{"vulnerability": "CVE-2026-4975", "sightings": [{"uuid": "a4aa6002-ae93-473b-9027-bb54f843b16c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4975", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mi3c4sv2322d", "content": "", "creation_timestamp": "2026-03-27T23:40:10.822168Z"}, {"uuid": "972ddba4-a2f1-4b56-819b-ba929f70164b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4975", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3milrmxsszy2f", "content": "", "creation_timestamp": "2026-04-03T13:00:14.985924Z"}, {"uuid": "54a6bff1-7cda-4696-a9c0-a39ec1459a78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4975", "type": "published-proof-of-concept", "source": "Telegram/wWPS0byCXjzJleEHKN6yjldptusIbQ1L7WvvuLFtEg9AE-Q", "content": "", "creation_timestamp": "2026-03-27T21:23:25.000000Z"}, {"uuid": "f37ee81b-781a-4308-9a38-ee938855dcf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49756", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mns7prs24r2y", "content": "CVE-2026-49756 - Multipart form-data header injection in Req via unescaped name/filename/content_type\nCVE ID : CVE-2026-49756\n \n Published : June 8, 2026, 4:16 p.m. | 17\u00a0minutes ago\n \n Description : Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ...", "creation_timestamp": "2026-06-08T17:34:18.004200Z"}, {"uuid": "9dbc6e47-6e85-479f-8905-4131bc08297a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49755", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnsabozbgi2a", "content": "CVE-2026-49755 - Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies\nCVE ID : CVE-2026-49755\n \n Published : June 8, 2026, 4:16 p.m. | 17\u00a0minutes ago\n \n Description : Improper Handling of Highly Compressed Data (Data Amplification) vulnerabilit...", "creation_timestamp": "2026-06-08T17:44:19.192829Z"}, {"uuid": "79c91906-963c-4123-b8be-7c3d88874c7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49757", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3modf7q5hpd23", "content": "CVE-2026-49757 - OAuth2/OIDC account takeover in AshAuthentication via email-based user matching\nCVE ID : CVE-2026-49757\n \n Published : June 15, 2026, 12:16 p.m. | 52\u00a0minutes ago\n \n Description : Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication...", "creation_timestamp": "2026-06-15T13:27:57.766449Z"}, {"uuid": "b7b9ed23-15a5-4687-aea2-eab08dee1523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49757", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116755425881916574", "content": "\ud83d\udea8 CRITICAL: CVE-2026-49757 in ash_authentication lets attackers bypass auth by spoofing email in OAuth2/OIDC, risking local account takeover. Patch status unconfirmed \u2014 check vendor advisory. Affected: v0.1.0, 5.0.0-rc.0. https://radar.offseq.com/threat/cve-2026-49757-cwe-290-authentication-bypass-by-sp-5df5a500 #OffSeq #CVE202649757 #OAuth2 #infosec", "creation_timestamp": "2026-06-15T18:00:18.422466Z"}, {"uuid": "42e17bf1-289e-4c6f-b18f-325d9c9cbab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49757", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3modugpemgd2a", "content": "\ud83d\udea8 CRITICAL: team-alembic ash_authentication flaw lets attackers bypass OAuth2/OIDC login with email spoofing \u2014 full account takeover possible! Patch status unconfirmed. Check vendor advisory & avoid email matching for auth. https://radar.offseq.com/threat/cve-2026-49757-cwe-290-authentication-byp...", "creation_timestamp": "2026-06-15T18:00:18.563178Z"}, {"uuid": "ab49548e-089c-4394-8373-33b86f09ba0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49757", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116757330371949034", "content": "It is possible to see elevated activities targeting team-alembic ash_authentication (CVE-2026-49757) https://vuldb.com/vuln/370892/cti", "creation_timestamp": "2026-06-16T02:04:37.941126Z"}, {"uuid": "186f3236-af62-4a04-9697-f8dc556ca624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49759", "type": "seen", "source": "https://bsky.app/profile/cyberowi.pl/post/3mokbedhmti25", "content": "\ud83d\udea8 Krytyczna luka DoS w Erlang/OTP zagra\u017ca systemom wysokiej dost\u0119pno\u015bci\n\nLuka CVE-2026-49759 z ocen\u0105 CVSS 8.2 mo\u017ce pozwoli\u0107 na zdalne wywo\u0142anie awarii w aplikacjach opartych o Erlang/OTP. Dotyczy\n\nhttps://cyberowi.pl/krytyczna-luka-dos-w-erlang-otp-zagraza-systemom-wysokiej/\n\n#cyberbezpieczenstwo", "creation_timestamp": "2026-06-18T07:07:36.828768Z"}]}