https://vulnerability.circl.lu/sightings/feed 2026-09-17T14:17:03.160911+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f5fa485d-e24f-49a0-8b6b-91803c63268f/export 2026-09-17T14:17:03.170317+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f5fa485d-e24f-49a0-8b6b-91803c63268f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0412", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/41b21563-e42a-4a21-8499-0f3b652b1e66", "content": "", "creation_timestamp": "2026-09-17T11:00:35.865813Z"} 2026-09-17T11:00:35.865813+00:00 https://vulnerability.circl.lu/sighting/dd4ad12b-e341-4c09-863c-3e6e880c3ff6/export 2026-09-17T14:17:03.171933+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "dd4ad12b-e341-4c09-863c-3e6e880c3ff6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0434", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b34d58bc-6a41-4594-a58d-8aa587199e1a", "content": "", "creation_timestamp": "2026-09-17T11:00:35.722406Z"} 2026-09-17T11:00:35.722406+00:00 https://vulnerability.circl.lu/sighting/3c8c6208-cb3f-4065-843e-37b02c0decd7/export 2026-09-17T14:17:03.172100+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3c8c6208-cb3f-4065-843e-37b02c0decd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0441", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5960", "content": "exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441\n\n3. Bypassing .NET Serialization Binders:\nCase studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277)\nhttps://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html", "creation_timestamp": "2026-09-11T00:00:47.534039Z"} 2026-09-11T00:00:47.534039+00:00 https://vulnerability.circl.lu/sighting/97975bac-ddb7-4a0e-ad04-e89b2d79e0d3/export 2026-09-17T14:17:03.172241+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "97975bac-ddb7-4a0e-ad04-e89b2d79e0d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://t.me/cissp/5722", "content": "Analytics\nTop 10 Most Used Vulns of the Month\n\nCVE-2022-1096 - Type Confusion in V8\nhttps://github.com/Maverick-cmd/Chrome-and-Edge-Version-Dumper\n\nCVE-2022-0847 - Dirty Pipe Vuln\n\nCVE-2022-0778 - OpenSSL Illegal x.509 certificate construction\n\nCVE-2022-0492 - Privilege escalation vuln causing container escape\nhttps://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig\n\nCVE-2022-22947 - Spring Cloud Gateway RCE\n\nCVE-2022-22963 - Spring Core RCE\n\nCVE-2022-25636 - net/netfilter/nf_dup_netdev.c in the Linux kernel <5.6.10 allows local users to gain privileges because of a heap out-of-bounds write\n\nCVE-2022-27254 - Vuln in Honda's Remote Keyless System\nhttps://github.com/nonamecoder/CVE-2022-27254\n\nCVE-2022-0609 - https://blog.google/threat-analysis-group/countering-threats-north-korea", "creation_timestamp": "2026-09-11T00:00:43.236593Z"} 2026-09-11T00:00:43.236593+00:00 https://vulnerability.circl.lu/sighting/213c4e04-750f-41b2-b67d-ecaaf5a919c5/export 2026-09-17T14:17:03.172356+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "213c4e04-750f-41b2-b67d-ecaaf5a919c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5466", "content": "Imperva has reported that the website of one of its customers was recently the target of a ransom-driven DDoS attack that reached a peak of 2.5 million \ud83e\udd13requests per second (RPS).\nRead details: https://thehackernews.com/2022/03/imperva-thwarts-25-million-rps-ransom.html\n\nResearchers warn of a new high-risk vulnerability (CVE-2022-0492) affecting the Linux kernel's cgroups \ud83e\udd2ffeature that could potentially be abused to escape a container to execute arbitrary commands on the host.\nRead details: https://thehackernews.com/2022/03/new-linux-kernel-cgroups-vulnerability.html\n\nU.S. cybersecurity agency CISA has added a new batch of 95 actively exploited flaws to its \"Known Exploited Vulnerabilities Catalog.\"\ud83d\ude17\nRead: https://thehackernews.com/2022/03/cisa-adds-another-95-flaws-to-its.html\n\nMozilla has warned hundreds of millions of Firefox users about newly discovered 0-day bugs (CVE-2022-26485, CVE-2022-26486) that are being exploited in the wild.\ud83d\ude10\nhttps://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html\nUpdate to Firefox 97.0.2, ESR 91.6.1, Android v97.3.0, Focus 97.3.0 & Thunderbird 91.6.2.\n\nUkrainian Computer Emergency Response Team (CERT-UA) warns of new phishing attacks against its citizens using compromised email accounts from Indian entities.\ud83e\udd78\nRead: https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html\n\nNewly disclosed vulnerabilities in the operating system for TerraMaster NAS devices can be chained to achieve unauthorized RCE with highest privileges.\nhttps://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html", "creation_timestamp": "2026-09-11T00:00:42.290959Z"} 2026-09-11T00:00:42.290959+00:00 https://vulnerability.circl.lu/sighting/ddf6c6ee-8c50-40f7-8192-6cb73d25c088/export 2026-09-17T14:17:03.172474+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ddf6c6ee-8c50-40f7-8192-6cb73d25c088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5466", "content": "Imperva has reported that the website of one of its customers was recently the target of a ransom-driven DDoS attack that reached a peak of 2.5 million \ud83e\udd13requests per second (RPS).\nRead details: https://thehackernews.com/2022/03/imperva-thwarts-25-million-rps-ransom.html\n\nResearchers warn of a new high-risk vulnerability (CVE-2022-0492) affecting the Linux kernel's cgroups \ud83e\udd2ffeature that could potentially be abused to escape a container to execute arbitrary commands on the host.\nRead details: https://thehackernews.com/2022/03/new-linux-kernel-cgroups-vulnerability.html\n\nU.S. cybersecurity agency CISA has added a new batch of 95 actively exploited flaws to its \"Known Exploited Vulnerabilities Catalog.\"\ud83d\ude17\nRead: https://thehackernews.com/2022/03/cisa-adds-another-95-flaws-to-its.html\n\nMozilla has warned hundreds of millions of Firefox users about newly discovered 0-day bugs (CVE-2022-26485, CVE-2022-26486) that are being exploited in the wild.\ud83d\ude10\nhttps://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html\nUpdate to Firefox 97.0.2, ESR 91.6.1, Android v97.3.0, Focus 97.3.0 & Thunderbird 91.6.2.\n\nUkrainian Computer Emergency Response Team (CERT-UA) warns of new phishing attacks against its citizens using compromised email accounts from Indian entities.\ud83e\udd78\nRead: https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html\n\nNewly disclosed vulnerabilities in the operating system for TerraMaster NAS devices can be chained to achieve unauthorized RCE with highest privileges.\nhttps://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html", "creation_timestamp": "2026-09-10T11:00:04.273296Z"} 2026-09-10T11:00:04.273296+00:00 https://vulnerability.circl.lu/sighting/af674a21-30eb-4e1d-917b-951b7205dae5/export 2026-09-17T14:17:03.172590+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "af674a21-30eb-4e1d-917b-951b7205dae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://t.me/cissp/5722", "content": "Analytics\nTop 10 Most Used Vulns of the Month\n\nCVE-2022-1096 - Type Confusion in V8\nhttps://github.com/Maverick-cmd/Chrome-and-Edge-Version-Dumper\n\nCVE-2022-0847 - Dirty Pipe Vuln\n\nCVE-2022-0778 - OpenSSL Illegal x.509 certificate construction\n\nCVE-2022-0492 - Privilege escalation vuln causing container escape\nhttps://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig\n\nCVE-2022-22947 - Spring Cloud Gateway RCE\n\nCVE-2022-22963 - Spring Core RCE\n\nCVE-2022-25636 - net/netfilter/nf_dup_netdev.c in the Linux kernel <5.6.10 allows local users to gain privileges because of a heap out-of-bounds write\n\nCVE-2022-27254 - Vuln in Honda's Remote Keyless System\nhttps://github.com/nonamecoder/CVE-2022-27254\n\nCVE-2022-0609 - https://blog.google/threat-analysis-group/countering-threats-north-korea", "creation_timestamp": "2026-09-10T10:00:05.109983Z"} 2026-09-10T10:00:05.109983+00:00 https://vulnerability.circl.lu/sighting/30e165be-0dfa-4e77-90c1-228c49e888dc/export 2026-09-17T14:17:03.172692+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "30e165be-0dfa-4e77-90c1-228c49e888dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0441", "type": "published-proof-of-concept", "source": "https://t.me/cissp/5960", "content": "exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441\n\n3. Bypassing .NET Serialization Binders:\nCase studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277)\nhttps://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html", "creation_timestamp": "2026-09-10T08:00:05.909699Z"} 2026-09-10T08:00:05.909699+00:00 https://vulnerability.circl.lu/sighting/9eeccbe0-3014-4f23-b83d-3b8c3ac7972e/export 2026-09-17T14:17:03.172795+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9eeccbe0-3014-4f23-b83d-3b8c3ac7972e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64, cmd\", \"author\": [\"h00die\", \"Yiqi Sun\", \"Kevin Wang\", \"T1erno\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This exploit module takes advantage of a Docker image which has either the privileged flag, or SYS_ADMIN Linux capability.\\n If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system.\\n\\n A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.\\n This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges\\n and bypass the namespace isolation unexpectedly.\\n\\n More simply put, cgroups v1 has a feature called release_agent that runs a program when a process in the cgroup terminates.\\n If notify_on_release is enabled, the kernel runs the release_agent binary as root. By editing the release_agent file,\\n an attacker can execute their own binary with elevated privileges, taking control of the system. However, the release_agent\\n file is owned by root, so only a user with root access can modify it.\", \"disclosure_date\": \"2022-02-04\", \"fullname\": \"exploit/linux/local/docker_cgroup_escape\", \"is_install_path\": true, \"mod_time\": \"2026-05-25 09:47:44 +0000\", \"name\": \"Docker cgroups Container Escape\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/docker_cgroup_escape.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/docker_cgroup_escape\", \"references\": [\"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af\", \"URL-https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/\", \"URL-https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC\", \"URL-https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492\", \"URL-https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker/blob/main/escape-check.sh\", \"URL-https://pwning.systems/posts/escaping-containers-for-fun/\", \"URL-https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html\", \"URL-https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation\", \"URL-https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/\", \"CVE-2022-0492\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"BINARY\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:07.699412Z"} 2026-09-08T06:49:07.699412+00:00 https://vulnerability.circl.lu/sighting/12d96f2e-2e5d-4d05-9606-027e6f3faabf/export 2026-09-17T14:17:03.172926+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "12d96f2e-2e5d-4d05-9606-027e6f3faabf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0441", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_masterstudy_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"Numan T\\u00fcrle\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"MasterStudy LMS, a WordPress plugin,\\n prior to 2.7.6 is affected by a privilege escalation where an unauthenticated\\n user is able to create an administrator account for wordpress itself.\", \"disclosure_date\": \"2022-02-18\", \"fullname\": \"auxiliary/admin/http/wp_masterstudy_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Wordpress MasterStudy Admin Account Creation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/wp_masterstudy_privesc.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/wp_masterstudy_privesc\", \"references\": [\"CVE-2022-0441\", \"URL-https://gist.github.com/numanturle/4762b497d3b56f1a399ea69aa02522a6\", \"EDB-50752\", \"WPVDB-173c2efe-ee9c-4539-852f-c242b4f728ed\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:51.964312Z"} 2026-09-08T06:46:51.964312+00:00