{"vulnerability": "CVE-2026-6376", "sightings": [{"uuid": "5e7fbcc8-ed68-4e45-93a0-0e46018332fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6376", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-04", "content": "", "creation_timestamp": "2026-04-23T05:00:00.000000Z"}, {"uuid": "4860da95-67ca-43ec-a509-2a93188eebb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6376", "type": "seen", "source": "Telegram/EOmUzEDCCjVld0ErnrIDoAMYFcT1xcXC6s4XJmAqdlxQalE", "content": "", "creation_timestamp": "2026-04-23T23:26:58.000000Z"}, {"uuid": "63371495-74ab-472c-abe0-974d5722cb86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63760", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3furnap72q", "content": "CVE-2026-63760 - SurrealDB before 3.1.0 Denial of Service via JSON Parser\nCVE ID : CVE-2026-63760\n \n Published : July 20, 2026, 12:19 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSO...", "creation_timestamp": "2026-07-20T13:34:00.596070Z"}, {"uuid": "1a0d263f-614f-4209-be4f-ef0456e84973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63766", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr464y2n462a", "content": "CVE-2026-63766\nGPT-SoVITS, a text-to-image model, is at risk if attackers can inject malicious commands through its web interface. This could allow unauthorized access to the system and potentially lead to data theft or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-20T20:48:05.721192Z"}, {"uuid": "e7e9e24f-00f5-42c4-a0e0-22ff1cb9d688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63767", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr46ajg2e22s", "content": "CVE-2026-63767\nThe ktransformers library, up to version 0.6.3, can be exploited by attackers to execute arbitrary commands on a server. This can happen when a malicious pickle payload is sent to the server, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-20T20:50:04.808319Z"}, {"uuid": "226bcf99-e62c-4c7e-ad2f-e4f7b58da7a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63766", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4cbkj3xu2w", "content": "\ud83d\udd34 CVE-2026-63766 - Critical (9.8)\n\nGPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63766/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T22:02:14.020434Z"}, {"uuid": "20c9cacf-23c1-42bd-8d48-c3cc9986f94b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63767", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fltadqn2u", "content": "\ud83d\udd34 CVE-2026-63767 - Critical (9.8)\n\nktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserial...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63767/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T23:01:40.621806Z"}, {"uuid": "0fb5fc51-10eb-4d93-941d-b347f6b1903d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63767", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr5ruurlhz26", "content": "CVE-2026-63767 - Critical RCE in Ktransformers. Unauthenticated pickle deserialization via ZMQ ROUTER socket. CVSS 9.8. No patch available - immediately isolate affected systems. #CVE #infosec #cybersecurity\n\nhttps://www.valtersit.com/cve/CVE-2026-63767/", "creation_timestamp": "2026-07-21T12:14:08.601378Z"}, {"uuid": "89043894-e3aa-4d6b-ab37-51a2b483a1db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63764", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6pppwq5x2v", "content": "CVE-2026-63764 - lmdeploy\nThe lmdeploy API server has a security weakness that allows unauthorized access to internal services and sensitive information. Attackers can exploit this weakness by sending a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#lmdeploy #internlm #CVE #infosec", "creation_timestamp": "2026-07-21T21:08:07.957349Z"}, {"uuid": "394c7fad-3380-4e54-827d-92cf57ddd97f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63764", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr6snqvcbe2j", "content": "\ud83d\udd34 CVE-2026-63764 - Critical (9.3)\n\nlmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63764/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-21T22:00:43.235948Z"}, {"uuid": "98466ba1-e2a5-4a9d-b509-d1a583bd532c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63764", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr6xbnk2m32e", "content": "CVE-2026-63764 - lmdeploy Server-Side Request Forgery via HTTP Redirect Bypass of Private-IP Guard in Vision Image Fetch\nCVE ID : CVE-2026-63764\n \n Published : July 21, 2026, 8:36 p.m. | 45\u00a0minutes ago\n \n Description : lmdeploy's OpenAI-compatible API server contains a server-...", "creation_timestamp": "2026-07-21T23:23:25.383661Z"}, {"uuid": "a03d03ed-e20c-42f4-9438-90afd570b34e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63760", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrc7y2osfl22", "content": "\ud83d\udccc CVE-2026-63760 - SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or ... https://www.cyberhub.blog/cves/CVE-2026-63760", "creation_timestamp": "2026-07-23T06:37:06.684295Z"}, {"uuid": "dbae65ab-0067-46c9-81e4-df37b2727efe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63766", "type": "seen", "source": "https://t.me/GithubRedTeam/94809", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63766_exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xdak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-23 11:28:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-23T13:00:04.607009Z"}, {"uuid": "a098db94-54ea-4313-aca9-243a1cb9dd1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63766", "type": "seen", "source": "Telegram/vvX3qHEz-OxKgnBCQLxVzIYR76LH85lkxYOWve4NS9I7tCI", "content": "", "creation_timestamp": "2026-07-23T17:00:03.956037Z"}, {"uuid": "7e7119bd-82c1-4ff4-91fa-e154f4b02c6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63766", "type": "published-proof-of-concept", "source": "Telegram/vvX3qHEz-OxKgnBCQLxVzIYR76LH85lkxYOWve4NS9I7tCI", "content": "", "creation_timestamp": "2026-07-24T00:00:08.069642Z"}, {"uuid": "c51c251f-a242-4092-8af0-097e81d1b0ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63766", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94809", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63766_exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xdak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-23 11:28:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-24T00:00:08.307893Z"}]}