https://vulnerability.circl.lu/sightings/feed 2026-09-16T21:00:18.639509+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/50d950f8-e764-42af-933b-eb0b063097cc/export 2026-09-16T21:00:18.672217+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "50d950f8-e764-42af-933b-eb0b063097cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:09.528839Z"} 2026-09-16T10:00:09.528839+00:00 https://vulnerability.circl.lu/sighting/e6838c67-3b22-4e37-bf91-68ced65333df/export 2026-09-16T21:00:18.675162+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e6838c67-3b22-4e37-bf91-68ced65333df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:10.147390Z"} 2026-09-09T10:00:10.147390+00:00 https://vulnerability.circl.lu/sighting/4898beef-8c16-46f6-9c5f-840ee7fcd724/export 2026-09-16T21:00:18.675299+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4898beef-8c16-46f6-9c5f-840ee7fcd724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated\\n attacker can leverage this to access the REST API and create a new administrator access token. This token\\n can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve\\n unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist\\n so the exploit will instead create a new administrator account before uploading a plugin. Older version of\\n TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,\\n however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code\\n execution instead, as this is supported on all versions tested.\", \"disclosure_date\": \"2024-03-04\", \"fullname\": \"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"JetBrains TeamCity Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"references\": [\"CVE-2024-27198\", \"EDB-52411\", \"URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\", \"URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/\"], \"rport\": 8111, \"session_types\": false, \"targets\": [\"Java\", \"Java Server Page\", \"Windows Command\", \"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:59.718665Z"} 2026-09-08T06:49:59.718665+00:00 https://vulnerability.circl.lu/sighting/5f1ab765-2d43-4fc2-9384-e41ef3143f86/export 2026-09-16T21:00:18.675431+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5f1ab765-2d43-4fc2-9384-e41ef3143f86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-03)", "content": "", "creation_timestamp": "2026-09-04T10:00:09.411883Z"} 2026-09-04T10:00:09.411883+00:00 https://vulnerability.circl.lu/sighting/dc5f0d6f-1cc8-4bb5-9190-70eb0f6bfd13/export 2026-09-16T21:00:18.675530+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dc5f0d6f-1cc8-4bb5-9190-70eb0f6bfd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-31T00:00:27.572600Z"} 2026-08-31T00:00:27.572600+00:00 https://vulnerability.circl.lu/sighting/57fc8448-f2a6-46cd-b3c4-cd33c93fc3aa/export 2026-09-16T21:00:18.675643+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "57fc8448-f2a6-46cd-b3c4-cd33c93fc3aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:00:05.368917Z"} 2026-08-30T10:00:05.368917+00:00 https://vulnerability.circl.lu/sighting/476e71c9-625d-4cb7-8a9d-85599ddad4cd/export 2026-09-16T21:00:18.675742+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "476e71c9-625d-4cb7-8a9d-85599ddad4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-30T00:00:43.147031Z"} 2026-08-30T00:00:43.147031+00:00 https://vulnerability.circl.lu/sighting/57c882fe-43bc-4298-a363-3cc51a547050/export 2026-09-16T21:00:18.675842+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "57c882fe-43bc-4298-a363-3cc51a547050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-29T20:00:17.423522Z"} 2026-08-29T20:00:17.423522+00:00 https://vulnerability.circl.lu/sighting/ed896e55-429c-455e-a46d-a28f58bac8b0/export 2026-09-16T21:00:18.675945+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ed896e55-429c-455e-a46d-a28f58bac8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-27)", "content": "", "creation_timestamp": "2026-08-28T10:00:07.885230Z"} 2026-08-28T10:00:07.885230+00:00 https://vulnerability.circl.lu/sighting/f17cd0a6-4fa6-475d-bf56-1a44fec33356/export 2026-09-16T21:00:18.676039+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f17cd0a6-4fa6-475d-bf56-1a44fec33356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-23)", "content": "", "creation_timestamp": "2026-08-24T10:15:35.472535Z"} 2026-08-24T10:15:35.472535+00:00