https://vulnerability.circl.lu/sightings/feed 2026-09-08T08:51:43.926056+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fb1664b4-14ef-4601-9802-04a86f3943c1/export 2026-09-08T08:51:43.953499+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "fb1664b4-14ef-4601-9802-04a86f3943c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33016", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/45642", "content": "\ud83d\udc30 BugBunny AI \u2014 tested it. Actually insane.\n\nAutonomous AI agents that run full pentests \u2014 recon, exploitation, PoC validation \u2014 zero human input.\n\nWhat it does:\n\u2705 Maps your full attack surface\n\u2705 Finds SQLi, XSS, RCE, SSRF, IDOR, Auth Bypass & more\n\u2705 Validates every finding with a working exploit (no false positives)\n\u2705 Generates audit-ready reports with CVSS scores\n\u2705 Reviews Pull Requests & suggests inline fixes\n\nReal CVEs dropped:\n\ud83d\udd34 CVE-2026-33016 \u2014 ShareX RCE\n\ud83d\udd34 CVE-2025-61622 \u2014 Apache Fory Python RCE \u00b7 9.8\n\ud83d\udd34 CVE-2025-58434 \u2014 Flowise.ai Full ATO \u00b7 9.8\n\ud83d\udd34 CVE-2026-27471 \u2014 ERPNext Unauth Data Access \u00b7 9.1\n\ud83d\udd34 CVE-2026-22807 \u2014 vLLM RCE \u00b7 8.8\n\ud83d\udd34 CVE-2025-59057 \u2014 React Router Stored XSS \u00b7 7.6\n\nAlso found 5 RCEs in Google Gemini CLI accepted by Google VRP.\nTargets hit: Google, Meta, Microsoft, Apache, ClickHouse & more.\n\n\ud83d\udc49 https://bugbunny.ai", "creation_timestamp": "2026-09-03T00:00:48.450858Z"} 2026-09-03T00:00:48.450858+00:00 https://vulnerability.circl.lu/sighting/82980f5a-dc3b-4d06-8169-7b1edbd54883/export 2026-09-08T08:51:43.956828+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "82980f5a-dc3b-4d06-8169-7b1edbd54883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33016", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/45642", "content": "\ud83d\udc30 BugBunny AI \u2014 tested it. Actually insane.\n\nAutonomous AI agents that run full pentests \u2014 recon, exploitation, PoC validation \u2014 zero human input.\n\nWhat it does:\n\u2705 Maps your full attack surface\n\u2705 Finds SQLi, XSS, RCE, SSRF, IDOR, Auth Bypass & more\n\u2705 Validates every finding with a working exploit (no false positives)\n\u2705 Generates audit-ready reports with CVSS scores\n\u2705 Reviews Pull Requests & suggests inline fixes\n\nReal CVEs dropped:\n\ud83d\udd34 CVE-2026-33016 \u2014 ShareX RCE\n\ud83d\udd34 CVE-2025-61622 \u2014 Apache Fory Python RCE \u00b7 9.8\n\ud83d\udd34 CVE-2025-58434 \u2014 Flowise.ai Full ATO \u00b7 9.8\n\ud83d\udd34 CVE-2026-27471 \u2014 ERPNext Unauth Data Access \u00b7 9.1\n\ud83d\udd34 CVE-2026-22807 \u2014 vLLM RCE \u00b7 8.8\n\ud83d\udd34 CVE-2025-59057 \u2014 React Router Stored XSS \u00b7 7.6\n\nAlso found 5 RCEs in Google Gemini CLI accepted by Google VRP.\nTargets hit: Google, Meta, Microsoft, Apache, ClickHouse & more.\n\n\ud83d\udc49 https://bugbunny.ai", "creation_timestamp": "2026-09-02T06:00:13.683691Z"} 2026-09-02T06:00:13.683691+00:00