{"vulnerability": "cve-2026-4706", "sightings": [{"uuid": "a0389d5b-7699-4009-81ed-c0a98c584cb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4706", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mhu7d3b6sc2j", "content": "", "creation_timestamp": "2026-03-25T04:01:23.575022Z"}, {"uuid": "aee39dd8-b092-42e1-97c4-c2c5b9817f11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-4706", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "a6d2da09-1781-4011-bd04-6fca7a761d6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47068", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmc7sv2h5b2h", "content": "CVE-2026-47068 - Cross-session PubSub topic injection via URL parameter in phoenix_storybook\nCVE ID : CVE-2026-47068\n \n Published : May 20, 2026, 1:35 p.m. | 39\u00a0minutes ago\n \n Description : Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix...", "creation_timestamp": "2026-05-20T15:28:18.415852Z"}, {"uuid": "8128ae64-23de-4df5-9a41-2448b8942b8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47065", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnf24u465g2o", "content": "CVE-2026-47065 - Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232\nCVE ID : CVE-2026-47065\n \n Published : June 3, 2026, 9:39 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filt...", "creation_timestamp": "2026-06-03T11:49:46.053689Z"}, {"uuid": "070c5438-fe3b-4ffa-b18c-0619a2cafd8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47065", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mngn33wfwh2l", "content": "\ud83d\udd34 CVE-2026-47065 - Critical (9.8)\n\nZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-47065/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-04T03:01:20.628438Z"}, {"uuid": "3ff7e5c3-1763-4734-96af-b28124cfeef9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47065", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116690538662978843", "content": "It is possible to see elevated activities targeting Apache MINA (CVE-2026-47065) https://vuldb.com/vuln/368097/cti", "creation_timestamp": "2026-06-04T06:58:35.484412Z"}, {"uuid": "28d4d354-7a88-4825-ad72-c6ab09513e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-47068", "type": "published-proof-of-concept", "source": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh", "content": "", "creation_timestamp": "2026-05-20T11:02:29.000000Z"}, {"uuid": "256ff6ba-f44c-4c03-ab6c-2e8ea3d0e646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47068", "type": "seen", "source": "https://gist.github.com/alon710/f640ae703fe7932b0c10bae26e654477", "content": "# CVE-2026-47068: CVE-2026-47068: Authorization Bypass via Cross-Session PubSub Topic Injection in phoenix_storybook\n\n> **CVSS Score:** 2.3\n> **Published:** 2026-06-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-47068\n\n## Summary\nA security vulnerability in the Elixir package phoenix_storybook (versions 0.4.0 up to 1.1.0) allows unauthenticated remote attackers to perform cross-session PubSub topic injection. By manipulating URL parameters, an attacker can hijack the real-time communications channel, enabling them to capture user state and control parameters from active sessions.\n\n## TL;DR\nUnauthenticated remote attackers can hijack active phoenix_storybook sessions by supplying a victim's PubSub topic via URL parameters, leading to potential cross-session state exposure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS Score**: 2.3 (Low)\n- **EPSS Score**: 0.00054\n- **Exploit Status**: No active public exploits\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- phoenix_storybook package for Elixir\n- **phoenix_storybook**: >= 0.4.0, < 1.1.0 (Fixed in: `1.1.0`)\n\n## Mitigation\n\n- Upgrade phoenix_storybook to version 1.1.0 or higher.\n- Ensure application endpoint configuration uses a secure, non-default secret_key_base.\n- Manually verify playground topic strings using Phoenix.Token in custom storybook setups.\n\n**Remediation Steps:**\n1. Inspect mix.exs to determine the current phoenix_storybook version.\n2. Update the dependency to `{:phoenix_storybook, \"~> 1.1.0\"}`.\n3. Run `mix deps.get` to download and compile the updated package.\n4. Verify deployment by inspecting URL parameters within the storybook playground iframe (should use 'playground_token' instead of 'topic').\n\n## References\n\n- [https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh](https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh)\n- [https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5](https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-47068) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-09T22:51:34.000000Z"}, {"uuid": "660174ce-6a26-4920-98af-6b9cde4f3b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-47066", "type": "published-proof-of-concept", "source": "https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j", "content": "", "creation_timestamp": "2026-06-26T22:35:17.670102Z"}, {"uuid": "7a327cab-a3e4-4b54-b77b-f6e7825b2d1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-47069", "type": "published-proof-of-concept", "source": "https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2", "content": "", "creation_timestamp": "2026-06-26T22:35:20.129106Z"}, {"uuid": "4618c6f5-fd91-40f6-9373-abfa6f565d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-47067", "type": "published-proof-of-concept", "source": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62", "content": "", "creation_timestamp": "2026-06-27T00:35:54.545165Z"}, {"uuid": "736ad1fe-34b0-45b7-afe2-eff492ea53df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47062", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j", "content": "\ud83d\udd17 CVE : CVE-2026-47041, CVE-2026-47043, CVE-2026-47044, CVE-2026-47047, CVE-2026-47050, CVE-2026-47053, CVE-2026-47054, CVE-2026-47055, CVE-2026-47062, CVE-2026-60150, CVE-2026-60155, CVE-2026-60158, CVE-2026-60159, CVE-2026-60160, CVE-2026-60161, CVE-2026-60162", "creation_timestamp": "2026-07-23T11:55:18.887928Z"}, {"uuid": "3d81c9f1-f7f9-46f2-9eae-d93a113b1c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-47063", "type": "seen", "source": "https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9", "content": "", "creation_timestamp": "2026-07-23T16:46:49.944815Z"}, {"uuid": "65c38da4-2cab-4144-8ce1-77882c5fad2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47065", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117309819472613244", "content": "sev:CRIT bypass of CVE-2026-47065 in Apache MINA.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-94301\n\nThe fix for CVE-2026-47065/ZDRES-232 (\"resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy\"), released on 2026-06-02 and announced as \"Fully addressed\" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the  2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.", "creation_timestamp": "2026-09-21T15:49:52.175870Z"}, {"uuid": "05e1add5-8c00-443f-80f7-4b8d2dbfedb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47065", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw23szyqif24", "content": "\ud83d\udea8 CVE-2026-94301 \u2014 CVSS 9.8 CRITICAL\n\nThe fix for CVE-2026-47065/ZDRES-232 (\"resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94301\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-21T16:07:23.577355Z"}]}