{"vulnerability": "cve-2026-6759", "sightings": [{"uuid": "28fb83f5-8ad3-4734-b8f8-cb97e51ca9d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6759", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mk2fobkx3t2w", "content": "", "creation_timestamp": "2026-04-22T02:01:22.125542Z"}, {"uuid": "fe156bc7-32c7-44dc-b816-a8e7c0a62cb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6759", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities_20260422", "content": "", "creation_timestamp": "2026-04-21T20:00:00.000000Z"}, {"uuid": "f97a63b4-b119-4a6a-aa16-a5698a402f09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6759", "type": "seen", "source": "Telegram/sOCPjtJD4k5MvWwp6dRuETsdkHJ60Tze_O4tn1nY_4b7uMQ", "content": "", "creation_timestamp": "2026-04-21T19:25:08.000000Z"}, {"uuid": "3ed6ba37-6390-4281-8095-9272f82d6930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67594", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrva7x7eag22", "content": "CVE-2026-67594 - spikster\nSpikster's API allows unauthorized access to sensitive functions, such as server enumeration and password reset. This vulnerability puts your servers and data at risk. Update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#spikster #yolanmees #CVE #infosec", "creation_timestamp": "2026-07-30T20:02:06.267324Z"}, {"uuid": "12566ade-ddd9-40ab-98e1-b861a55808ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67594", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvdib25zu2j", "content": "\ud83d\udd34 CVE-2026-67594 - Critical (9.8)\n\nSpikster through commit e1cdf8c contains a missing authentication vulnerability that allows unaut...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67594/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-30T21:00:27.028546Z"}, {"uuid": "d3c6d07c-6d98-4f5a-a373-7097b9b67d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67595", "type": "published-proof-of-concept", "source": "Telegram/LkH85X-JUMEtHWq9ccTX7RdLtAYJyJlmaTWlNzBdkhBs1mA", "content": "", "creation_timestamp": "2026-08-03T02:13:57.092525Z"}, {"uuid": "f6253d07-7fb1-43a5-91da-5b879bb740bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67590", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3xxd5lc2zvh3f", "content": "CVE-2026-67590: Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow", "creation_timestamp": "2026-08-04T20:00:41.770177Z"}, {"uuid": "6b67dccd-dbc7-4d65-b695-9c9958a59e63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67591", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/ayo27b4c6lfg2", "content": "CVE-2026-67591: Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded", "creation_timestamp": "2026-08-04T20:06:41.607582Z"}, {"uuid": "425b74dc-767f-4f85-a6d2-79386548b83c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67592", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/7p5nbufssz34w", "content": "CVE-2026-67592: Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery", "creation_timestamp": "2026-08-04T20:12:38.261857Z"}, {"uuid": "d7363195-d930-437a-8b60-c733db76d2f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67599", "type": "published-proof-of-concept", "source": "Telegram/A6qFAVNxP6Ryt2RMDMYFF5Y-UPjLnX51xt-O998Q-AV03LU", "content": "", "creation_timestamp": "2026-08-02T00:01:15.024194Z"}, {"uuid": "0d092175-ca53-474f-a83f-2de909b1fb49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67599", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96071", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67599_ClearOS_RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LazyTitan33\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 22:50:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAuthenticated Blind OS Command Injection in ClearOS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-02T00:01:20.932445Z"}, {"uuid": "d994f91c-d52e-42d1-8d58-36ecb7fdba59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67595", "type": "published-proof-of-concept", "source": "Telegram/LkH85X-JUMEtHWq9ccTX7RdLtAYJyJlmaTWlNzBdkhBs1mA", "content": "", "creation_timestamp": "2026-08-02T06:08:45.838987Z"}, {"uuid": "d4414ab2-78f1-4451-9b0f-4ade924c8ce7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67596", "type": "seen", "source": "https://gist.github.com/fkan001/9eb1ebd3d98743c920f2fd241a51ccbb", "content": "# G03-20 \u2014 PCCW Entra Tenant c5924da6 Deep Recon\nDate: 2026-08-02 | Operator: EH | ROE: unauth/read-only, single-attempt credential discipline\nEvidence root: /mnt/agents/output/evidence/work/g03-tenant-c5924da6/ (all items evlogged, sha256 in manifest, gist-synced)\n\n## 1. Tenant liveness \u2014 CONFIRMED\n- Tenant c5924da6-deb3-421b-aa98-57bcba0ba050 live; v2.0 openid-configuration served; token endpoint accepts client_secret_post/basic, private_key_jwt.\n- Evidence: openid-config.json\n\n## 2. Domain \u2192 tenant map \u2014 CONFIRMED (unauth, getuserrealm.srf + openid-config)\n| Domain | Tenant | Type |\n|---|---|---|\n| pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| corphq.hk.pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| pccwsolutions.com | **c5924da6** | Managed (cloud auth) |\n| hkt.com | **c5924da6** | Managed |\n| hkcsl.com | **c5924da6** | Managed |\n| theclub.com.hk | **c5924da6** | Managed |\n| netvigator.com | faa25108-\u2026 | Managed \u2014 SEPARATE tenant |\n| pccwglobal.com | 024d6fa0-\u2026 | Managed \u2014 SEPARATE tenant |\n| nowtv.com | 68b865d5-\u2026 | Managed \u2014 SEPARATE tenant |\n| biznetvigator.com | 3aa20025-\u2026 | Managed \u2014 SEPARATE tenant |\n| hkt.com.hk, csl.com.hk, 1010.com.hk, cslmobile.com, onenet.com.hk | none | Unknown |\n| now.com.hk, viu.com, moov.com.hk, club.com.hk, hkteducation.com, hkte.com, hktpremier.com, pccwmobile.com, eyechat.com.hk, uhubplus.com | various others | Unknown/other tenants |\n- Evidence: domain-tenant-map.txt\n- Key blast-radius correction: **netvigator.com and pccwglobal.com are NOT in c5924da6** \u2014 Monday-token blast radius is the 6 c5924da6 domains, not the whole brand family.\n\n## 3. Leaked app db684a8a \u2014 Variant C status: BLOCKED (single attempt, ROE-compliant)\n- POST token (client_credentials) \u2192 AADSTS7000222: \"provided client secret keys \u2026 are EXPIRED\".\n- 7000222 fires after app lookup \u21d2 **app registration db684a8a is ALIVE** in tenant; only the leaked secret is dead (expired, not revoked-visible).\n- Implication: MFA-bypass Variant C (app client_credentials) is currently BLOCKED for us. But the app object surviving means: (a) HKT remediation scrubbed the secret value's validity window, not the app; (b) if the owner (Kilson's process) still owns the app, only Variant B (dispenser refresh-token) remains the live vending path \u2192 Monday poll is decisive.\n- Evidence: token-attempt-1.json (Trace d6bf1081)\n\n## 4. ADFS rms.pccw.com \u2014 CONFIRMED internet-facing corporate IdP\n- TLS cert: O=PCCW-HKT DataCom Services Limited, CN=rms.pccw.com, GlobalSign, valid to 2026-10-13. Attribution CONFIRMED corporate (attack-surface-recon checklist item 3).\n- federationmetadata.xml + adfs .well-known/openid-configuration served unauth.\n- Sign-in page /adfs/ls: FormsAuthentication with Username+Password enabled \u2192 internet-exposed password endpoint for BOTH federated domains (pccw.com, corphq.hk.pccw.com).\n- Password-spray surface: NOT TESTED (ROE: no spray without explicit ZY go). Label: ANALYTIC (surface observed, exploitability untested).\n- Evidence: adfs-fedmeta.xml, adfs-ls.html\n\n## 5. SharePoint Online tenancies \u2014 CONFIRMED existence \u00d73\n- pccw0.sharepoint.com, pccw.sharepoint.com, hkt.sharepoint.com all return 307 (tenant exists); hktenterprise/pccwglobal SPO do not resolve from sandbox.\n- Note: multiple SPO tenancies vs one Entra tenant = tenancy sprawl; each SPO root has its own anon-sharing posture (gated 403 on root, expected).\n\n## 6. Seamless SSO \u2014 UNPROVEN\n- autologon.microsoftazuread-sso.com/pccw.com returned generic HTML sign-in (200), not the Kerberos/usernamemixed WIA endpoint response \u2192 cannot confirm seamless-SSO computer-account AZUREADSSOACC exposure unauth. Kept as honest negative.\n\n## 7. Closures per ZY 2026-08-02\n- emailService SEND: confirmed unexploitable by ZY inbox check \u21d2 **13/13 G03-17 flows dead**. Final label: BLOCKED (remediated).\n- CVE-2026-67596 (CSL 3G module): DROPPED per ZY. Prior verdict stands (no remote vector, customer CPE attribution, EOL \u2192 census/isolate). Logged as --type note closure.\n\n## 8. Attack-surface deltas worth ZY attention\n1. ADFS forms-auth endpoint internet-facing + federated pccw.com = single password-guess channel into corporate creds; recommend ADFS extranet lockout/smart-lockout verification + WAF rate-limit. (ANALYTIC)\n2. App db684a8a still exists in tenant \u2014 recommend delete app reg entirely, not just secret expiry; also audit other secrets/certs on the app (we can only see the expired one unauth). (CONFIRMED existence / ANALYTIC residual risk)\n3. Tenancy hygiene: 6 domains on c5924da6 incl. legacy LPS (pccwsolutions.com) \u2014 R10 finding cross-ref: de-federate/retire LPS domain from corporate tenant. (CONFIRMED mapping)\n", "creation_timestamp": "2026-08-02T09:09:28.125583Z"}, {"uuid": "ee9e0682-ed20-4704-bf2c-b8008bed7524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67596", "type": "seen", "source": "https://gist.github.com/fkan001/86026af6c6a04b70229801e3a084d44a", "content": "# G03-20 \u2014 PCCW Entra Tenant c5924da6 Deep Recon\nDate: 2026-08-02 | Operator: EH | ROE: unauth/read-only, single-attempt credential discipline\nEvidence root: /mnt/agents/output/evidence/work/g03-tenant-c5924da6/ (all items evlogged, sha256 in manifest, gist-synced)\n\n## 1. Tenant liveness \u2014 CONFIRMED\n- Tenant c5924da6-deb3-421b-aa98-57bcba0ba050 live; v2.0 openid-configuration served; token endpoint accepts client_secret_post/basic, private_key_jwt.\n- Evidence: openid-config.json\n\n## 2. Domain \u2192 tenant map \u2014 CONFIRMED (unauth, getuserrealm.srf + openid-config)\n| Domain | Tenant | Type |\n|---|---|---|\n| pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| corphq.hk.pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| pccwsolutions.com | **c5924da6** | Managed (cloud auth) |\n| hkt.com | **c5924da6** | Managed |\n| hkcsl.com | **c5924da6** | Managed |\n| theclub.com.hk | **c5924da6** | Managed |\n| netvigator.com | faa25108-\u2026 | Managed \u2014 SEPARATE tenant |\n| pccwglobal.com | 024d6fa0-\u2026 | Managed \u2014 SEPARATE tenant |\n| nowtv.com | 68b865d5-\u2026 | Managed \u2014 SEPARATE tenant |\n| biznetvigator.com | 3aa20025-\u2026 | Managed \u2014 SEPARATE tenant |\n| hkt.com.hk, csl.com.hk, 1010.com.hk, cslmobile.com, onenet.com.hk | none | Unknown |\n| now.com.hk, viu.com, moov.com.hk, club.com.hk, hkteducation.com, hkte.com, hktpremier.com, pccwmobile.com, eyechat.com.hk, uhubplus.com | various others | Unknown/other tenants |\n- Evidence: domain-tenant-map.txt\n- Key blast-radius correction: **netvigator.com and pccwglobal.com are NOT in c5924da6** \u2014 Monday-token blast radius is the 6 c5924da6 domains, not the whole brand family.\n\n## 3. Leaked app db684a8a \u2014 Variant C status: BLOCKED (single attempt, ROE-compliant)\n- POST token (client_credentials) \u2192 AADSTS7000222: \"provided client secret keys \u2026 are EXPIRED\".\n- 7000222 fires after app lookup \u21d2 **app registration db684a8a is ALIVE** in tenant; only the leaked secret is dead (expired, not revoked-visible).\n- Implication: MFA-bypass Variant C (app client_credentials) is currently BLOCKED for us. But the app object surviving means: (a) HKT remediation scrubbed the secret value's validity window, not the app; (b) if the owner (Kilson's process) still owns the app, only Variant B (dispenser refresh-token) remains the live vending path \u2192 Monday poll is decisive.\n- Evidence: token-attempt-1.json (Trace d6bf1081)\n\n## 4. ADFS rms.pccw.com \u2014 CONFIRMED internet-facing corporate IdP\n- TLS cert: O=PCCW-HKT DataCom Services Limited, CN=rms.pccw.com, GlobalSign, valid to 2026-10-13. Attribution CONFIRMED corporate (attack-surface-recon checklist item 3).\n- federationmetadata.xml + adfs .well-known/openid-configuration served unauth.\n- Sign-in page /adfs/ls: FormsAuthentication with Username+Password enabled \u2192 internet-exposed password endpoint for BOTH federated domains (pccw.com, corphq.hk.pccw.com).\n- Password-spray surface: NOT TESTED (ROE: no spray without explicit ZY go). Label: ANALYTIC (surface observed, exploitability untested).\n- Evidence: adfs-fedmeta.xml, adfs-ls.html\n\n## 5. SharePoint Online tenancies \u2014 CONFIRMED existence \u00d73\n- pccw0.sharepoint.com, pccw.sharepoint.com, hkt.sharepoint.com all return 307 (tenant exists); hktenterprise/pccwglobal SPO do not resolve from sandbox.\n- Note: multiple SPO tenancies vs one Entra tenant = tenancy sprawl; each SPO root has its own anon-sharing posture (gated 403 on root, expected).\n\n## 6. Seamless SSO \u2014 UNPROVEN\n- autologon.microsoftazuread-sso.com/pccw.com returned generic HTML sign-in (200), not the Kerberos/usernamemixed WIA endpoint response \u2192 cannot confirm seamless-SSO computer-account AZUREADSSOACC exposure unauth. Kept as honest negative.\n\n## 7. Closures per ZY 2026-08-02\n- emailService SEND: confirmed unexploitable by ZY inbox check \u21d2 **13/13 G03-17 flows dead**. Final label: BLOCKED (remediated).\n- CVE-2026-67596 (CSL 3G module): DROPPED per ZY. Prior verdict stands (no remote vector, customer CPE attribution, EOL \u2192 census/isolate). Logged as --type note closure.\n\n## 8. Attack-surface deltas worth ZY attention\n1. ADFS forms-auth endpoint internet-facing + federated pccw.com = single password-guess channel into corporate creds; recommend ADFS extranet lockout/smart-lockout verification + WAF rate-limit. (ANALYTIC)\n2. App db684a8a still exists in tenant \u2014 recommend delete app reg entirely, not just secret expiry; also audit other secrets/certs on the app (we can only see the expired one unauth). (CONFIRMED existence / ANALYTIC residual risk)\n3. Tenancy hygiene: 6 domains on c5924da6 incl. legacy LPS (pccwsolutions.com) \u2014 R10 finding cross-ref: de-federate/retire LPS domain from corporate tenant. (CONFIRMED mapping)\n", "creation_timestamp": "2026-08-02T09:29:17.334563Z"}, {"uuid": "ae8c6b03-f4ca-4ddc-ae4c-3c38a285ba26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67598", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7f2blmgt2q", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-67598](https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5)\nEmlog Pr...\nhttps://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5 #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-08-03T20:55:02.802565Z"}, {"uuid": "0cc91f12-acc5-4847-b8c6-51da5df5ac04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67598", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7fgvrgmd2i", "content": "CVE-2026-67598 - emlog\nEmlog Pro versions up to 2.6.23 may allow hackers to intercept sensitive data sent over HTTPS connections to certain services. This could allow them to steal important security keys or inject\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#emlog #CVE #infosec", "creation_timestamp": "2026-08-03T21:02:05.738864Z"}, {"uuid": "64ea02b0-5fae-4f20-bb78-b834eafd72fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67599", "type": "seen", "source": "https://t.me/GithubRedTeam/96071", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67599_ClearOS_RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LazyTitan33\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 22:50:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAuthenticated Blind OS Command Injection in ClearOS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-01T01:00:04.758276Z"}, {"uuid": "063c281c-5aa8-4583-8d95-d222893bf493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67595", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mryn35w7dr2h", "content": "CVE-2026-67595\nVaahCMS versions 2.0.0 through 2.3.4 contain a security risk in their OTP email feature. If a user with JavaScript enabled receives a malicious email, it can secretly install a keylogger and capture sensitive\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-01T04:30:03.717269Z"}, {"uuid": "a73ba013-1ff5-45b2-b897-24696694bba9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67599", "type": "seen", "source": "Telegram/A6qFAVNxP6Ryt2RMDMYFF5Y-UPjLnX51xt-O998Q-AV03LU", "content": "", "creation_timestamp": "2026-08-01T05:00:04.827921Z"}, {"uuid": "d5d1df99-0fcd-4b00-a404-3b4f6b4643c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67595", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsz5fry6g2u", "content": "CVE-2026-67595\nVaahCMS versions 2.0.0 to 2.3.4 have a security flaw in their email system that could allow hackers to steal passwords from users who open a malicious email in their browser. This means that anyone using these\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-29T22:50:15.033621Z"}, {"uuid": "94e1651c-d4cc-4637-a821-3cba24f0f840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67595", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrt52dd6wg2c", "content": "\ud83d\udfe0 CVE-2026-67595 - High (8.1)\n\nVaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded i...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67595/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T23:59:57.894861Z"}, {"uuid": "eb8ed76d-1ab8-4b12-b453-9318f1d5c763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67595", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrt53khbxv2t", "content": "VaahCMS 2.0.0 \u2013 2.3.4 hit by CRITICAL vuln: OTP email templates contain malicious JS enabling code execution, keylogging, & C2. Avoid JS-enabled email rendering. Await vendor patch. https://radar.offseq.com/threat/cve-2026-67595-embedded-malicious-code-in-webreinvent-vaahcms-94fc0638a0fe22eb #Off...", "creation_timestamp": "2026-07-30T00:00:38.645654Z"}]}