content": "\ud83d\udea8 CVE-2026-105863 \u2014 CVSS 9.2 CRITICAL\n\nPayload is a free and open source headless content management system. In versions after 3.0.0 and before 3....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105863\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:08:50.962264Z"}, {"uuid": "882a8f61-21a0-4ca9-abb3-58d6af52e469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105862", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ccltxwsrgywol", "content": "CVE-2026-105862 - Payload: Bypassed sanitization of user uploaded SVGs\nCVE ID : CVE-2026-105862\n \n Published : Oct. 6, 2026, 4:37 p.m. | 50\u00a0minutes ago\n \n Description : Payload is a free and open source headless content management system. In versions before 3.90.0 and canary v...", "creation_timestamp": "2026-10-06T18:14:46.319482Z"}, {"uuid": "3a89065c-75a3-4508-9d1f-da5a9e830e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105865", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2ymgr62znmayp", "content": "CVE-2026-105865 - Payload: Incomplete validation during the upload file lifecycle\nCVE ID : CVE-2026-105865\n \n Published : Oct. 6, 2026, 4:45 p.m. | 43\u00a0minutes ago\n \n Description : Payload is a free and open source headless content management system. In versions before 3.90.0 a...", "creation_timestamp": "2026-10-06T18:16:45.860822Z"}, {"uuid": "6e195af8-400e-4d88-bf40-1474c3412d3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105863", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbo72ux7v2w", "content": "CVE-2026-105863\nVersions of the free Payload content system from 3.0.0 up to but not including 3.90.0 can insert unexpected information into the authentication token that is created when users log in. This could allow users\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-07T09:50:04.194369Z"}, {"uuid": "fe4b0b6b-824f-4a68-95a2-4d3cbbe55af1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105868", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbo74iziz27", "content": "CVE-2026-105868\nIf you use Payload's content system version earlier than 3.90.0 (or the early 4.0.0\u2011canary builds), an attacker could upload an XML file that includes a stylesheet causing JavaScript to run in the same browser\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-07T09:50:05.747726Z"}]}