https://vulnerability.circl.lu/sightings/feed 2026-08-19T19:59:30.268112+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5a36664e-1d7c-493f-ae6f-b7ac6e2f652d/export 2026-08-19T19:59:30.286252+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5a36664e-1d7c-493f-ae6f-b7ac6e2f652d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mthil7nmgd2u", "content": "MLflow has an unauthenticated SSRF (CVE-2026-64849, CVSS 9.3) that reaches cloud metadata and returns the response, so it reads your instance credentials.\n\nEvery version before 3.15.0 is affected. Now on CISA's KEV list.\n\nPatch to 3.15.0 and enforce IMDSv2.", "creation_timestamp": "2026-08-19T19:44:41.593709Z"} 2026-08-19T19:44:41.593709+00:00 https://vulnerability.circl.lu/sighting/ee37b479-5aed-4372-aa45-104d6389b1c3/export 2026-08-19T19:59:30.288449+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ee37b479-5aed-4372-aa45-104d6389b1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mthg3qes4x2p", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0819)\n\n\u26a0\ufe0f CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-08-19T19:00:14.420853Z"} 2026-08-19T19:00:14.420853+00:00 https://vulnerability.circl.lu/sighting/61c179b0-f702-4c66-9de1-176c99c79cd1/export 2026-08-19T19:59:30.288541+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "61c179b0-f702-4c66-9de1-176c99c79cd1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9fc3fe97-7585-44d9-af56-6bae58615f6f", "content": "", "creation_timestamp": "2026-08-19T18:00:01.540208Z"} 2026-08-19T18:00:01.540208+00:00 https://vulnerability.circl.lu/sighting/b9328d6c-75c1-405a-8625-f04fe3991b51/export 2026-08-19T19:59:30.288620+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b9328d6c-75c1-405a-8625-f04fe3991b51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mthc5vwzr72p", "content": "\ud83d\uded1 CVE-2026-64849\nMLflow MLflow\nCVSS 9.3 / EPSS 1% / KEV \u2705\nTL;DR: MLflow is an open source AI engineering platform for agents, large language models, and machine\u2026\nhttps://cvesentinel.com/report/CVE-2026-64849?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-19T17:49:52.553129Z"} 2026-08-19T17:49:52.553129+00:00 https://vulnerability.circl.lu/sighting/7527cf66-3ca4-4e1b-9229-848fe926558e/export 2026-08-19T19:59:30.288689+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7527cf66-3ca4-4e1b-9229-848fe926558e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-19T00:00:03.269533Z"} 2026-08-19T00:00:03.269533+00:00 https://vulnerability.circl.lu/sighting/263917b5-ef45-4d09-bbe3-3204e204e813/export 2026-08-19T19:59:30.288759+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "263917b5-ef45-4d09-bbe3-3204e204e813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mtfeorh3bu2r", "content": "\ud83d\udea8 CRITICAL & ACTIVELY EXPLOITED: A severe SSRF flaw (CVE-2026-64849) in the MLflow AI platform allows attackers to steal cloud credentials. Upgrade to version 3.15.0 immediately and ensure your servers are not public-facing. #MLflow #SSRF #CyberSecu...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-18T23:29:46.405667Z"} 2026-08-18T23:29:46.405667+00:00 https://vulnerability.circl.lu/sighting/7f944814-a947-43f4-afc6-0033a327b3a8/export 2026-08-19T19:59:30.288825+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7f944814-a947-43f4-afc6-0033a327b3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mtf7vxl4xx2k", "content": "Two critical vulnerabilities in MLflow (CVE-2026-64849, CVSS 9.3) and FUXA (CVE-2026-25895, CVSS 9.5) are under active exploitation. Attackers are exploiting [\u2026]", "creation_timestamp": "2026-08-18T22:04:24.202016Z"} 2026-08-18T22:04:24.202016+00:00 https://vulnerability.circl.lu/sighting/b2ab106b-4ca7-4a6d-8eb5-2df087fca179/export 2026-08-19T19:59:30.288890+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b2ab106b-4ca7-4a6d-8eb5-2df087fca179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mtf4kbvv5w2m", "content": "MLflow SSRF (CVE-2026-64849) exploit for cloud creds in hours, bypassing prior fixes. You gotta hand it to 'em, the attackers don't waste time. Relentless", "creation_timestamp": "2026-08-18T21:04:07.220630Z"} 2026-08-18T21:04:07.220630+00:00 https://vulnerability.circl.lu/sighting/806e7724-54e4-465f-9fd7-b2c31783b86a/export 2026-08-19T19:59:30.288954+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "806e7724-54e4-465f-9fd7-b2c31783b86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtf2kobzid25", "content": "\ud83e\udd16 CVE-2026-64849 (CVSS 9.3): unauthenticated SSRF in MLflow (<3.15.0) exploited in the wild to exfiltrate cloud credentials. CVE-2026-25895 (CVSS 9.5): path traversal to RCE in FUXA SCADA/HMI, mass scanning.\nhttps://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "creation_timestamp": "2026-08-18T20:28:31.184194Z"} 2026-08-18T20:28:31.184194+00:00 https://vulnerability.circl.lu/sighting/164232a2-5645-4bbc-b241-d5f074d31089/export 2026-08-19T19:59:30.289018+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "164232a2-5645-4bbc-b241-d5f074d31089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64849", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mtezagljq22f", "content": "MLflow SSRF (CVE-2026-64849): exploited for cloud metadata credential theft hours after disclosure. Patch ML infra like production. #ThreatIntel #AIsecurity #CriticalInfrastructure https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026", "creation_timestamp": "2026-08-18T20:04:54.484618Z"} 2026-08-18T20:04:54.484618+00:00