{"vulnerability": "cve-2026-8654", "sightings": [{"uuid": "87a1e4d8-e58f-40a2-af3b-a1769e0ba933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86543", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117232476810981498", "content": "CVE-2026-86543: CRITICAL vuln in knowns-dev knowns <0.30.0. Mgmt API is exposed w/o auth by default, allowing attackers to create public tunnels. Restrict access & upgrade ASAP. https://radar.offseq.com/threat/cve-2026-86543-missing-authentication-for-critical-function-in-knowns-dev-knowns-3a84bb55b20322bc #OffSeq #CVE2026_86543 #Vulnerability #APIsecurity", "creation_timestamp": "2026-09-08T00:00:36.343482Z"}, {"uuid": "a013436c-bb4c-4b97-8514-3010552dc37f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86543", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3muxpqdzfmn2e", "content": "CRITICAL: knowns-dev knowns <0.30.0 exposes mgmt API without auth \u2014 attackers can create public tunnels. Restrict API access & upgrade to 0.30.0+ as soon as possible. https://radar.offseq.com/threat/cve-2026-86543-missing-authentication-for-critical-function-in-knowns-dev-knowns-3a84bb55b20322bc ...", "creation_timestamp": "2026-09-08T00:00:37.865425Z"}, {"uuid": "81d2fe2e-10b7-4769-9dcb-431f75387fdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86544", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpvecsqn2o", "content": "\ud83d\udfe0 CVE-2026-86544 - High (8.1)\n\nknowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86544/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-08T00:03:25.660777Z"}, {"uuid": "73e489cb-e530-4bef-9aad-a2a5747bd6ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86540", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpxhjqtr22", "content": "\ud83d\udfe0 CVE-2026-86540 - High (7.8)\n\nknowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86540/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-08T00:04:36.831925Z"}, {"uuid": "e5b41925-af23-4236-923d-623dac4b0daa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86542", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpux7hsz22", "content": "\ud83d\udd34 CVE-2026-86542 - Critical (9.1)\n\nknowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticate...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86542/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-08T00:03:12.704601Z"}, {"uuid": "deff8bc6-150c-40c3-a37b-4ee960606968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86543", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpv5ru6t2z", "content": "\ud83d\udd34 CVE-2026-86543 - Critical (9.8)\n\nknowns versions before 0.30.0 serve the management API without authentication on all network inte...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86543/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-08T00:03:19.000926Z"}, {"uuid": "6e359119-a2b0-414d-bea6-0339149e4ebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86543", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muxq42qj7f2g", "content": "\ud83d\udea8 CVE-2026-86543 \u2014 CVSS 9.3 CRITICAL\n\nknowns versions before 0.30.0 serve the management API without authentication on all network interfaces by ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86543\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-08T00:07:10.264447Z"}, {"uuid": "4c78e15c-b7bf-44fa-aabd-1c4100713ebc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86541", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muxt54eecs2k", "content": "\ud83d\udfe0 CVE-2026-86541 - High (8.3)\n\nknowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() f...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86541/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-08T01:01:27.566325Z"}, {"uuid": "da5d03d5-ded2-417f-b60d-7791af66350a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86543", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muysdz66x52j", "content": "CVE-2026-86543 - knowns\nVersions of the Knowns software earlier than 0.30.0 expose a management interface that anyone on the network can reach without a password. This allows an attacker to start a tunnel\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#knowns #knownsdev #CVE #infosec", "creation_timestamp": "2026-09-08T10:20:04.120561Z"}, {"uuid": "15f30d0f-d25d-4c84-a166-2a3fa2cd6e70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86542", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muyrs6o7z42n", "content": "CVE-2026-86542 - knowns\nVersions of the knowns software earlier than 0.30.0 do not check the names used when importing files. This allows a remote user to trick the system into saving files outside the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#knowns #knownsdev #CVE #infosec", "creation_timestamp": "2026-09-08T10:10:05.782954Z"}, {"uuid": "176e2203-e116-42f8-adff-5791e009294b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86541", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muz3c77uf42g", "content": "CVE-2026-86541 - knowns\nVersions of the Knows tool older than 0.30.0 let a user supply specially crafted file names to the code\u2011replace feature, causing the program to write data outside its own folder.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#knowns #knownsdev #CVE #infosec", "creation_timestamp": "2026-09-08T13:00:07.800127Z"}, {"uuid": "ffdb8b1a-0c14-46fd-af0f-a20107a0a5b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86547", "type": "seen", "source": "Telegram/ZDsKk6umJ3OlCagGo0wD54oo8d8XbKXnBjolAPHYcDQ0RXY", "content": "", "creation_timestamp": "2026-09-14T03:00:12.021114Z"}, {"uuid": "44a108d6-0b4c-4827-929a-874af19a660f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86547", "type": "seen", "source": "Telegram/ZDsKk6umJ3OlCagGo0wD54oo8d8XbKXnBjolAPHYcDQ0RXY", "content": "", "creation_timestamp": "2026-09-15T00:00:23.799782Z"}]}