CVE-2026-8739

Overview

Sanluan
PublicCMS

17 May 2026

Published

17 May 2026

Updated

CVSS v4.0

MEDIUM (6.9)

EPSS

0.03%

MITRE

KEV

Description

A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key . The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

1 Post

Last activity: 11 hours ago

Fediverse

OffSequence @offseq

🔒 MEDIUM severity: Sanluan PublicCMS 5.202506.d suffers from a hard-coded cryptographic key (CVE-2026-8739), enabling remote exploitation. No patch yet — restrict access, monitor for updates. Exploit code public. https://radar.offseq.com/threat/cve-2026-8739-use-of-hard-coded-cryptographic-key--58e8ec15 #OffSeq #Vuln #PublicCMS

0
0
0
11h ago

CVE-2026-8719

Overview

tigroumeow
AI Engine – The Chatbot, AI Framework & MCP for WordPress

17 May 2026

Published

17 May 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

0.04%

MITRE

KEV

Description

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.

Statistics

1 Post

Last activity: 10 hours ago

Fediverse

OffSequence @offseq

⚠️ CVE-2026-8719 (HIGH, CVSS 8.8): AI Engine for WordPress v3.4.9 lets any OAuth token holder with Subscriber+ escalate to admin via MCP tools. Restrict OAuth, monitor for fixes. https://radar.offseq.com/threat/cve-2026-8719-cwe-269-improper-privilege-managemen-4682432a #OffSeq #WordPress #Vuln #PrivilegeEscalation

0
0
0
10h ago

CVE-2026-46300

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

2 Posts
9 Interactions

Last activity: 9 hours ago

Fediverse

Christoph Schmees @PC_Fluesterer

Ist die Aufregung um die neuen Linux-Fehler berechtigt?

Radio Eriwan antwortet: Das kommt darauf an. Nämlich darauf, ob wir von einem Arbeitsplatz-Rechner reden oder von einem Server. Arbeitsplatz-Rechner sind nicht betroffen. - Die Rede ist von drei neu entdeckten Sicherheitslücken im Linux-Kernel:

CVE-2026-43284 ("Dirty Frag")*,
CVE-2026-43500 ("Copy Fail 2") und
CVE-2026-46300 ("Fragnesia").

Die stecken in Server-Funktionen für VPN-Zugriff über IPSec und für das verteilte Dateisystem AFS. Sie ermöglichen eine lokale Privilegien-Eskalation (LPE).

Um eine LPE Sicherheitslücke auszunutzen, muss ein/e Benutzer/in angemeldet sein, also entweder am Terminal vorm Rechner sitzen, oder eher

https://www.pc-fluesterer.info/wordpress/2026/05/17/ist-die-aufregung-um-die-neuen-linux-fehler-berechtigt/

#Allgemein #Hintergrund #cybercrime #exploits #linux #sicherheit #wissen

6
3
0
13h ago

Sourceware @sourceware

To make sure the latest linux kernel security issues (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-46333) are properly patched we have rebooted various systems (again).

Specifically you might have seen interruptions for starfive-{1-4}, debian-i386, debian-i386-2, debian-armhf, snapshots, osuosl-arm64, osuosl-arm64-2, sw3bb1, sw3bb2, sw3runner1, sw3runner2, sourceware-builder3, rh-ospo-sourceware01, forge and forge-stage.

0
0
0
9h ago