{"vulnerability": "cve-2026-78265", "sightings": [{"uuid": "67e2b2b8-0a9d-4255-9605-0a22eb5fe449", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78265", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtufu62l7y24", "content": "\ud83d\udd34 CVE-2026-78265 - Critical (9.8)\n\nUnauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78265/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-24T23:00:37.448898Z"}, {"uuid": "95367cd0-0ea0-4608-9e85-26c165bb3222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78265", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtuhit53l42p", "content": "CVE-2026-78265\nVersions of The Events Calendar up to 6.17.2 can be tricked into loading malicious data without requiring any login. This could let an attacker execute commands on your server, potentially stealing data or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-24T23:30:04.389330Z"}, {"uuid": "ec4b0270-0b8b-4482-a080-fdac6a655989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78265", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtujndti2w2p", "content": "\ud83d\udea8 CVE-2026-78265 \u2014 CVSS 9.8 CRITICAL\n\nUnauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78265\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T00:08:22.941005Z"}, {"uuid": "0696620a-cc75-4407-a196-38928af7e657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78265", "type": "published-proof-of-concept", "source": "Telegram/Ks6sPRK7rGEZMA3UBlp7GLmJzLFcjQs_KZ-4Nh0Q9BWMtB8", "content": "", "creation_timestamp": "2026-08-26T00:00:10.789115Z"}, {"uuid": "3ec82247-ccf1-4518-a987-58170fd7f66f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78265", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117153557589549950", "content": "CRITICAL CVE-2026-78265: Nexcess The Events Calendar <=6.17.2 has unauthenticated PHP Object Injection (CWE-502). Full system compromise possible. No patch yet \u2014 remove or disable plugin for now. https://radar.offseq.com/threat/cve-2026-78265-cwe-502-deserialization-of-untrusted-data-in-nexcess-the-events-calendar-3dd3af18547313e0 #OffSeq #WordPress #Infosec #CVE2026_78265", "creation_timestamp": "2026-08-25T01:30:23.819125Z"}, {"uuid": "7250618f-1745-4f47-950b-3a4059248411", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78265", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtuoa225op2n", "content": "Nexcess The Events Calendar <=6.17.2 faces a CRITICAL flaw (CVE-2026-78265) enabling unauthenticated PHP Object Injection. No patch yet \u2014 remove/disable plugin to reduce risk. https://radar.offseq.com/threat/cve-2026-78265-cwe-502-deserialization-of-untrusted-data-in-nexcess-the-events-calendar-3...", "creation_timestamp": "2026-08-25T01:30:25.761931Z"}, {"uuid": "c6666b0f-c49a-4ff7-8d2a-4100a2801805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78265", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23up6tm2d", "content": "Daily IT Security Digest \u2014 2026-08-25\nObject Injection (CVE-2026-78265) \u2014 Full System Compromise\n\nA critical unauthenticated PHP Object Injection vulnerability (CWE-502) exists in Nexcess The Events Calendar WordPress plugin versions up to 6.17.2. This flaw allows full system compromise since PHP", "creation_timestamp": "2026-08-25T05:02:50.424501Z"}, {"uuid": "251ee347-bbe1-4821-977f-0a64872699ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78265", "type": "published-proof-of-concept", "source": "Telegram/Ks6sPRK7rGEZMA3UBlp7GLmJzLFcjQs_KZ-4Nh0Q9BWMtB8", "content": "", "creation_timestamp": "2026-08-25T09:00:04.344205Z"}]}