{"vulnerability": "cve-2026-6730", "sightings": [{"uuid": "9a61f17a-81c3-42f5-aed7-0d8f84831f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67305", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms2bwrfkiw2h", "content": "CVE-2026-67305 - freerdp\nThe FreeRDP Windows client has a security flaw that allows an attacker to execute malicious code on a user's computer. This can happen if a user connects to a malicious Remote Desktop server\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#freerdp #CVE #infosec", "creation_timestamp": "2026-08-01T20:16:04.612036Z"}, {"uuid": "1d5267e1-a91a-4652-ad6a-2659b6ccdb04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67308", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2egyp24c2b", "content": "\ud83d\udd34 CVE-2026-67308 - Critical (10)\n\nWazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that all...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67308/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-01T21:00:56.845023Z"}, {"uuid": "99f80277-b5bf-4e58-92e0-63fee15c2659", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67308", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117022368056209142", "content": "A severe vulnerability was disclosed for Wazuh Workflows (CVE-2026-67308) https://vuldb.com/vuln/385268", "creation_timestamp": "2026-08-01T21:27:10.157761Z"}, {"uuid": "509a379b-bbe8-4513-821c-844f50a04966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67300", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2l56spgn2z", "content": "\ud83d\udfe0 CVE-2026-67300 - High (7.5)\n\nFreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async updat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67300/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-01T23:00:44.185663Z"}, {"uuid": "b48e56b9-b1e7-4326-a465-ddc49f8c3f75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67301", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2oibcxlk2g", "content": "\ud83d\udfe0 CVE-2026-67301 - High (7.5)\n\nFreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message pro...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67301/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T00:00:43.549023Z"}, {"uuid": "b74ddb4a-d3ec-46d8-b9d9-f75afc99b0b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67304", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2oihufp22b", "content": "\ud83d\udfe0 CVE-2026-67304 - High (7.5)\n\nFreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device contr...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67304/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T00:00:45.766115Z"}, {"uuid": "e28dd688-1984-4d01-9e08-a9c8cafd253d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67308", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms3yaubip62f", "content": "CVE-2026-67308 - wazuh\nWazuh's GitHub Actions workflows have a security flaw that can be exploited by attackers. If an attacker submits a specific type of file through a pull request, they can execute unauthorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wazuh #CVE #infosec", "creation_timestamp": "2026-08-02T12:28:05.553509Z"}, {"uuid": "6655034e-fe21-46f8-bdd9-898f59c332df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67308", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117026128509459969", "content": "Attention, elevated activities detected targeting Wazuh Workflows (CVE-2026-67308) https://vuldb.com/vuln/385268/cti", "creation_timestamp": "2026-08-02T13:23:30.154094Z"}, {"uuid": "8240440a-c2c1-4cbd-b8b2-92517ffa46f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67309", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3ms47yxells24", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-67309 \u0432 Traefik: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/64A743C1-1992-45D9-9F66-CA3B5DCB8268", "creation_timestamp": "2026-08-02T14:46:50.190422Z"}, {"uuid": "71fb9085-0fce-4734-8107-dccbdf972ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67308", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4aak2lyo2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-67308 \u0432 Wazuh: \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 GitHub Actions\n\n\n\nhttps://kripta.biz/posts/12597D8D-DF4E-4268-9844-A424A6E97D5C", "creation_timestamp": "2026-08-02T14:51:04.224709Z"}, {"uuid": "1c19c075-27a6-40ac-8ba3-e79f39a96cda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67304", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117027006957378264", "content": "CVE-2026-67304 - DoS via null ptr deref in FreeRDP smartcard cleanup. CVSS 7.5. Unpatched. Patch when 3.29.0 available. #CVE #FreeRDP #infosec\nhttps://www.valtersit.com/cve/CVE-2026-67304/", "creation_timestamp": "2026-08-02T17:09:04.708395Z"}, {"uuid": "c3f43611-91cd-4a23-b199-8502f1f70867", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67305", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msciabr6c623", "content": "CVE-2026-67305 - freerdp2\nThe FreeRDP Windows client before version 3.29.0 has a security flaw that could allow an attacker to take control of a user's computer by sending malicious data\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#freerdp2 #canonical #Ubuntu1604LTS #CVE #infosec", "creation_timestamp": "2026-08-05T02:30:03.868466Z"}, {"uuid": "85277dd2-5654-4199-b11f-72ddc52ecc36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67309", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8rxv-jg7p-wvg3", "content": "", "creation_timestamp": "2026-08-06T18:35:08.901133Z"}, {"uuid": "f5bf5ac8-e48b-491d-b00a-c9e05dbf5c1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67309", "type": "seen", "source": "https://gist.github.com/alon710/73aecb4bf7a9c9303fe6451f784d95ea", "content": "# CVE-2026-67309: CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67309\n\n## Summary\nA high-severity path traversal vulnerability exists in Traefik's Kubernetes Ingress NGINX provider. The flaw resides in the RewriteTarget middleware, which is auto-generated when an Ingress resource specifies the `nginx.ingress.kubernetes.io/rewrite-target` annotation. This allows remote, unauthenticated attackers to bypass route-level authentication and access restricted downstream endpoints by exploiting a parser differential.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Traefik's routing-layer security controls via relative dot-segment path traversals, gaining unauthorized access to restricted downstream backend resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0**: 7.8 (High)\n- **EPSS Score**: 0.00492\n- **Exploit Status**: PoC (No Weaponized)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy (Kubernetes Ingress NGINX provider environment with RewriteTarget enabled)\n- **Traefik**: >= v3.7.0, <= v3.7.7 (Fixed in: `v3.7.8`)\n\n## Mitigation\n\n- Upgrade Traefik to v3.7.8 or higher.\n- Enforce strict Ingress path regular expression matching by requiring trailing slashes.\n- Implement downstream validation rules to reject unnormalized URI segments.\n\n**Remediation Steps:**\n1. Identify all Kubernetes Ingress resources utilizing 'nginx.ingress.kubernetes.io/rewrite-target' or custom regex path replacement.\n2. Audit matching rules to ensure wildcards are separated by explicit directory boundaries (e.g., '/api/(.*)').\n3. Deploy Traefik v3.7.8 using Helm, YAML manifests, or the official Docker image update.\n4. Verify incoming logs for HTTP 400 responses indicating rejected path traversal attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-8rxv-jg7p-wvg3](https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67309) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T19:32:23.703855Z"}, {"uuid": "74060ab0-d43f-4e34-9d3d-2ebe821a68a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6730", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw7qy7wzot2u", "content": "\ud83d\udea8 CVE-2026-6730 \u2014 CVSS 9.8 CRITICAL\n\nIBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A l...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-6730\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-23T22:09:24.530324Z"}, {"uuid": "6edf50e2-260f-4a66-a0f3-a976739a9b8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6730", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwa474h5iu2r", "content": "CVE-2026-6730 - concert\nVersions 1.0.0 through 3.0.0 of IBM Concert can be tricked by a local user into running unwanted programs because the software does not properly check the size of certain data. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#concert #ibm #CVE #infosec", "creation_timestamp": "2026-09-24T01:30:09.130599Z"}, {"uuid": "f1a3e4e7-a3e2-488e-9443-dbea6b6de6cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6730", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwmyy3i7iu27", "content": "\ud83d\udccc CVE-2026-6730 - IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and exe... https://www.cyberhub.blog/cves/CVE-2026-6730", "creation_timestamp": "2026-09-29T04:37:07.361439Z"}]}