https://vulnerability.circl.lu/sightings/feed 2026-08-01T21:06:39.308953+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c7c69958-544a-4f48-be5b-6f2248f16a4a/export 2026-08-01T21:06:39.332607+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c7c69958-544a-4f48-be5b-6f2248f16a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-54725", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrxowcc2lk2h", "content": "CRITICAL SSRF (CVE-2026-54725) in bank-vaults vault-secrets-webhook lets attackers steal ServiceAccount JWTs. Upgrade to 1.23.1 ASAP. \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-54725-cwe-918-server-side-request-forgery-ssrf-in-bank-vaults-vault-secrets-webhook-ec0efb4a3e2ca6ff #OffSeq #Kubernetes...", "creation_timestamp": "2026-07-31T19:30:28.573537Z"} 2026-07-31T19:30:28.573537+00:00 https://vulnerability.circl.lu/sighting/fc424d8a-8653-4530-8d62-285ae473bfc9/export 2026-08-01T21:06:39.335469+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "fc424d8a-8653-4530-8d62-285ae473bfc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54725", "type": "published-proof-of-concept", "source": "https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm", "content": "", "creation_timestamp": "2026-07-31T18:35:03.821931Z"} 2026-07-31T18:35:03.821931+00:00 https://vulnerability.circl.lu/sighting/ec207915-c7d6-42ef-b933-3d885a95051c/export 2026-08-01T21:06:39.336844+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ec207915-c7d6-42ef-b933-3d885a95051c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54725", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrxlgcrm3u2i", "content": "A critical flaw in bank-vaults' Kubernetes secret injector, vault-secrets-webhook (CVSS 9.6), lets anyone who can create a ConfigMap steal ServiceAccount tokens and read HashiCorp Vault secrets.\n\nAffects versions up to 1.22.2.\n\nFix: upgrade to 1.23.1. (CVE-2026-54725)", "creation_timestamp": "2026-07-31T18:27:51.544574Z"} 2026-07-31T18:27:51.544574+00:00 https://vulnerability.circl.lu/sighting/dff6ca37-90bf-4e55-be54-99db7aab4576/export 2026-08-01T21:06:39.336925+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dff6ca37-90bf-4e55-be54-99db7aab4576", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54725", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrxjr42xr42o", "content": "CVE-2026-54725 - bank-vaults\nAn attacker can create ConfigMaps or Secrets that cause the Vault webhook to make arbitrary outbound HTTP connections, potentially exfiltrating ServiceAccount JWTs. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bankvaults #Golang #CVE #infosec", "creation_timestamp": "2026-07-31T17:58:05.079072Z"} 2026-07-31T17:58:05.079072+00:00