https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 21:00:18 +0000 https://vulnerability.circl.lu/sighting/50d950f8-e764-42af-933b-eb0b063097cc/export {"uuid": "50d950f8-e764-42af-933b-eb0b063097cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:09.528839Z"} {"uuid": "50d950f8-e764-42af-933b-eb0b063097cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:09.528839Z"} https://vulnerability.circl.lu/sighting/50d950f8-e764-42af-933b-eb0b063097cc/export Wed, 16 Sep 2026 10:00:09 +0000 https://vulnerability.circl.lu/sighting/e6838c67-3b22-4e37-bf91-68ced65333df/export {"uuid": "e6838c67-3b22-4e37-bf91-68ced65333df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:10.147390Z"} {"uuid": "e6838c67-3b22-4e37-bf91-68ced65333df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:10.147390Z"} https://vulnerability.circl.lu/sighting/e6838c67-3b22-4e37-bf91-68ced65333df/export Wed, 09 Sep 2026 10:00:10 +0000 https://vulnerability.circl.lu/sighting/4898beef-8c16-46f6-9c5f-840ee7fcd724/export {"uuid": "4898beef-8c16-46f6-9c5f-840ee7fcd724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated\\n attacker can leverage this to access the REST API and create a new administrator access token. This token\\n can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve\\n unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist\\n so the exploit will instead create a new administrator account before uploading a plugin. Older version of\\n TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,\\n however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code\\n execution instead, as this is supported on all versions tested.\", \"disclosure_date\": \"2024-03-04\", \"fullname\": \"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"JetBrains TeamCity Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"references\": [\"CVE-2024-27198\", \"EDB-52411\", \"URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\", \"URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/\"], \"rport\": 8111, \"session_types\": false, \"targets\": [\"Java\", \"Java Server Page\", \"Windows Command\", \"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:59.718665Z"} {"uuid": "4898beef-8c16-46f6-9c5f-840ee7fcd724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated\\n attacker can leverage this to access the REST API and create a new administrator access token. This token\\n can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve\\n unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist\\n so the exploit will instead create a new administrator account before uploading a plugin. Older version of\\n TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,\\n however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code\\n execution instead, as this is supported on all versions tested.\", \"disclosure_date\": \"2024-03-04\", \"fullname\": \"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"JetBrains TeamCity Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"references\": [\"CVE-2024-27198\", \"EDB-52411\", \"URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\", \"URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/\"], \"rport\": 8111, \"session_types\": false, \"targets\": [\"Java\", \"Java Server Page\", \"Windows Command\", \"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:59.718665Z"} https://vulnerability.circl.lu/sighting/4898beef-8c16-46f6-9c5f-840ee7fcd724/export Tue, 08 Sep 2026 06:49:59 +0000 https://vulnerability.circl.lu/sighting/5f1ab765-2d43-4fc2-9384-e41ef3143f86/export {"uuid": "5f1ab765-2d43-4fc2-9384-e41ef3143f86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-03)", "content": "", "creation_timestamp": "2026-09-04T10:00:09.411883Z"} {"uuid": "5f1ab765-2d43-4fc2-9384-e41ef3143f86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-03)", "content": "", "creation_timestamp": "2026-09-04T10:00:09.411883Z"} https://vulnerability.circl.lu/sighting/5f1ab765-2d43-4fc2-9384-e41ef3143f86/export Fri, 04 Sep 2026 10:00:09 +0000 https://vulnerability.circl.lu/sighting/dc5f0d6f-1cc8-4bb5-9190-70eb0f6bfd13/export {"uuid": "dc5f0d6f-1cc8-4bb5-9190-70eb0f6bfd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-31T00:00:27.572600Z"} {"uuid": "dc5f0d6f-1cc8-4bb5-9190-70eb0f6bfd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-31T00:00:27.572600Z"} https://vulnerability.circl.lu/sighting/dc5f0d6f-1cc8-4bb5-9190-70eb0f6bfd13/export Mon, 31 Aug 2026 00:00:27 +0000 https://vulnerability.circl.lu/sighting/57fc8448-f2a6-46cd-b3c4-cd33c93fc3aa/export {"uuid": "57fc8448-f2a6-46cd-b3c4-cd33c93fc3aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:00:05.368917Z"} {"uuid": "57fc8448-f2a6-46cd-b3c4-cd33c93fc3aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:00:05.368917Z"} https://vulnerability.circl.lu/sighting/57fc8448-f2a6-46cd-b3c4-cd33c93fc3aa/export Sun, 30 Aug 2026 10:00:05 +0000 https://vulnerability.circl.lu/sighting/476e71c9-625d-4cb7-8a9d-85599ddad4cd/export {"uuid": "476e71c9-625d-4cb7-8a9d-85599ddad4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-30T00:00:43.147031Z"} {"uuid": "476e71c9-625d-4cb7-8a9d-85599ddad4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-30T00:00:43.147031Z"} https://vulnerability.circl.lu/sighting/476e71c9-625d-4cb7-8a9d-85599ddad4cd/export Sun, 30 Aug 2026 00:00:43 +0000 https://vulnerability.circl.lu/sighting/57c882fe-43bc-4298-a363-3cc51a547050/export {"uuid": "57c882fe-43bc-4298-a363-3cc51a547050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-29T20:00:17.423522Z"} {"uuid": "57c882fe-43bc-4298-a363-3cc51a547050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27199", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-29T20:00:17.423522Z"} https://vulnerability.circl.lu/sighting/57c882fe-43bc-4298-a363-3cc51a547050/export Sat, 29 Aug 2026 20:00:17 +0000 https://vulnerability.circl.lu/sighting/ed896e55-429c-455e-a46d-a28f58bac8b0/export {"uuid": "ed896e55-429c-455e-a46d-a28f58bac8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-27)", "content": "", "creation_timestamp": "2026-08-28T10:00:07.885230Z"} {"uuid": "ed896e55-429c-455e-a46d-a28f58bac8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-27)", "content": "", "creation_timestamp": "2026-08-28T10:00:07.885230Z"} https://vulnerability.circl.lu/sighting/ed896e55-429c-455e-a46d-a28f58bac8b0/export Fri, 28 Aug 2026 10:00:07 +0000 https://vulnerability.circl.lu/sighting/f17cd0a6-4fa6-475d-bf56-1a44fec33356/export {"uuid": "f17cd0a6-4fa6-475d-bf56-1a44fec33356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-23)", "content": "", "creation_timestamp": "2026-08-24T10:15:35.472535Z"} {"uuid": "f17cd0a6-4fa6-475d-bf56-1a44fec33356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-23)", "content": "", "creation_timestamp": "2026-08-24T10:15:35.472535Z"} https://vulnerability.circl.lu/sighting/f17cd0a6-4fa6-475d-bf56-1a44fec33356/export Mon, 24 Aug 2026 10:15:35 +0000