{"vulnerability": "cve-2026-10072", "sightings": [{"uuid": "be997d80-9f87-4ad9-aa36-dc216be36849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-100727", "type": "seen", "source": "https://jvn.jp/en/jp/JVN24352487", "content": "", "creation_timestamp": "2026-10-04T23:00:00.000000Z"}, {"uuid": "ec769008-4095-4d2b-8ff3-79ffc83a77e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10072", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmywblz34b27", "content": "CVE-2026-10072 - Interinfo\uff5cDreamMaker - Arbitrary File Upload\nCVE ID : CVE-2026-10072\n \n Published : May 29, 2026, 2:16 p.m. | 55\u00a0minutes ago\n \n Description : DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to ...", "creation_timestamp": "2026-05-29T16:08:45.204576Z"}, {"uuid": "0aa9c2ac-181d-40dc-9f44-f6e3f584139c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100720", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwgo6n4zek2q", "content": "\ud83d\udea8 CVE-2026-100720 \u2014 CVSS 9.3 CRITICAL\n\nFroxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-priv...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100720\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-26T16:07:56.566727Z"}, {"uuid": "03270ff6-e592-4e38-a36e-ab2c87163007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100720", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwhbugmbza2k", "content": "CVE-2026-100720 - froxlor\nIf a low\u2011privilege customer uploads a specially crafted SSL certificate, the system stores the certificate issuer information without cleaning it. When an admin views the SSL certificates\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#froxlor #CVE #infosec", "creation_timestamp": "2026-09-26T22:00:09.138218Z"}, {"uuid": "170ab0e9-11cd-4f49-a9dd-877931555e62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100720", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwhio62c4t2d", "content": "\ud83d\udfe0 CVE-2026-100720 - High (8.7)\n\nFroxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the l...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100720/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-27T00:01:56.328402Z"}, {"uuid": "54a88dac-0c0d-4bca-ab4d-11a132c29ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwhqf7qodh2i", "content": "CVE-2026-100721 - vm2\nThe vm2 library version earlier than 3.12.2 can be tricked into loading code it should block, allowing code running inside a sandbox to execute on the host system. This happens when a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-27T02:20:04.717688Z"}, {"uuid": "8664ffa5-99ac-4464-91ee-2feecdae5d30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwhwellgf726", "content": "\ud83d\udea8 CVE-2026-100721 \u2014 CVSS 9.5 CRITICAL\n\nvm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100721\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T04:07:06.183675Z"}, {"uuid": "5bb7180f-8dc7-4a2b-b308-3663268d3bde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100721", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117341475539176060", "content": "CVE-2026-100721: CRITICAL auth bypass in vm2 <3.12.2's NodeVM external-module resolver. Sandbox escape & arbitrary code exec possible. Upgrade to 3.12.2+ ASAP. https://radar.offseq.com/threat/vm2-before-3122-contains-an-authorization-bypass-in-the-nodevm-external-module-resolver-cve-2026-100721-5c70167d00dbbf82 #OffSeq #CVE2026100721 #vm2 #infosec", "creation_timestamp": "2026-09-27T06:00:24.304087Z"}, {"uuid": "4528e429-d4ff-41bc-80ed-ddfb79e3b574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100721", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwi4pagjcv2q", "content": "vm2 <3.12.2 suffers a CRITICAL authorization bypass in NodeVM external-module resolver. Sandbox escape & code execution risk. Upgrade to 3.12.2+ immediately. https://radar.offseq.com/threat/vm2-before-3122-contains-an-authorization-bypass-in-the-nodevm-external-module-resolver-cve-2026-100721-5c7...", "creation_timestamp": "2026-09-27T06:00:26.502810Z"}, {"uuid": "a6ab7ab0-069a-4a09-9604-34c028cf440d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100723", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwk4gzcayx2g", "content": "\ud83d\udfe0 CVE-2026-100723 - High (7.5)\n\nvm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100723/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T01:01:10.763034Z"}, {"uuid": "fe6019ba-bded-4969-a6bf-30f0a47e928d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwk4haotdp27", "content": "\ud83d\udd34 CVE-2026-100721 - Critical (9)\n\nvm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100721/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T01:01:18.368358Z"}, {"uuid": "a80e91ca-cecc-4f46-ad39-05267c6525d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103628", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-100721\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 09:46:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-100721 PoC: vm2 <3.12.2 NodeVM external allowlist bypass \u2192 sandbox escape / host RCE. Local Node lab (evil-left-pad), remote sandbox API mass exploit, colorful CLI. PoCbit \u2014 https://pocbit.org/pocs/cve-2026-100721\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-28T10:00:09.000000Z"}, {"uuid": "2f2cc5fa-637a-4cee-8423-cbb4d6446d39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "seen", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "content": "", "creation_timestamp": "2026-09-28T21:00:04.000000Z"}, {"uuid": "ef4998aa-9c78-43cb-a157-bb3938682fcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "seen", "source": "Telegram/86UKc-a8dyoVcD7Y4niyS9OxM-BpnvAATArPBShCYu67BME", "content": "", "creation_timestamp": "2026-09-28T11:00:13.000000Z"}, {"uuid": "c191452a-9cb9-4340-942c-6671d58e9bc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "published-proof-of-concept", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "content": "", "creation_timestamp": "2026-09-28T21:00:04.000000Z"}, {"uuid": "255ac885-4ba2-4a54-89b9-9a65128b681b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100721", "type": "published-proof-of-concept", "source": "Telegram/86UKc-a8dyoVcD7Y4niyS9OxM-BpnvAATArPBShCYu67BME", "content": "", "creation_timestamp": "2026-09-28T11:00:13.000000Z"}, {"uuid": "7d68d8fb-a4dc-4858-8d0d-c895861c0461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100727", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6cybwj4u4ptny", "content": "CVE-2026-100727 - GROWI Improper Access Control Vulnerability\nCVE ID : CVE-2026-100727\n \n Published : Oct. 5, 2026, 6:36 a.m. | 34\u00a0minutes ago\n \n Description : An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files conta...", "creation_timestamp": "2026-10-05T07:38:00.177192Z"}, {"uuid": "20e77fbb-3cbb-47e5-8747-7f8af784a1ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-100721", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-5h3f-q97h-ccvc", "content": "", "creation_timestamp": "2026-10-05T23:24:29.000000Z"}, {"uuid": "0601e244-5fde-4d47-b9f3-1ebc75c398cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-100722", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-2v2p-6j97-cjg9", "content": "", "creation_timestamp": "2026-10-05T23:19:55.000000Z"}, {"uuid": "712b8c4b-43c4-461a-a972-dff57e93f29a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-100723", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-489w-w794-jq94", "content": "", "creation_timestamp": "2026-10-05T23:00:46.000000Z"}]}