{"vulnerability": "CVE-2026-7656", "sightings": [{"uuid": "4e02b307-f143-4080-96a3-6e8c9b400773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76564", "type": "published-proof-of-concept", "source": "Telegram/03DcXoGQZQ9mku-eZxZ3sqEt8rlqeSHZe7wXn_yHaiQybcE", "content": "", "creation_timestamp": "2026-08-22T03:00:04.152713Z"}, {"uuid": "8b553490-a246-468e-98dd-6e0c08ee711d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4ux6zdcluqupc", "content": "CVE-2026-76565 - Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7\nCVE ID : CVE-2026-76565\n \n Published : Aug. 20, 2026, 7:27 a.m. | 24\u00a0minutes ago\n \n Description : Joomla Extension - phoca.cz - Reflected XSS via ...", "creation_timestamp": "2026-08-20T08:14:55.771542Z"}, {"uuid": "4f164003-b487-4d40-813e-8142e57f4c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76569", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fnbczdll3t7iz", "content": "CVE-2026-76569 - Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4\nCVE ID : CVE-2026-76569\n \n Published : Aug. 20, 2026, 7:29 a.m. | 22\u00a0minutes ago\n \n Description : Joomla Extension - phoca.cz - Reflected XSS via the search ...", "creation_timestamp": "2026-08-20T08:16:57.268002Z"}, {"uuid": "2567426b-4869-445d-a2fe-49030d70156b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-76565", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-76565", "content": "", "creation_timestamp": "2026-08-20T12:15:06.112462Z"}, {"uuid": "8f9d9067-fbda-4969-b2d0-35c7c6f6b56c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-76564", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-76564", "content": "", "creation_timestamp": "2026-08-20T12:15:08.356322Z"}, {"uuid": "ceff66ce-e19d-4f5c-9207-43f89bb795fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-76569", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-76569", "content": "", "creation_timestamp": "2026-08-20T12:15:13.073385Z"}, {"uuid": "f7bdb948-c80a-43f9-b35d-064f258d0a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "published-proof-of-concept", "source": "Telegram/20v2IoyFQshDHts5_7Yn4T7Cia_Iss1KLurhB1ZSh0DbW1c", "content": "", "creation_timestamp": "2026-08-22T00:00:09.658741Z"}, {"uuid": "d1585a5e-3c92-473e-98e3-7d82d996dfe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7656", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphowclzrx2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-7656 \u0432 IPv6: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/FC77736F-DBF0-4842-9BAE-0B176F97ADDF", "creation_timestamp": "2026-06-29T23:57:29.177980Z"}, {"uuid": "ca0afff9-d22d-48d3-8aeb-38933a51fbb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7656", "type": "seen", "source": "https://gist.github.com/ichintu/8b78df900d5aca0afc4dd97225bd83dc", "content": "**Daily Cyber Threat Intelligence\u2014June\u202f29\u202f2026**\n\n| CVE | Product/Component | Issue | Severity | Key Impact | Resolution |\n|-----|-------------------|-------|----------|------------|------------|\n| **CVE-2026-7656** | Zephyr OS IPv6 stack | Input\u2011validation bug in `handle_ra_input`, `handle_ns_input`, `handle_na_input` caused all RFC\u20114861 checks to be bypassed (ICMPv6 code\u202f0 made the predicate false). | 8.1 (High) | Forged RA/NS/NA from an on\u2011link or even remote attacker \u2192 router re\u2011config, DNS hijack, MTU spoof, MITM, DoS. | Updated condition so any failed check drops the packet (fixed in all releases 2018\u2011v4.4.0). |\n| **CVE-2026-34594** | Coolify (self\u2011hosted server/app manager) | Authenticated command injection in Destination Network Management \u2013 a `network` parameter is passed directly to shell. | 8.8 (High) | Full root RCE on the managed machine. | Fixed in 4.0.0\u2011beta.471. |\n| **CVE-2026-34597** | Coolify | Authenticated Host RCE \u2013 user\u2011supplied `install_command` in Nixpacks is concatenated into a shell command. | 8.8 (High) | Host\u2011level command execution. | Fixed in 4.0.0\u2011beta.470. |\n| **CVE-2026-57498** | Coolify | Cross\u2011team IDOR: Livewire UI components accepted `server_id` and `destination_uuid` from query strings without validating team ownership, while API controllers were correct. | 9.6 (Critical) | Deploy resources to other teams\u2019 servers. | Patched in 4.0.0\u2011beta.474. |\n| **CVE-2026-13763** | AWS Application Load Balancer + WAF | HTTP/2 body\u2011inspection bypass: fragmented bodies mean only a portion is inspected by WAF. | 9.8 (Critical) | Attacker can send malicious content partially inspected. | Enable \u201cInspect after sufficient data\u201d target\u2011group setting (AWS doc link). |\n| **CVE-2026-13762** | Amazon CloudFront + WAF | Same HTTP/2 body\u2011inspection confusion as above, affecting CloudFront target groups. | 9.8 (Critical) | Bypass WAF body\u2011inspection. | Server\u2011side patch applied; no customer action required. |\n| **Other Alert** | GitHub Repository | Repository hosts a dropper RAT, a cryptominer, and AI\u2011based credential\u2011stealing code. | \u2014 | \u2014 | \u2014 |\n\n**Take\u2011away:**  \n\n- Zephyr OS and Coolify are currently plagued by authenticated RCE and IDOR flaws that were fixed in recent releases; update immediately.  \n- AWS customers should check that ALB \u201cInspect after sufficient data\u201d is enabled; CloudFront security is already patched.  \n- Monitor the mentioned malicious GitHub repo for potential new threats.", "creation_timestamp": "2026-06-30T00:01:40.240927Z"}, {"uuid": "8dfb4ec1-1004-48d3-a634-5e88513d2fb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7656", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mphtbzdtxu2x", "content": "CVE-2026-7656 - Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack\nCVE ID : CVE-2026-7656\n \n Published : June 29, 2026, 10:09 p.m. | 1\u00a0hour, 49\u00a0minutes ago\n \n Description : The IPv6 Neighbor Discovery handlers in subsys/net/i...", "creation_timestamp": "2026-06-30T01:15:37.114795Z"}, {"uuid": "0798b680-92b6-4a35-8ad9-ba390d2774f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7656", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mphz5m4ppd2g", "content": "Zephyr OS (1.14.0 \u2013 <4.5.0) HIGH severity IPv6 ND flaw: attackers can inject forged network messages, risking MITM & DoS. Restrict access & monitor ND traffic until official fix. https://radar.offseq.com/threat/cve-2026-7656-always-incorrect-control-flow-implem-8d38cfb126f4b968 #OffSeq #ZephyrOS ...", "creation_timestamp": "2026-06-30T03:00:32.801148Z"}, {"uuid": "27496b92-4048-46f7-9704-5f78b1cd4840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7656", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116836822502111735", "content": "CVE-2026-7656 (HIGH, CVSS 8.1) in Zephyr OS: Incorrect IPv6 ND logic lets attackers inject forged router/neighbor messages, risking MITM, redirection, and DoS. Patch pending. Restrict untrusted access, monitor ND. https://radar.offseq.com/threat/cve-2026-7656-always-incorrect-control-flow-implem-8d38cfb126f4b968 #OffSeq #ZephyrOS #CVE20267656", "creation_timestamp": "2026-06-30T03:00:41.355738Z"}, {"uuid": "d38bdc56-ee77-4333-83f4-cb31c918e784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76564", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99099", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Stored\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-76564\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 17:16:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nStored XSS via User-Agent in Admin Order View in PhocaCart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:03.821577Z"}, {"uuid": "fa07615e-0e58-4ad9-b4a7-1d72ed83c464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "seen", "source": "https://t.me/GithubRedTeam/99100", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Reflected\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-76565\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 17:14:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReflected XSS via price_from & price_to Filter Parameters in PhocaCart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:04.954837Z"}, {"uuid": "acc1beec-05f2-4f79-864c-70851c4ecdea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117151851235145822", "content": "\u203c\ufe0f CVE PoC Published: CVE-2026-76565 - Reflected XSS in PhocaCart\nGitHub: https://github.com/toanln-cov/CVE-2026-76565\nA proof-of-concept has been released for CVE-2026-76565, a reflected cross-site scripting (XSS) vulnerability affecting PhocaCart \u2264 6.1.7 for Joomla.\nThe vulnerability exists in the price_from and price_to filter parameters within the mod_phocacart_filter module. Due to improper output encoding, unauthenticated attackers can craft a malicious URL that injects JavaScript into the page when viewed by a victim.\nThe PoC demonstrates:\n\u2022 Reflected XSS through crafted GET parameters\u2022 Exploitation of vulnerable price filter inputs\u2022 Attribute-context injection caused by missing htmlspecialchars() encoding\u2022 No authentication requirement for exploitation\u2022 Affected versions: PhocaCart \u2264 6.1.7\u2022 Fixed version: PhocaCart 6.1.8\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel before everyone else with Dark Web Informer.", "creation_timestamp": "2026-08-24T18:16:27.552813Z"}, {"uuid": "ce043e99-fcee-498b-b4dd-1babdc455e09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99100", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Reflected\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-76565\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 17:14:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReflected XSS via price_from & price_to Filter Parameters in PhocaCart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:31.428780Z"}, {"uuid": "15e58685-6481-4536-bbf7-db67ae805780", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76564", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99099", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Stored\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-76564\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 17:16:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nStored XSS via User-Agent in Admin Order View in PhocaCart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:31.479340Z"}, {"uuid": "22e481e5-6e95-48d9-b54f-6e54abe11de6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76564", "type": "published-proof-of-concept", "source": "Telegram/03DcXoGQZQ9mku-eZxZ3sqEt8rlqeSHZe7wXn_yHaiQybcE", "content": "", "creation_timestamp": "2026-08-23T00:00:45.521867Z"}, {"uuid": "52ba8156-7903-485f-becf-c41070a7cef6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7656", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrba4svmww22", "content": "\ud83d\udccc CVE-2026-7656 - The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean express... https://www.cyberhub.blog/cves/CVE-2026-7656", "creation_timestamp": "2026-07-22T21:07:06.543937Z"}, {"uuid": "99e7148e-68ab-436b-b5a1-21dd970aa01d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mtupnewzvx2j", "content": "CVE-2026-76565 is trending. Hype score 6, currently #8 on cvemon.\n\nJoomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7\n\nhttps://cvemon.intruder.io/cves/CVE-2026-76565", "creation_timestamp": "2026-08-25T01:55:46.607940Z"}]}