https://vulnerability.circl.lu/sightings/feed 2026-09-17T14:09:32.771023+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ed6ec0d3-53b6-4105-9de7-9535cb39359a/export 2026-09-17T14:09:32.776914+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ed6ec0d3-53b6-4105-9de7-9535cb39359a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54196", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/981aac5c-5075-4d2d-b365-6ed8b27d86d0", "content": "", "creation_timestamp": "2026-09-17T12:00:27.543534Z"} 2026-09-17T12:00:27.543534+00:00 https://vulnerability.circl.lu/sighting/cc55e27e-0e5e-4c93-b8bc-23c16a45410e/export 2026-09-17T14:09:32.778349+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "cc55e27e-0e5e-4c93-b8bc-23c16a45410e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/pphm_HackerNews/3181", "content": "\ud83d\udd34 Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\" according to an advisory released by WSO2 in May 2026. \"Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\"", "creation_timestamp": "2026-09-17T11:00:04.435073Z"} 2026-09-17T11:00:04.435073+00:00 https://vulnerability.circl.lu/sighting/8cf17ed8-5a37-447c-ba2c-f6c25a30453e/export 2026-09-17T14:09:32.778489+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8cf17ed8-5a37-447c-ba2c-f6c25a30453e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f259b169-f7e7-4be8-9dae-1a7a384eba15", "content": "", "creation_timestamp": "2026-09-17T06:01:19.506128Z"} 2026-09-17T06:01:19.506128+00:00 https://vulnerability.circl.lu/sighting/d425bb9c-1fe7-48c5-8e25-ace6322e3d0c/export 2026-09-17T14:09:32.778603+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d425bb9c-1fe7-48c5-8e25-ace6322e3d0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/", "content": "The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data.\n\nThe post Enterprises Warned of Attacks Exploiting WSO2 Vulnerability appeared first on SecurityWeek.", "creation_timestamp": "2026-09-17T01:00:36.494733Z"} 2026-09-17T01:00:36.494733+00:00 https://vulnerability.circl.lu/sighting/8adbb526-6e08-4bfe-b7c6-dce49886123f/export 2026-09-17T14:09:32.778705+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8adbb526-6e08-4bfe-b7c6-dce49886123f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "content": "A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication", "creation_timestamp": "2026-09-17T01:00:36.338385Z"} 2026-09-17T01:00:36.338385+00:00 https://vulnerability.circl.lu/sighting/f4a0409c-8e5d-425e-81a8-5f4fdf0b316a/export 2026-09-17T14:09:32.778812+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f4a0409c-8e5d-425e-81a8-5f4fdf0b316a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/thehackernews/10066", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-17T01:00:04.539372Z"} 2026-09-17T01:00:04.539372+00:00 https://vulnerability.circl.lu/sighting/d3944e15-b652-43fb-bf94-70c7b7cbb177/export 2026-09-17T14:09:32.778909+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d3944e15-b652-43fb-bf94-70c7b7cbb177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/CyberDispatch/2964", "content": "Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.", "creation_timestamp": "2026-09-17T01:00:04.443787Z"} 2026-09-17T01:00:04.443787+00:00 https://vulnerability.circl.lu/sighting/ff95bcf9-9dbd-4637-86b6-96debf9ae60c/export 2026-09-17T14:09:32.779004+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ff95bcf9-9dbd-4637-86b6-96debf9ae60c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/ViralCyber/26273", "content": "\ud83d\udd34\u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0646\u0642\u0635 \u062f\u0648\u0631 \u0632\u062f\u0646 JWT \u062f\u0631 WSO2 API Manager \u0628\u0627 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc watchTowr \u0627\u0632 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 WSO2 API Manager \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-5430 (\u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f8) \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0628\u0631\u0631\u0633\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a JWT \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0628\u0627 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c\u0647\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc\u200c\u0646\u0634\u062f\u0647\u060c \u0627\u062c\u0627\u0632\u0647 \u0639\u0628\u0648\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062a\u0635\u0627\u062d\u0628 \u06a9\u0627\u0645\u0644 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n\n\u0647\u0627\u0646\u06cc\u200c\u067e\u0627\u062a\u200c\u0647\u0627\u06cc watchTowr \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f3 \u0633\u067e\u062a\u0627\u0645\u0628\u0631\u060c \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc JWT \u062c\u0639\u0644\u06cc \u062d\u0627\u0648\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u067e\u06cc\u0634 \u062a\u0639\u0628\u06cc\u0647\u200c\u0634\u062f\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f4.\u06f1.\u06f0 \u062a\u0627 \u06f4.\u06f6.\u06f0 \u0627\u0632 API Manager\u060c API Control Plane\u060c Traffic Manager \u0648 Universal Gateway \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\u0628\u0647 \u06af\u0641\u062a\u0647 \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646\u060c \u0627\u06cc\u0646 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u062a\u0645\u0627\u0645 \u0646\u0642\u0627\u0637 \u067e\u0627\u06cc\u0627\u0646\u06cc \u0628\u06a9\u200c\u0627\u0646\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0645\u0635\u0631\u0641\u200c\u06a9\u0646\u0646\u062f\u0647 \u0648 \u0627\u0633\u0631\u0627\u0631 \u062a\u0645\u0627\u0645 \u0627\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646\u200c\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0645\u06a9\u0627\u0646 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc \u062f\u0631 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u062f\u0627\u062e\u0644\u06cc \u0633\u0627\u0632\u0645\u0627\u0646 \u0631\u0627 \u0628\u062f\u0647\u0646\u062f.\n\n\n\u062c\u0647\u062a \u0645\u0637\u0627\u0644\u0639\u0647 \u06a9\u0627\u0645\u0644 \u062e\u0628\u0631 \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f\n\n\ud83c\udd94 @TakianCo\n\ud83c\uddee\ud83c\uddf7", "creation_timestamp": "2026-09-17T01:00:03.841029Z"} 2026-09-17T01:00:03.841029+00:00 https://vulnerability.circl.lu/sighting/526e3195-1b15-4d7e-9fbb-3fee8d3b21ed/export 2026-09-17T14:09:32.779118+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "526e3195-1b15-4d7e-9fbb-3fee8d3b21ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvo3jewp2k2d", "content": "Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.\u2026\n#hackernews #news", "creation_timestamp": "2026-09-16T21:30:03.120392Z"} 2026-09-16T21:30:03.120392+00:00 https://vulnerability.circl.lu/sighting/a29e519e-dd70-4193-9176-5b3c769a622a/export 2026-09-17T14:09:32.779222+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a29e519e-dd70-4193-9176-5b3c769a622a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjc6tadd2t", "content": "Critical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-16T16:03:54.361331Z"} 2026-09-16T16:03:54.361331+00:00