https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 22 Sep 2026 11:07:54 +0000 https://vulnerability.circl.lu/sighting/e00d185c-e9a2-4162-8299-8f6a33b61c7f/export {"uuid": "e00d185c-e9a2-4162-8299-8f6a33b61c7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16265", "type": "seen", "source": "Telegram/RS5m0OdVynqfpAXslopdUI2FReOGMsRVPyHSkkL3z1_1Kmc", "content": "", "creation_timestamp": "2026-09-22T07:00:11.987057Z"} {"uuid": "e00d185c-e9a2-4162-8299-8f6a33b61c7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16265", "type": "seen", "source": "Telegram/RS5m0OdVynqfpAXslopdUI2FReOGMsRVPyHSkkL3z1_1Kmc", "content": "", "creation_timestamp": "2026-09-22T07:00:11.987057Z"} https://vulnerability.circl.lu/sighting/e00d185c-e9a2-4162-8299-8f6a33b61c7f/export Tue, 22 Sep 2026 07:00:11 +0000 https://vulnerability.circl.lu/sighting/0f02a210-4e8d-48a3-b97c-6ceae81ad5cf/export {"uuid": "0f02a210-4e8d-48a3-b97c-6ceae81ad5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1642", "type": "seen", "source": "https://t.me/Noheartz1337/148", "content": "VMANI CODE COMPANY IN UNITED STATES \ud83c\uddfa\ud83c\uddf8\n\nURL : https://52.87.97.56/vmanicode-home\nOR\nURL : https://vmanicode.com/vmanicode-home\n\nCVE 2026\n\nNGINX:CVE-2026-27654 8.8 https://vulners.com/nginx/NGINX:CVE-2026-27654\nNGINX:CVE-2026-27651 8.7 https://vulners.com/nginx/NGINX:CVE-2026-27651\nNGINX:CVE-2026-32647 8.5 https://vulners.com/nginx/NGINX:CVE-2026-32647\nNGINX:CVE-2026-27784 8.5 https://vulners.com/nginx/NGINX:CVE-2026-27784\nNGINX:CVE-2026-1642 8.2 https://vulners.com/nginx/NGINX:CVE-2026-1642\nNGINX:CVE-2026-28753 6.3 https://vulners.com/nginx/NGINX:CVE-2026-28753\nNGINX:CVE-2026-28755 5.4 https://vulners.com/nginx/NGINX:CVE-2026-28755\nhttp-server-header: nginx/1.29.0\n\n#NoHeartz", "creation_timestamp": "2026-09-22T05:00:04.901629Z"} {"uuid": "0f02a210-4e8d-48a3-b97c-6ceae81ad5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1642", "type": "seen", "source": "https://t.me/Noheartz1337/148", "content": "VMANI CODE COMPANY IN UNITED STATES \ud83c\uddfa\ud83c\uddf8\n\nURL : https://52.87.97.56/vmanicode-home\nOR\nURL : https://vmanicode.com/vmanicode-home\n\nCVE 2026\n\nNGINX:CVE-2026-27654 8.8 https://vulners.com/nginx/NGINX:CVE-2026-27654\nNGINX:CVE-2026-27651 8.7 https://vulners.com/nginx/NGINX:CVE-2026-27651\nNGINX:CVE-2026-32647 8.5 https://vulners.com/nginx/NGINX:CVE-2026-32647\nNGINX:CVE-2026-27784 8.5 https://vulners.com/nginx/NGINX:CVE-2026-27784\nNGINX:CVE-2026-1642 8.2 https://vulners.com/nginx/NGINX:CVE-2026-1642\nNGINX:CVE-2026-28753 6.3 https://vulners.com/nginx/NGINX:CVE-2026-28753\nNGINX:CVE-2026-28755 5.4 https://vulners.com/nginx/NGINX:CVE-2026-28755\nhttp-server-header: nginx/1.29.0\n\n#NoHeartz", "creation_timestamp": "2026-09-22T05:00:04.901629Z"} https://vulnerability.circl.lu/sighting/0f02a210-4e8d-48a3-b97c-6ceae81ad5cf/export Tue, 22 Sep 2026 05:00:04 +0000 https://vulnerability.circl.lu/sighting/32aae6ea-b470-49c5-a09d-5f35388f0a5a/export {"uuid": "32aae6ea-b470-49c5-a09d-5f35388f0a5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16651", "type": "seen", "source": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a", "content": "This threat intelligence briefing covers critical vulnerabilities, active malware campaigns, and emerging AI security governance:\n\n**Vulnerabilities & Advisories:** IBM released advisory AV26-943 requiring immediate patches for multiple enterprise products. Two high-severity CVEs were disclosed: CVE-2026-16651 (a DoS flaw in Temporal\u2019s SQL parser) and CVE-2026-92574 (a CRI-O checkpoint restore bypass enabling Kubernetes privilege escalation).\n\n**Active Threats:** The TASK#STOMP PowerShell backdoor is harvesting documents, Wi-Fi credentials, clipboard data, and screenshots. A sophisticated npm malware campaign evaded script defenses by hijacking core runtime functions, exfiltrated data via Slack/Telegram, used an Ethereum testnet for resilient C2, and accumulated ~2M weekly downloads.\n\n**AI & Device Security:** Five Eyes/CISA guidance recommends restricting autonomous AI agents to low-risk, non-sensitive tasks, while Orchid Security introduced identity drift detection and application-level kill-switches to govern safe AI scaling. Additional insights cover a critical disk encryption bypass in Flock ALPR cameras and security best practices for Windows 11 kiosk deployments.\n\n**Recommendation:** Organizations should apply pending patches, monitor for newly disclosed IOCs, and enforce strict identity hygiene and access controls across software supply chains and AI workloads.", "creation_timestamp": "2026-09-21T16:01:32.825979Z"} {"uuid": "32aae6ea-b470-49c5-a09d-5f35388f0a5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16651", "type": "seen", "source": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a", "content": "This threat intelligence briefing covers critical vulnerabilities, active malware campaigns, and emerging AI security governance:\n\n**Vulnerabilities & Advisories:** IBM released advisory AV26-943 requiring immediate patches for multiple enterprise products. Two high-severity CVEs were disclosed: CVE-2026-16651 (a DoS flaw in Temporal\u2019s SQL parser) and CVE-2026-92574 (a CRI-O checkpoint restore bypass enabling Kubernetes privilege escalation).\n\n**Active Threats:** The TASK#STOMP PowerShell backdoor is harvesting documents, Wi-Fi credentials, clipboard data, and screenshots. A sophisticated npm malware campaign evaded script defenses by hijacking core runtime functions, exfiltrated data via Slack/Telegram, used an Ethereum testnet for resilient C2, and accumulated ~2M weekly downloads.\n\n**AI & Device Security:** Five Eyes/CISA guidance recommends restricting autonomous AI agents to low-risk, non-sensitive tasks, while Orchid Security introduced identity drift detection and application-level kill-switches to govern safe AI scaling. Additional insights cover a critical disk encryption bypass in Flock ALPR cameras and security best practices for Windows 11 kiosk deployments.\n\n**Recommendation:** Organizations should apply pending patches, monitor for newly disclosed IOCs, and enforce strict identity hygiene and access controls across software supply chains and AI workloads.", "creation_timestamp": "2026-09-21T16:01:32.825979Z"} https://vulnerability.circl.lu/sighting/32aae6ea-b470-49c5-a09d-5f35388f0a5a/export Mon, 21 Sep 2026 16:01:32 +0000 https://vulnerability.circl.lu/sighting/2716d267-4a1f-45fa-944c-dbb8cb7fd136/export {"uuid": "2716d267-4a1f-45fa-944c-dbb8cb7fd136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1603", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-20)", "content": "", "creation_timestamp": "2026-09-21T10:00:08.294200Z"} {"uuid": "2716d267-4a1f-45fa-944c-dbb8cb7fd136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1603", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-20)", "content": "", "creation_timestamp": "2026-09-21T10:00:08.294200Z"} https://vulnerability.circl.lu/sighting/2716d267-4a1f-45fa-944c-dbb8cb7fd136/export Mon, 21 Sep 2026 10:00:08 +0000 https://vulnerability.circl.lu/sighting/6f2482e6-05da-464a-b816-3169ba1c0b9c/export {"uuid": "6f2482e6-05da-464a-b816-3169ba1c0b9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1603", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-19)", "content": "", "creation_timestamp": "2026-09-20T10:00:06.812542Z"} {"uuid": "6f2482e6-05da-464a-b816-3169ba1c0b9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1603", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-19)", "content": "", "creation_timestamp": "2026-09-20T10:00:06.812542Z"} https://vulnerability.circl.lu/sighting/6f2482e6-05da-464a-b816-3169ba1c0b9c/export Sun, 20 Sep 2026 10:00:06 +0000 https://vulnerability.circl.lu/sighting/5b69ea63-eb0a-445d-9b38-75dad6d34e88/export {"uuid": "5b69ea63-eb0a-445d-9b38-75dad6d34e88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16232", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43629", "content": "New Check Point Zero-Day Vulnerability Exploited in the Wild\n\nThe vulnerability tracked as CVE-2026-16232 has been exploited against customers with certain configurations.\nThe post New Check Point Zero-Day Vulnerability Exploited in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/new-check-point-zero-day-vulnerability-exploited-in-the-wild/", "creation_timestamp": "2026-09-19T00:00:43.465614Z"} {"uuid": "5b69ea63-eb0a-445d-9b38-75dad6d34e88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16232", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43629", "content": "New Check Point Zero-Day Vulnerability Exploited in the Wild\n\nThe vulnerability tracked as CVE-2026-16232 has been exploited against customers with certain configurations.\nThe post New Check Point Zero-Day Vulnerability Exploited in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/new-check-point-zero-day-vulnerability-exploited-in-the-wild/", "creation_timestamp": "2026-09-19T00:00:43.465614Z"} https://vulnerability.circl.lu/sighting/5b69ea63-eb0a-445d-9b38-75dad6d34e88/export Sat, 19 Sep 2026 00:00:43 +0000 https://vulnerability.circl.lu/sighting/0de0e697-04dc-4e72-9575-a9c14dd04855/export {"uuid": "0de0e697-04dc-4e72-9575-a9c14dd04855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43656", "content": "Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available\n\nSecurity firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.\n\nTracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires\nhttps://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "creation_timestamp": "2026-09-19T00:00:43.338993Z"} {"uuid": "0de0e697-04dc-4e72-9575-a9c14dd04855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43656", "content": "Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available\n\nSecurity firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.\n\nTracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires\nhttps://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "creation_timestamp": "2026-09-19T00:00:43.338993Z"} https://vulnerability.circl.lu/sighting/0de0e697-04dc-4e72-9575-a9c14dd04855/export Sat, 19 Sep 2026 00:00:43 +0000 https://vulnerability.circl.lu/sighting/08df11b5-3bcf-44dc-b7f9-fe3bc7ad934e/export {"uuid": "08df11b5-3bcf-44dc-b7f9-fe3bc7ad934e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16812", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43681", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nCVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-19T00:00:43.295305Z"} {"uuid": "08df11b5-3bcf-44dc-b7f9-fe3bc7ad934e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16812", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43681", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nCVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-19T00:00:43.295305Z"} https://vulnerability.circl.lu/sighting/08df11b5-3bcf-44dc-b7f9-fe3bc7ad934e/export Sat, 19 Sep 2026 00:00:43 +0000 https://vulnerability.circl.lu/sighting/1d45eb30-3e37-4ca3-82dc-8588d0393c2e/export {"uuid": "1d45eb30-3e37-4ca3-82dc-8588d0393c2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16140", "type": "published-proof-of-concept", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "content": "", "creation_timestamp": "2026-09-19T00:00:13.150191Z"} {"uuid": "1d45eb30-3e37-4ca3-82dc-8588d0393c2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16140", "type": "published-proof-of-concept", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "content": "", "creation_timestamp": "2026-09-19T00:00:13.150191Z"} https://vulnerability.circl.lu/sighting/1d45eb30-3e37-4ca3-82dc-8588d0393c2e/export Sat, 19 Sep 2026 00:00:13 +0000 https://vulnerability.circl.lu/sighting/eca7ebfb-fc0b-471a-8e00-66e593cc1472/export {"uuid": "eca7ebfb-fc0b-471a-8e00-66e593cc1472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16265", "type": "published-proof-of-concept", "source": "Telegram/H7T7dK3uqmkjlkp23xt7S3AYXc4CzofFX2dd1POZQ2XzQMI", "content": "", "creation_timestamp": "2026-09-19T00:00:09.779111Z"} {"uuid": "eca7ebfb-fc0b-471a-8e00-66e593cc1472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16265", "type": "published-proof-of-concept", "source": "Telegram/H7T7dK3uqmkjlkp23xt7S3AYXc4CzofFX2dd1POZQ2XzQMI", "content": "", "creation_timestamp": "2026-09-19T00:00:09.779111Z"} https://vulnerability.circl.lu/sighting/eca7ebfb-fc0b-471a-8e00-66e593cc1472/export Sat, 19 Sep 2026 00:00:09 +0000