https://vulnerability.circl.lu/sightings/feed 2026-09-30T23:47:35.490040+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/55a231ac-915e-46bf-b031-cd11f964e4ad/export 2026-09-30T23:47:35.524133+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "55a231ac-915e-46bf-b031-cd11f964e4ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-101084", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwki5bpbxu2q", "content": "CVE-2026-101084: CRITICAL flaw in obot-platform obot <0.21.1. Authenticated users can bypass authorization on /mcp-connect and manipulate backend systems. Upgrade to 0.21.1 ASAP. https://radar.offseq.com/threat/cve-2026-101084-authorization-bypass-through-user-controlled-key-in-obot-platform-obot...", "creation_timestamp": "2026-09-28T04:30:28.185776Z"} 2026-09-28T04:30:28.185776+00:00 https://vulnerability.circl.lu/sighting/9e3ff03b-caf6-4bfa-9c0a-2593348951ce/export 2026-09-30T23:47:35.526685+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9e3ff03b-caf6-4bfa-9c0a-2593348951ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-101084", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117346784083424784", "content": "obot-platform obot <0.21.1 suffers a CRITICAL auth bypass (CVE-2026-101084): authenticated users with server IDs can access restricted MCP servers via /mcp-connect. Patch to 0.21.1 now! https://radar.offseq.com/threat/cve-2026-101084-authorization-bypass-through-user-controlled-key-in-obot-platform-obot-2f19c5f80b1ebeae #OffSeq #CVE2026101084 #infosec #vuln", "creation_timestamp": "2026-09-28T04:30:26.225764Z"} 2026-09-28T04:30:26.225764+00:00 https://vulnerability.circl.lu/sighting/844314cc-22ca-43cc-bb9f-db8ad170f131/export 2026-09-30T23:47:35.526889+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "844314cc-22ca-43cc-bb9f-db8ad170f131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101084", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwjzw55n4t2y", "content": "\ud83d\udd34 CVE-2026-101084 - Critical (9.6)\n\nobot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-101084/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T00:15:56.514939Z"} 2026-09-28T00:15:56.514939+00:00 https://vulnerability.circl.lu/sighting/43ea5fb9-e77d-4f4d-ae8b-d2f0b4b2c209/export 2026-09-30T23:47:35.527035+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "43ea5fb9-e77d-4f4d-ae8b-d2f0b4b2c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101084", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjsqhmdoy2u", "content": "\ud83d\udea8 CVE-2026-101084 \u2014 CVSS 9.3 CRITICAL\n\nobot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing an...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-101084\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T22:07:29.366484Z"} 2026-09-27T22:07:29.366484+00:00 https://vulnerability.circl.lu/sighting/dc7cd286-fd9d-4c3f-8079-1d4bbd1ff445/export 2026-09-30T23:47:35.527172+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "dc7cd286-fd9d-4c3f-8079-1d4bbd1ff445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101084", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjq3rqld42u", "content": "CVE-2026-101084 - obot\nVersions of the obot platform before the latest update allow a logged-in user who knows a server identifier to connect to MCP servers that should be off\u2011limits. This can let\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#obot #obotplatform #CVE #infosec", "creation_timestamp": "2026-09-27T21:20:07.745319Z"} 2026-09-27T21:20:07.745319+00:00