https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 20 Jul 2026 04:35:50 +0000 https://vulnerability.circl.lu/sighting/af50ec7e-246c-4b88-bd3d-2193bbbb27cd/export {"uuid": "af50ec7e-246c-4b88-bd3d-2193bbbb27cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116948731053893657", "content": "It is possible to see elevated activities targeting parisneo lollms (CVE-2026-12228) https://vuldb.com/vuln/380097/cti", "creation_timestamp": "2026-07-19T21:20:18.718350Z"} {"uuid": "af50ec7e-246c-4b88-bd3d-2193bbbb27cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116948731053893657", "content": "It is possible to see elevated activities targeting parisneo lollms (CVE-2026-12228) https://vuldb.com/vuln/380097/cti", "creation_timestamp": "2026-07-19T21:20:18.718350Z"} https://vulnerability.circl.lu/sighting/af50ec7e-246c-4b88-bd3d-2193bbbb27cd/export Sun, 19 Jul 2026 21:20:18 +0000 https://vulnerability.circl.lu/sighting/3d54a5ce-57ac-42c3-8ac8-e9aee0f76553/export {"uuid": "3d54a5ce-57ac-42c3-8ac8-e9aee0f76553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqy42wqik62g", "content": "\ud83d\udfe0 CVE-2026-12228 - High (8.7)\n\nA stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoin...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12228/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-19T06:00:31.037339Z"} {"uuid": "3d54a5ce-57ac-42c3-8ac8-e9aee0f76553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqy42wqik62g", "content": "\ud83d\udfe0 CVE-2026-12228 - High (8.7)\n\nA stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoin...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12228/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-19T06:00:31.037339Z"} https://vulnerability.circl.lu/sighting/3d54a5ce-57ac-42c3-8ac8-e9aee0f76553/export Sun, 19 Jul 2026 06:00:31 +0000 https://vulnerability.circl.lu/sighting/ff50b1a0-9149-4edf-a750-d0e1316ae058/export {"uuid": "ff50b1a0-9149-4edf-a750-d0e1316ae058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12228", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqxhxek3hj2i", "content": "parisneo/lollms hit by HIGH severity stored XSS (CVE-2026-12228, CVSS 8.7). Authenticated users can execute JS in victims\u2019 browsers. Check vendor for fixes \u2014 limit prompt sharing for now. https://radar.offseq.com/threat/cve-2026-12228-cwe-79-improper-neutralization-of-input-during-web-page-genera...", "creation_timestamp": "2026-07-19T00:00:36.686356Z"} {"uuid": "ff50b1a0-9149-4edf-a750-d0e1316ae058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12228", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqxhxek3hj2i", "content": "parisneo/lollms hit by HIGH severity stored XSS (CVE-2026-12228, CVSS 8.7). Authenticated users can execute JS in victims\u2019 browsers. Check vendor for fixes \u2014 limit prompt sharing for now. https://radar.offseq.com/threat/cve-2026-12228-cwe-79-improper-neutralization-of-input-during-web-page-genera...", "creation_timestamp": "2026-07-19T00:00:36.686356Z"} https://vulnerability.circl.lu/sighting/ff50b1a0-9149-4edf-a750-d0e1316ae058/export Sun, 19 Jul 2026 00:00:36 +0000 https://vulnerability.circl.lu/sighting/955c4258-242f-47ad-9467-a649887ac5cf/export {"uuid": "955c4258-242f-47ad-9467-a649887ac5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116943698895820998", "content": "CVE-2026-12228: parisneo/lollms suffers HIGH severity stored XSS (CVSS 8.7) via POST /api/prompts/share. Authenticated users can execute JS in victims' browsers, risking account takeover. Patch status unknown \u2014 check vendor updates. https://radar.offseq.com/threat/cve-2026-12228-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-9a447d2fa5ce8bc8 #OffSeq #XSS #Vuln #InfoSec", "creation_timestamp": "2026-07-19T00:00:34.448171Z"} {"uuid": "955c4258-242f-47ad-9467-a649887ac5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116943698895820998", "content": "CVE-2026-12228: parisneo/lollms suffers HIGH severity stored XSS (CVSS 8.7) via POST /api/prompts/share. Authenticated users can execute JS in victims' browsers, risking account takeover. Patch status unknown \u2014 check vendor updates. https://radar.offseq.com/threat/cve-2026-12228-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-9a447d2fa5ce8bc8 #OffSeq #XSS #Vuln #InfoSec", "creation_timestamp": "2026-07-19T00:00:34.448171Z"} https://vulnerability.circl.lu/sighting/955c4258-242f-47ad-9467-a649887ac5cf/export Sun, 19 Jul 2026 00:00:34 +0000 https://vulnerability.circl.lu/sighting/f4dc444d-4599-4bf3-8608-cd3a0936c821/export {"uuid": "f4dc444d-4599-4bf3-8608-cd3a0936c821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqxgbznwv727", "content": "CVE-2026-12228 - Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms\nCVE ID : CVE-2026-12228\n \n Published : July 18, 2026, 9:17 p.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/sha...", "creation_timestamp": "2026-07-18T23:30:46.399226Z"} {"uuid": "f4dc444d-4599-4bf3-8608-cd3a0936c821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqxgbznwv727", "content": "CVE-2026-12228 - Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms\nCVE ID : CVE-2026-12228\n \n Published : July 18, 2026, 9:17 p.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/sha...", "creation_timestamp": "2026-07-18T23:30:46.399226Z"} https://vulnerability.circl.lu/sighting/f4dc444d-4599-4bf3-8608-cd3a0936c821/export Sat, 18 Jul 2026 23:30:46 +0000 https://vulnerability.circl.lu/sighting/ebfa798b-fbba-4210-927f-b70de8eecfb1/export {"uuid": "ebfa798b-fbba-4210-927f-b70de8eecfb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/116943308400000440", "content": "\ud83d\udd77 Bugs Alerts\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udea8 New Vulnerability!\n\ud83c\udd94 CVE ID:CVE-2026-12228\ud83d\udcca Severity: \ud83d\udfe0 HIGH\ud83d\udcc8 CVSS Score: 8.7\ud83d\udcc5 Published: 2026-07-18 21:17 UTC\n\ud83d\udcdd Description:A stored cross-site scripting (XSS) vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled prompt_content into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through MessageContentRenderer, which uses v-html...\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\ud83d\udc68\u200d\ud83d\udcbb", "creation_timestamp": "2026-07-18T22:21:15.497066Z"} {"uuid": "ebfa798b-fbba-4210-927f-b70de8eecfb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/116943308400000440", "content": "\ud83d\udd77 Bugs Alerts\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udea8 New Vulnerability!\n\ud83c\udd94 CVE ID:CVE-2026-12228\ud83d\udcca Severity: \ud83d\udfe0 HIGH\ud83d\udcc8 CVSS Score: 8.7\ud83d\udcc5 Published: 2026-07-18 21:17 UTC\n\ud83d\udcdd Description:A stored cross-site scripting (XSS) vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled prompt_content into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through MessageContentRenderer, which uses v-html...\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\ud83d\udc68\u200d\ud83d\udcbb", "creation_timestamp": "2026-07-18T22:21:15.497066Z"} https://vulnerability.circl.lu/sighting/ebfa798b-fbba-4210-927f-b70de8eecfb1/export Sat, 18 Jul 2026 22:21:15 +0000