https://vulnerability.circl.lu/sightings/feed 2026-08-10T04:58:58.645751+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/298cc2d0-94e7-4c02-bb89-d8cb89b4d86a/export 2026-08-10T04:58:58.668166+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "298cc2d0-94e7-4c02-bb89-d8cb89b4d86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3367", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u0440\u0441\u0435\u0440\u0430 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 aiohttp \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\nBDU:2026-11139\nCVE-2026-69243\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98", "creation_timestamp": "2026-08-08T00:06:19.946314Z"} 2026-08-08T00:06:19.946314+00:00 https://vulnerability.circl.lu/sighting/edab4b06-1ac2-4016-ac1c-6d2cd2cb5f7a/export 2026-08-10T04:58:58.670718+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "edab4b06-1ac2-4016-ac1c-6d2cd2cb5f7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3367", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u0440\u0441\u0435\u0440\u0430 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 aiohttp \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\nBDU:2026-11139\nCVE-2026-69243\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98", "creation_timestamp": "2026-08-07T14:02:14.203218Z"} 2026-08-07T14:02:14.203218+00:00 https://vulnerability.circl.lu/sighting/5ca15b01-e29b-4024-9541-8b541e17f29e/export 2026-08-10T04:58:58.670868+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5ca15b01-e29b-4024-9541-8b541e17f29e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "Telegram/rJSqz12D-kpQyCOJVo_dGQ5YtXruuuT1_BANzgPusZ6YAnQ", "content": "", "creation_timestamp": "2026-08-06T00:01:00.789029Z"} 2026-08-06T00:01:00.789029+00:00 https://vulnerability.circl.lu/sighting/7f4240ed-020a-49a1-9454-2fde64568cab/export 2026-08-10T04:58:58.670984+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7f4240ed-020a-49a1-9454-2fde64568cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "seen", "source": "Telegram/rJSqz12D-kpQyCOJVo_dGQ5YtXruuuT1_BANzgPusZ6YAnQ", "content": "", "creation_timestamp": "2026-08-05T01:00:03.566033Z"} 2026-08-05T01:00:03.566033+00:00 https://vulnerability.circl.lu/sighting/dda0bf56-eca4-4a9f-9083-7ff66730d8cb/export 2026-08-10T04:58:58.671094+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dda0bf56-eca4-4a9f-9083-7ff66730d8cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96645", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-69243-poc-aiohttp-smuggling\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JVBotelho\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 19:53:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T00:00:21.592414Z"} 2026-08-05T00:00:21.592414+00:00 https://vulnerability.circl.lu/sighting/16e079fc-0afd-4c66-86cd-3f75aabbc504/export 2026-08-10T04:58:58.671200+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "16e079fc-0afd-4c66-86cd-3f75aabbc504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96645", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-69243-poc-aiohttp-smuggling\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JVBotelho\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 19:53:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T21:00:04.721322Z"} 2026-08-04T21:00:04.721322+00:00 https://vulnerability.circl.lu/sighting/34dbadad-2e43-4a87-8774-9bd7e8acb2a6/export 2026-08-10T04:58:58.671309+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "34dbadad-2e43-4a87-8774-9bd7e8acb2a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69246", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msbcc3iwy52e", "content": "CVE-2026-69246 - Guzzle HTTP client mishandles Host header via libcurl IDNA/decoding, leading to request smuggling/SSRF. CVSS 7.2. No patch yet; upgrade when fixed. #CVE #PHP #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-69246/", "creation_timestamp": "2026-08-04T15:11:08.171345Z"} 2026-08-04T15:11:08.171345+00:00 https://vulnerability.circl.lu/sighting/18e9175a-2c20-4900-b337-dce6a965c163/export 2026-08-10T04:58:58.671415+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "18e9175a-2c20-4900-b337-dce6a965c163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69246", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117037876063346800", "content": "CVE-2026-69246 - Guzzle HTTP client mishandles Host header via libcurl IDNA/decoding, leading to request smuggling/SSRF. CVSS 7.2. No patch yet; upgrade when fixed. #CVE #PHP #infosec\nhttps://www.valtersit.com/cve/CVE-2026-69246/", "creation_timestamp": "2026-08-04T15:11:04.395143Z"} 2026-08-04T15:11:04.395143+00:00 https://vulnerability.circl.lu/sighting/74d7cbd7-3889-4468-8e87-be7a6ecd862f/export 2026-08-10T04:58:58.671516+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "74d7cbd7-3889-4468-8e87-be7a6ecd862f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://gist.github.com/alon710/d6efe0abb614ef8ea563c1fdaaf1246b", "content": "# CVE-2026-69240: CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69240\n\n## Summary\nA critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.\n\n## TL;DR\nSequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **Impact**: Confidentiality, Integrity, Availability (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Sequelize ORM with Oracle database backend\n- **sequelize**: < 6.37.4 (Fixed in: `6.37.4`)\n\n## Mitigation\n\n- Upgrade Sequelize to version 6.37.4 or later\n- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes\n- Use parameterized bind variables where possible to isolate data from commands\n\n**Remediation Steps:**\n1. Identify all service deployments using Sequelize with the Oracle database dialect.\n2. Update the package.json file to specify sequelize version ^6.37.4.\n3. Execute npm install or yarn install to apply the patch.\n4. Validate that all application tests pass and deploy the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-v8fg-2rw7-q452](https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452)\n- [Sequelize Release Note (v6.37.4)](https://github.com/sequelize/sequelize/releases/tag/v6.37.4)\n- [NVD CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69240)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69240) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T05:31:41.629580Z"} 2026-08-04T05:31:41.629580+00:00 https://vulnerability.circl.lu/sighting/2ef08a7f-32a7-4a6d-980c-c1c0fd1dd6b6/export 2026-08-10T04:58:58.671633+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "2ef08a7f-32a7-4a6d-980c-c1c0fd1dd6b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "seen", "source": "https://gist.github.com/alon710/b3523524be79c42fa548f91ed3953ea3", "content": "# CVE-2026-69243: CVE-2026-69243: HTTP Request Smuggling via WebSocket Upgrade State Desynchronization in aiohttp\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69243\n\n## Summary\nAn asynchronous HTTP client/server framework for asyncio and Python, aiohttp prior to version 3.14.2 is vulnerable to HTTP Request Smuggling. The server-side HTTP parser immediately transitions the protocol state to 'upgraded' upon receiving a WebSocket upgrade request before consuming the accompanying request body. If the backend handler rejects the upgrade request while keeping the TCP connection alive, the unconsumed request body remains in the socket buffer and is parsed as a subsequent pipelined HTTP request. This allows an attacker to smuggle requests, bypass frontend reverse proxy controls, and perform unauthorized actions.\n\n## TL;DR\nPrior to version 3.14.2, aiohttp transitions its protocol state to 'upgraded' before reading the body of a WebSocket upgrade request. If the handler rejects the upgrade, any unconsumed body bytes are parsed as a new pipelined HTTP request, enabling request smuggling.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS Vector**: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\n- **Exploit Status**: poc\n- **KEV Status**: No\n- **Affected Component**: HTTP Parser\n\n## Affected Systems\n\n- aiohttp asynchronous server component\n- **aiohttp**: < 3.14.2 (Fixed in: `3.14.2`)\n\n## Mitigation\n\n- Upgrade to aiohttp version 3.14.2 or higher.\n- Block WebSocket upgrade requests that contain a non-empty request body at the reverse proxy layer.\n- Disable HTTP keep-alive or connection reuse for routes handling WebSocket upgrades.\n\n**Remediation Steps:**\n1. Update standard requirements.txt or dependency lockfiles to require 'aiohttp>=3.14.2'.\n2. Deploy the updated application containers or server instances.\n3. Verify the implementation by sending a test pipelined connection to confirm unconsumed bodies are properly handled without request smuggling.\n\n## References\n\n- [GitHub Security Advisory GHSA-mfx4-hv73-q22v](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v)\n- [Official Pull Request #13017](https://github.com/aio-libs/aiohttp/pull/13017)\n- [Commit 6ae358f0983c3f4d6f67692b2f8e65dc8e091c98](https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98)\n- [Release v3.14.2](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69243)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69243) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T03:31:26.704466Z"} 2026-08-04T03:31:26.704466+00:00