{"vulnerability": "cve-2026-7617", "sightings": [{"uuid": "9471458f-7185-42bb-9744-8f475adf6fbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7617", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mp476o2q2f26", "content": "CVE-2026-7617 wpoauth (CVSS Score 5.3) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-06-25T10:16:32.662345Z"}, {"uuid": "4c1e8e88-caf3-4db9-b67f-068802f03418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-76179", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05", "content": "", "creation_timestamp": "2026-08-27T16:15:21.541623Z"}, {"uuid": "fdb1a9cd-6c4b-4c32-813e-703fd7738cb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76179", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu7yugl4el2t", "content": "CVE-2026-76179\nEbyte gateway devices store their web\u2011management login tokens in a way that can be seen by someone who can view a user\u2019s session data. If an attacker captures that token, they can pretend to be the logged\u2011in\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-29T13:40:04.192817Z"}, {"uuid": "f8ab3cdd-305f-43fe-8049-510b7f2abbb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76179", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu4bqubl7e2j", "content": "\ud83d\udea8 CVE-2026-76179 \u2014 CVSS 9.3 CRITICAL\n\nAn improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Aut...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76179\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-28T02:08:28.769864Z"}, {"uuid": "67ba723c-9023-41cd-875c-f9c523c18c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76172", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mtt2uomns22b", "content": "\ud83d\udea8 High-severity security fix in fast-uri 2.4.5, 3.1.6, and 4.1.3 just released!\n\nPatches CVE-2026-76172. Host confusion via percent-encoded scheme normalization.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-08-24T10:11:24.990809Z"}, {"uuid": "88a8129e-d75e-4b5e-9931-54970f4477f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76172", "type": "seen", "source": "https://gist.github.com/alon710/af575107e879f298d568b88dd8bac4cb", "content": "# CVE-2026-76172: CVE-2026-76172: Parser Differential and Host Confusion in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76172\n\n## Summary\nA critical parser differential and host confusion vulnerability (CVE-2026-76172) exists in fast-uri, a dependency-free URI validation and normalization library for Node.js. This vulnerability stems from improper validation of the URI scheme component after decoding percent-encoded characters using the legacy global unescape() function. This allows structural characters such as path delimiters and control characters to be written raw into the output stream during serialization, causing host confusion, Server-Side Request Forgery (SSRF), or HTTP response splitting downstream.\n\n## TL;DR\nfast-uri parses percent-encoded schemes with lenient decoding and no validation, resulting in structure mutation, host confusion, and SSRF upon serialization.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-177\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00247 (Percentile: 15.89%)\n- **Impact**: Host Confusion / SSRF / HTTP Response Splitting\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri NPM package (versions 2.3.1 to 2.4.4, 3.0.0 to 3.1.5, and 4.0.0 to 4.1.2)\n- Fastify-dependent security gateways and reverse proxies utilizing fast-uri for input resolution and routing validation\n- **fast-uri**: >= 2.3.1 < 2.4.5 (Fixed in: `2.4.5`)\n- **fast-uri**: >= 3.0.0 < 3.1.6 (Fixed in: `3.1.6`)\n- **fast-uri**: >= 4.0.0 < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade fast-uri dependency to patched versions immediately.\n- Sanitize input URIs to reject percent-encoded sequences in the scheme component before parsing.\n- Align parser implementations across upstream validation layers and downstream HTTP clients to eliminate parser differentials.\n\n**Remediation Steps:**\n1. Audit the project dependency tree to locate instances of fast-uri using 'npm ls fast-uri' or 'yarn why fast-uri'.\n2. Execute the update command 'npm update fast-uri' or forcefully resolve fast-uri to safe versions.\n3. Verify that the lockfile reflects versions 2.4.5, 3.1.6, 4.1.3, or higher.\n4. Implement a central input validation regex for all user-controlled URLs to ensure the scheme strictly contains allowed alphanumeric characters prior to processing.\n\n## References\n\n- [GitHub Security Advisory GHSA-jqff-g426-hqxp](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD - CVE-2026-76172](https://nvd.nist.gov/vuln/detail/CVE-2026-76172)\n- [CVE.org - CVE-2026-76172](https://www.cve.org/CVERecord?id=CVE-2026-76172)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76172) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T19:33:12.843299Z"}, {"uuid": "0c16a482-2052-4a2a-b95d-c6882c464c74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76178", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/f7xdn7oz4na4y", "content": "CVE-2026-76178 - Multiple vulnerabilities in Ocsreports for OCS Inventory NG\nCVE ID : CVE-2026-76178\n \n Published : Sept. 3, 2026, 10:20 a.m. | 17\u00a0minutes ago\n \n Description : A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the e...", "creation_timestamp": "2026-09-03T10:44:25.610231Z"}, {"uuid": "2a3fbbca-ce82-401c-b57f-15cb54cebf3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76174", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/j2xudr2x2zzga", "content": "CVE-2026-76174 - Multiple vulnerabilities in Ocsreports for OCS Inventory NG\nCVE ID : CVE-2026-76174\n \n Published : Sept. 3, 2026, 9:38 a.m. | 59\u00a0minutes ago\n \n Description : Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_in...", "creation_timestamp": "2026-09-03T10:50:25.222852Z"}, {"uuid": "cf32d8f2-3e0b-4ead-accb-e5f6c3943519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76175", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7nqbvpo4r4i2g", "content": "CVE-2026-76175 - Multiple vulnerabilities in Ocsreports for OCS Inventory NG\nCVE ID : CVE-2026-76175\n \n Published : Sept. 3, 2026, 9:44 a.m. | 52\u00a0minutes ago\n \n Description : SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list en...", "creation_timestamp": "2026-09-03T10:56:25.434706Z"}, {"uuid": "d91aa0d2-63e6-42d7-83fe-9499262207da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76176", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/37gv4ptodjy32", "content": "CVE-2026-76176 - Multiple vulnerabilities in Ocsreports for OCS Inventory NG\nCVE ID : CVE-2026-76176\n \n Published : Sept. 3, 2026, 9:47 a.m. | 50\u00a0minutes ago\n \n Description : SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to imprope...", "creation_timestamp": "2026-09-03T10:58:24.811654Z"}, {"uuid": "261b6de5-5096-4418-bc17-b012d47e4e89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76174", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mummphzzjj2o", "content": "\ud83d\udea8 CVE-2026-76174 \u2014 CVSS 9.4 CRITICAL\n\nUnrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info en...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76174\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-03T14:07:09.513245Z"}, {"uuid": "cacb583a-9c73-4722-97ac-b57c2e129a5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76178", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mummprovor2t", "content": "\ud83d\udea8 CVE-2026-76178 \u2014 CVSS 9.2 CRITICAL\n\nA stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoin...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76178\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-03T14:07:20.543349Z"}, {"uuid": "e9cf4bcd-5dd6-4507-9d1a-c61dd1542a11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76174", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mumngke5nu2o", "content": "CVE-2026-76174 - ocsreports\nThe Ocsreports reporting tool lets administrators upload CSV files, but it only checks the file name, not the actual content. This means a malicious script could be placed on the web\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ocsreports #CVE #infosec", "creation_timestamp": "2026-09-03T14:20:03.693669Z"}]}