https://vulnerability.circl.lu/sightings/feed 2026-09-17T23:36:06.643298+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/02c5c97c-24a2-4b25-ad93-170fd7b3a4e7/export 2026-09-17T23:36:06.655636+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "02c5c97c-24a2-4b25-ad93-170fd7b3a4e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvpw72c6432n", "content": "\ud83d\udce2 Red Heron exploite CVE-2026-60004 dans Gitea pour d\u00e9ployer un rootkit Linux in\u00e9dit\n\nL'Acronis Threat Research Unit (TRU) a publi\u00e9 le 13 septembre 2026 une analyse d\u00e9taill\u00e9e d'une campagne multinationale men\u00e9e par un acteur\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#RedHeron #RootkitLinux #Cyberveille", "creation_timestamp": "2026-09-17T15:00:07.499039Z"} 2026-09-17T15:00:07.499039+00:00 https://vulnerability.circl.lu/sighting/2ded3e6b-6919-47d3-9543-5cb086441373/export 2026-09-17T23:36:06.658646+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2ded3e6b-6919-47d3-9543-5cb086441373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mvomyrzrpk2p", "content": "Forty-eight hours, Morty. Acronis says Red Heron flipped a public Gitea RCE\u2014CVE-2026-60004\u2014into an automated heist across ~1,386 boxes. Defense, elections, energy nested. Self-hosted git as a spy gift shop. Your patch calendar just auctioned the keys. day260.008", "creation_timestamp": "2026-09-17T02:42:54.849177Z"} 2026-09-17T02:42:54.849177+00:00 https://vulnerability.circl.lu/sighting/9cb9167d-957e-44ba-8c67-aea58e557668/export 2026-09-17T23:36:06.658763+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9cb9167d-957e-44ba-8c67-aea58e557668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6", "content": "# CVE-2026-60137: CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60137\n\n## Summary\nCVE-2026-60137 is a critical SQL injection vulnerability in the Core component of WordPress. The flaw occurs within the WP_Query class during the processing of the author__not_in parameter, where user-supplied array inputs are constructed into a SQL string without strict integer type-casting. When chained with CVE-2026-63030, an unauthenticated remote attacker can exploit this SQL injection to read database values, extract administrator credential hashes, or modify administrative options to execute arbitrary PHP code on the server.\n\n## TL;DR\nWordPress Core contains an SQL injection vulnerability in the WP_Query class when parsing author__not_in parameters. When chained with CVE-2026-63030, unauthenticated attackers can execute arbitrary SQL and escalate privileges to Remote Code Execution.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS Base Score**: 5.9 (Standalone) / 9.8 (Chained)\n- **Exploit Status**: active\n- **CISA KEV Status**: Listed\n- **EPSS Score**: 0.78305\n\n## Affected Systems\n\n- WordPress Core 6.8.0 through 6.8.5\n- WordPress Core 6.9.0 through 6.9.4\n- WordPress Core 7.0.0 through 7.0.1\n- **WordPress Core**: >= 6.8.0, < 6.8.6 (Fixed in: `6.8.6`)\n- **WordPress Core**: >= 6.9.0, < 6.9.5 (Fixed in: `6.9.5`)\n- **WordPress Core**: >= 7.0.0, < 7.0.2 (Fixed in: `7.0.2`)\n\n## Mitigation\n\n- Upgrade WordPress Core immediately to a patched version\n- Disable or block unauthorized access to the REST API batch routes\n- Implement restrictive WAF rules to detect nested array manipulations in REST requests\n\n**Remediation Steps:**\n1. Access the administrative control panel of the WordPress installation.\n2. Navigate to the Updates section and select Update Now to apply the latest security version.\n3. For headless or automated deployments, update the composer.json or version lockfiles to reference 6.8.6, 6.9.5, or 7.0.2.\n4. Configure the Web Application Firewall to block POST requests directed at /wp-json/batch/v1 and /?rest_route=/batch/v1.\n\n## References\n\n- [WordPress Core Advisory (GHSA-fpp7-x2x2-2mjf)](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)\n- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)\n- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)\n- [Searchlight Cyber Research on wp2shell](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)\n- [Aikido Security Blog Analysis](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60137) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T13:01:54.533652Z"} 2026-09-16T13:01:54.533652+00:00 https://vulnerability.circl.lu/sighting/3d241152-a21e-4c66-9bc2-9d095ed42a62/export 2026-09-17T23:36:06.658853+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3d241152-a21e-4c66-9bc2-9d095ed42a62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60004", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mvmvkvvblk2g", "content": "Original text: \"Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit\" \u2014 Subhajeet Singha, Acronis Threat Research Unit (13 September 2026). Figures, sector/command/IOC tables and publish\nhttps://core-jmp.org/2026/09/red-heron-gitea-cve-2026-60004-jitterly-sixzut/", "creation_timestamp": "2026-09-16T10:10:52.623959Z"} 2026-09-16T10:10:52.623959+00:00 https://vulnerability.circl.lu/sighting/f0b2b107-6c8a-4c68-9d69-3aadf93f072b/export 2026-09-17T23:36:06.658940+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f0b2b107-6c8a-4c68-9d69-3aadf93f072b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvkfmmz7qk22", "content": "Critical Gitea RCE bug CVE-2026-60004 in versions 1.17-1.27.0 now in live attacks\u2014upgrade ASAP. #Security #CVE2026-60004 #Gitea #RCE #Infosec #CyberAttack https://thedailytechfeed.com/critical-gitea-rce-vulnerability-under-active-attack-what-you-need-to-know/", "creation_timestamp": "2026-09-15T10:20:09.837029Z"} 2026-09-15T10:20:09.837029+00:00 https://vulnerability.circl.lu/sighting/8cf43bb1-5539-4ef3-b6f6-4db3100dfef0/export 2026-09-17T23:36:06.659014+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8cf43bb1-5539-4ef3-b6f6-4db3100dfef0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/virusbtn.bsky.social/post/3mvka7r3pxc2q", "content": "Acronis TRU uncovered a multinational campaign in which Red Heron, a Chinese-speaking threat actor, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. www.acronis.com/en/tru/posts...", "creation_timestamp": "2026-09-15T08:43:33.406998Z"} 2026-09-15T08:43:33.406998+00:00 https://vulnerability.circl.lu/sighting/ea3a8f06-533c-44ac-93c9-380740b3893d/export 2026-09-17T23:36:06.659093+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ea3a8f06-533c-44ac-93c9-380740b3893d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "published-proof-of-concept", "source": "Telegram/CIwg3dUruFUkA2IiAP63EE_3LOdvwiOYKhxCOUQk67UuENI", "content": "", "creation_timestamp": "2026-09-15T00:00:29.163070Z"} 2026-09-15T00:00:29.163070+00:00 https://vulnerability.circl.lu/sighting/5af3d757-94c3-4f4a-8bb3-69950a6f56dc/export 2026-09-17T23:36:06.659160+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5af3d757-94c3-4f4a-8bb3-69950a6f56dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102315", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60004-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a erberkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-14 15:57:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-15T00:00:11.818721Z"} 2026-09-15T00:00:11.818721+00:00 https://vulnerability.circl.lu/sighting/f44c2637-ac72-4951-bd2f-db6edfc09712/export 2026-09-17T23:36:06.659236+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f44c2637-ac72-4951-bd2f-db6edfc09712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvispqshge2e", "content": "Red Heron, a China-linked group, has automated exploitation of Gitea RCE CVE-2026-60004, hitting 13 orgs in 6 countries per Acronis TRU. Patch Gitea now. https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html", "creation_timestamp": "2026-09-14T19:09:13.963678Z"} 2026-09-14T19:09:13.963678+00:00 https://vulnerability.circl.lu/sighting/89433177-9f58-43ee-91b0-06dc67e4075c/export 2026-09-17T23:36:06.659311+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "89433177-9f58-43ee-91b0-06dc67e4075c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102315", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60004-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a erberkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-14 15:57:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T19:00:05.651099Z"} 2026-09-14T19:00:05.651099+00:00