{"vulnerability": "cve-2026-1491", "sightings": [{"uuid": "ea333326-cda7-4394-afda-1fb60fde3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14919", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrxgjgetfu2a", "content": "CVE-2026-14919 - shopmonitor.io\nThe ShopMonitor.io WordPress plugin allows attackers to redirect emails, including password reset emails, to an address they control. This can lead to unauthorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#shopmonitorio #unknown #CVE #infosec", "creation_timestamp": "2026-07-31T17:00:06.166796Z"}, {"uuid": "8da0b512-4ffe-4d3f-ab9b-02e8e63d1369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14917", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvmwo2xzak22", "content": "Kong's API gateway has a SAML single sign-on bypass (CVE-2026-14917). With assertion-signature checks turned off, it could accept a forged, unsigned login and impersonate any user, admins included.\n\nOnly affects gateways with that flag off.\n\nFix: patch and audit the config.", "creation_timestamp": "2026-09-16T10:30:31.897232Z"}, {"uuid": "dd6bf2f9-3bd6-4687-9bfd-baa2cf9e508b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14913", "type": "seen", "source": "https://gist.github.com/ichintu/2e6f8ce728dea0dd9cf4a6348df184a8", "content": "**September 22\u201323, 2026 Cyber Threat Intelligence Summary**\n\n**\ud83d\udd34 Critical Vulnerabilities & Patches**\nUrgent updates required for **WordPress** (AV26-952) and **SolarWinds** (AV26-950) due to actively exploited, unauthenticated RCEs. **HPE** (AV26-951) patches DoS and multiple flaws in ALE and Telco Orchestrator. Other notable advisories include a cPanel root-escalation bug, ManageEngine SQLi (CVE-2026-14913), Tauri v2 CSP bypass (CVE-2026-95626), Chrome 154 (108 patches, 11 critical), and an unpatched Ubuntu kernel flaw (CVE-2026-80521) enabling container escape to host root.\n\n**\ud83e\udda0 Emerging Threats & Malware**\n- **CLOSEDQUORUM:** Windows malware using AI model voting for C2 to steal credentials and crypto wallets.\n- **MemTensor Compromise:** Legitimate npm/PyPI packages hijacked to distribute the cross-platform `sckit` credential stealer.\n- **Android MDM Spyware:** Targeting logistics companies via corporate mobile device management systems.\n\n**\ud83d\udd17 Supply Chain & Operational Risks**\n- **GitHub App Keys:** Private keys never expire, creating persistent takeover risks. GitGuardian identified 474 active leaked keys, many with admin/write privileges.\n- **MSP Relationships:** Heavily trust-based MSP contracts are flagged as a major supply chain vector. Experts recommend enforcing dedicated admin accounts, phishing-resistant MFA, full audit logging, and strict offboarding/breach protocols.\n\n**\ud83d\udcf1 Platform Updates**\n- **Android 17:** Enables Certificate Transparency, which will break trust in custom/internal CAs and require PKI adjustments.\n\n**\u2705 Key Actions:** Immediately patch affected software, revoke unused GitHub App keys, audit MSP security controls, and prepare for Android 17 CA changes.", "creation_timestamp": "2026-09-23T16:01:57.007519Z"}, {"uuid": "6fef19b2-614a-4bb7-8cbe-82afbd7381f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14913", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mw77fo4apb2e", "content": "Zoho ManageEngine OpManager/Firewall Analyzer 12.8.669\u4ee5\u524d\u306f\u3001\u30eb\u30fc\u30eb\u7ba1\u7406\u691c\u7d22\u30ec\u30dd\u30fc\u30c8\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u653b\u6483\u8005\u306f\u6a5f\u5bc6\u60c5\u5831\u3078\u306e\u30a2\u2026\nCVE-2026-14913 CVSS 8.8 | HIGH", "creation_timestamp": "2026-09-23T16:54:48.179980Z"}, {"uuid": "2e4b1370-a572-4dc8-a78f-6815bab9eabe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14911", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxb32r4ipy22", "content": "\ud83d\udea8 CVE-2026-14911 \u2014 CVSS 9.3 CRITICAL\n\nImproper Neutralization of Input During Web Page Generation (\u201cCross-site Scripting\u201d) in ASUS router modules...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-14911\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-07T04:07:38.379118Z"}, {"uuid": "b6488e65-f8a1-4145-924f-85f6b0c6af93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14911", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117398098681807664", "content": "ASUS Router XSS (CVE-2026-14911, CRITICAL, CVSS 9.3): Remote attackers can exploit improper input neutralization to execute scripts, alter settings, or cause DoS if visited by authenticated users. No patch yet. Details: https://radar.offseq.com/threat/cve-2026-14911-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-81fca42ab40cabc9 #OffSeq #XSS #Cybersecurity", "creation_timestamp": "2026-10-07T06:00:24.781831Z"}, {"uuid": "11576d29-1d2d-4bc4-854a-8bc01704e8ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14911", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxbbehdebr2l", "content": "ASUS Routers face a CRITICAL XSS flaw (CVE-2026-14911, CVSS 9.3). Exploitable via crafted URLs \u2014 attackers can change settings or cause DoS. No patch yet; avoid untrusted links while authenticated. https://radar.offseq.com/threat/cve-2026-14911-cwe-79-improper-neutralization-of-input-during-web-p...", "creation_timestamp": "2026-10-07T06:00:26.999799Z"}, {"uuid": "d1730d5d-5f44-4676-a6be-30bad38dd4ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-14911", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-asus-2", "content": "", "creation_timestamp": "2026-10-07T00:27:48.000000Z"}, {"uuid": "bf84b785-c541-417d-8d6b-7af4b194a2bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14911", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxczrukyup2x", "content": "CVE-2026-14911 - router\nThe web interface of certain ASUS router models does not properly filter malicious code in web pages. An attacker who sends a specially crafted URL can make an authenticated user\u2019s\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#router #asus #CVE #infosec", "creation_timestamp": "2026-10-07T22:50:06.448668Z"}]}