{"vulnerability": "cve-2026-5524", "sightings": [{"uuid": "d1b13e10-6784-4108-8f32-3b6ad40857eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55247", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muagtjc7tp2e", "content": "CVE-2026-55247 - plone-app-event\nThe calendar import feature in Plone\u2019s event manager (versions before 5.2.4 and 6.0.1) lets a logged\u2011in editor supply specially crafted URLs that can make the server reach\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plone #Python #CVE #infosec", "creation_timestamp": "2026-08-29T17:50:05.596658Z"}, {"uuid": "af30317f-f8d0-4d23-a1f8-6976a26d0cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55248", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muahffpc4j2t", "content": "CVE-2026-55248 - plone.app.portlets\nIf you let users add RSS portlets in Plone versions before 5.0.8, 6.0.4, or 7.0.2, they can supply a very large or malicious feed URL that makes the server download huge amounts of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plone #CVE #infosec", "creation_timestamp": "2026-08-29T18:00:06.051079Z"}, {"uuid": "66204f04-0889-40c4-a195-6c2368149271", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55241", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnsqduoqo2o", "content": "\ud83d\udfe0 CVE-2026-55241 - High (7.5)\n\nCheckmate is an open-source, self-hosted tool designed to track and monitor server hardware, upti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55241/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T08:02:30.635340Z"}, {"uuid": "e18541a4-118c-448c-bd58-727d17b1d482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55249", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moybmxdeit2j", "content": "CVE-2026-55249 - @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String\nCVE ID : CVE-2026-55249\n \n Published : June 23, 2026, 6:33 p.m. | 1\u00a0hour, 10\u00a0minutes ago\n \n Description : @rtk-ai/rtk-rewrite transparently rewrites shell commands exec...", "creation_timestamp": "2026-06-23T20:49:40.723172Z"}, {"uuid": "6f436edf-ef32-45d9-9192-fe874a07b069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55244", "type": "published-proof-of-concept", "source": "https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77", "content": "", "creation_timestamp": "2026-08-20T18:35:06.485154Z"}, {"uuid": "79b86cb0-66eb-402d-8cdd-5da0a4ba7a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55249", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnl5nomc72l", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55249 \u0432 @rtk-ai/rtk-rewrite: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AEF0C20A-FB7C-4FBC-B843-DB2B35CCC1C0", "creation_timestamp": "2026-07-02T08:05:59.588028Z"}, {"uuid": "58a625d1-32e9-4303-8ca7-ed18ea338271", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5524", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116850624546842014", "content": "CVE-2026-5524: Divi Form Builder <=5.1.8 has a CRITICAL file upload vuln (CVSS 9.8). Unauth RCE possible via PHP extensions not blocked by .htaccess, esp. on Nginx. Restrict uploads, monitor for patch. https://radar.offseq.com/threat/cve-2026-5524-cwe-434-unrestricted-upload-of-file--ef397843e92862b0 #OffSeq #WordPress #Infosec #CVE2026_5524", "creation_timestamp": "2026-07-02T13:30:32.505483Z"}, {"uuid": "f55c71f3-0d56-4dd7-b44f-15f253abb59d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5524", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpo5c24aet2x", "content": "Divi Form Builder <=5.1.8 hit by CRITICAL RCE flaw \u2014 unauthenticated attackers can upload executable PHP files due to weak validation. Restrict uploads, monitor for patches. \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-5524-cwe-434-unrestricted-upload-of-file--ef397843e92862b0 #OffSeq #WordPress #S...", "creation_timestamp": "2026-07-02T13:30:34.641050Z"}, {"uuid": "b879054f-9fa6-4ec3-b1bd-53c36013ed46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5524", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mpot3pwt7u2b", "content": "CVE-2026-5524 [CRITICAL] nginx\n\nThe Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in th\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-5524", "creation_timestamp": "2026-07-02T20:00:44.466974Z"}, {"uuid": "2a8f223f-352e-4e74-812b-6ecde720ba65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5524", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mppnlm5eck2m", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5524 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Divi Form Builder: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 WordPress\n\n\n\nhttps://kripta.biz/posts/08F7D531-1ECB-4A9B-A0C6-8E8837A63595", "creation_timestamp": "2026-07-03T03:54:54.211492Z"}, {"uuid": "a363f446-8237-4a3c-bdd0-9835bd651a67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5524", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpriufaj6y2u", "content": "CVE-2026-5524\nThe Divi Form Builder plugin for WordPress allows hackers to upload malicious files to the website, which can be used to take control of the site. This is a serious security risk that affects all versions of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-03T21:35:39.684753Z"}, {"uuid": "258774c9-5c38-42a9-946c-05b0f3d37ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5524", "type": "seen", "source": "https://t.me/GithubRedTeam/91812", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5524-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a caterscam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-04 00:33:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:13.099108Z"}, {"uuid": "fa632800-4766-4fc7-8d35-2dfd85d14287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5524", "type": "seen", "source": "https://t.me/GithubRedTeam/91812", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5524-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a caterscam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-04 00:33:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:21.080316Z"}, {"uuid": "09419477-9ebe-410c-bf15-67c6f8daca88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5524", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91812", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5524-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a caterscam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-04 00:33:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:29.098159Z"}, {"uuid": "efd420a1-d975-4d93-8d52-f28cf014b81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55242", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqp73qubec2v", "content": "\ud83d\udfe0 CVE-2026-55242 - High (8.8)\n\nERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55242/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-15T17:00:42.132480Z"}, {"uuid": "6ae5a88b-9d1a-42c9-b8e7-a9f39d8e943f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55245", "type": "published-proof-of-concept", "source": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc", "content": "", "creation_timestamp": "2026-08-28T20:35:24.670008Z"}, {"uuid": "3522d5f2-e9e8-41da-8ed2-771f88f6009b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55248", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu6ervflz52u", "content": "\ud83d\udea8 CVE-2026-55248 \u2014 CVSS 9.1 CRITICAL\n\nplone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-55248\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-28T22:08:04.451693Z"}, {"uuid": "30e667f7-71b4-44c6-948b-24acffbb37b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55247", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu6ernejp724", "content": "\ud83d\udea8 CVE-2026-55247 \u2014 CVSS 9.1 CRITICAL\n\nplone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-55247\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-28T22:07:55.917911Z"}, {"uuid": "1d9284d6-ad2b-47bf-bfde-c6dbaa923dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55247", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mu62tjrvqz2v", "content": "plone.app.event CVE-2026-55247 is rated critical: a logged-in editor's iCalendar import can take the site offline, make the server read calendar files off disk and reach internal hosts (SSRF). Patched in 6.0.1 for Plone 6.2, 5.2.4 for 6.1 and 6.0. #dev", "creation_timestamp": "2026-08-28T19:10:03.910044Z"}, {"uuid": "bb9ca982-637a-46c2-9a96-b8cfeab6ee67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55247", "type": "seen", "source": "https://gist.github.com/alon710/0c57b295c1c8fe9eb4b1e012f4bf501d", "content": "# CVE-2026-55247: CVE-2026-55247: Multiple Vulnerabilities (DoS, SSRF, and Stored XSS) in plone.app.event iCalendar Import\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55247\n\n## Summary\nA critical security vulnerability exists in plone.app.event, the event content type package for the Plone CMS. Prior to versions 5.2.4 and 6.0.1, the iCalendar import component lacked proper file size controls, URL scheme validation, and network isolation filters. Authenticated editors could exploit these deficiencies to cause denial of service via memory exhaustion, read local files, perform server-side request forgery, and inject stored cross-site scripting vectors.\n\n## TL;DR\nPlone's event importer failed to validate input sizes and URL protocols, enabling authenticated users to trigger Denial of Service, execute Server-Side Request Forgery, and inject Stored XSS.\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption)\n- **Attack Vector**: Network\n- **CVSS Score**: 9.1 (Critical)\n- **Impact**: Denial of Service, SSRF, Stored XSS\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n- **Access Required**: Low Privilege (Authenticated Editor)\n\n## Affected Systems\n\n- Plone CMS (via plone.app.event)\n- **plone.app.event**: < 5.2.4 (Fixed in: `5.2.4`)\n- **plone.app.event**: >= 6.0.0, < 6.0.1 (Fixed in: `6.0.1`)\n\n## Mitigation\n\n- Update plone.app.event to patched versions (5.2.4 or 6.0.1)\n- Restrict event creation and import privileges to highly trusted users\n- Configure system-level network firewalls to block outgoing traffic from the Plone application to local and private IP spaces\n- Implement a reverse proxy or WAF to filter malicious request patterns\n\n**Remediation Steps:**\n1. Identify current installed version of plone.app.event using buildout or pip.\n2. Update requirements file to specify plone.app.event>=5.2.4 for Plone 5.x, or plone.app.event>=6.0.1 for Plone 6.x.\n3. Run the buildout or pip installation command to fetch and install the updated package.\n4. Restart the Plone/Zope instances to apply changes in a staging environment.\n5. Verify functionality by attempting to import a normal iCalendar file and ensuring unauthorized protocols are rejected.\n6. Deploy the updated build to production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-r82h-mqw3-fc56](https://github.com/plone/plone.app.event/security/advisories/GHSA-r82h-mqw3-fc56)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55247) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T19:31:37.010879Z"}, {"uuid": "d04485bc-8415-4466-a745-8a851097881f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55248", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mucag72w252b", "content": "\ud83d\udd34 CVE-2026-55248 - Critical (9.1)\n\nplone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55248/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-30T11:00:36.479742Z"}, {"uuid": "6bbb721d-c636-4fea-bf48-23435b2b9feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55247", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muckkq72fz22", "content": "\ud83d\udd34 CVE-2026-55247 - Critical (9.1)\n\nplone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55247/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-30T14:02:06.610700Z"}]}