https://vulnerability.circl.lu/sightings/feed 2026-10-05T20:06:17.311049+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1afaf7ed-8e51-4891-a617-e59969517f05/export 2026-10-05T20:06:17.333465+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1afaf7ed-8e51-4891-a617-e59969517f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwtmer6vhq2w", "content": "CVE-2025-68121 CVE-2025-68161 CVE-2026-25679 CVE-2026-27139 CVE-2026-27140 CVE-2026-27142 CVE-2026-27143 CVE-2026-27144 CVE-2026-27145 CVE-2026-32280 CVE-2026-32281 CVE-2026-32282 CVE-2026-32283 CVE-2026-32288 CVE-2026-32289 CVE-2026-33811 CVE-2026-33814 CVE-2026-33818", "creation_timestamp": "2026-10-01T19:40:13.417872Z"} 2026-10-01T19:40:13.417872+00:00 https://vulnerability.circl.lu/sighting/f3856622-d73c-4a84-8ba7-20950a9be7d5/export 2026-10-05T20:06:17.335199+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f3856622-d73c-4a84-8ba7-20950a9be7d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://gist.github.com/akses0/75206bef66ae9889ac26a86a74520308", "content": "// Tripper - a deliberately vulnerable URL unfurling service.\n//\n// CVE-2026-25679 demo: the \"SSRF guard\" inspects u.Host, trusting that\n// url.Parse rejects malformed authorities. On vulnerable Go (1.24.13-1.25.7,\n// 1.26.0) the URL \"https://example.com[::1]/\" parses with Host == \"[::1]\",\n// so an attacker smuggles an internal hostname past the guard inside the\n// domain portion of the URL.\npackage main\n\nimport (\n\t\"fmt\"\n\t\"io\"\n\t\"log\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strings\"\n\t\"time\"\n)\n\nvar client = &http.Client{\n\t// Unfurlers usually limit redirects and set timeouts; this demo keeps\n\t// them short so port-scanning via timing is snappy.\n\tTimeout: 3 * time.Second,\n\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\tif len(via) >= 3 {\n\t\t\treturn fmt.Errorf(\"too many redirects\")\n\t\t}\n\t\treturn nil\n\t},\n}\n\n// naive guard: a string blocklist over the parsed hostname. This mirrors\n// the very common real-world pattern (grep for \"localhost\", obvious\n// RFC1918 prefixes, cloud metadata...) - and it has no idea that\n// \"example.com[::1]\" parses to the IPv6 loopback on vulnerable Go.\nfunc isAllowed(u *url.URL) bool {\n\thost := strings.ToLower(u.Hostname())\n\tif host == \"\" {\n\t\treturn false\n\t}\n\tblocked := []string{\n\t\t\"localhost\", \"127.\", \"0.0.0.0\", \"10.\", \"192.168.\", \"172.16.\",\n\t\t\"169.254\", \"metadata\", \"internal\", \".local\",\n\t}\n\tfor _, b := range blocked {\n\t\tif strings.Contains(host, b) {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}\n\nfunc unfurl(w http.ResponseWriter, r *http.Request) {\n\traw := r.URL.Query().Get(\"url\")\n\tif raw == \"\" {\n\t\thttp.Error(w, \"missing ?url=\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tu, err := url.Parse(raw)\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"rejected by url.Parse: %v\", err), http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tif !isAllowed(u) {\n\t\thttp.Error(w, fmt.Sprintf(\"blocked: host %q is internal\", u.Hostname()), http.StatusForbidden)\n\t\treturn\n\t}\n\n\tstart := time.Now()\n\tresp, err := client.Get(u.String())\n\telapsed := time.Since(start)\n\tif err != nil {\n\t\t// Timing leak: even errors reveal whether something answered.\n\t\tfmt.Fprintf(w, \"fetch failed after %v: %v\\n\", elapsed, err)\n\t\treturn\n\t}\n\tdefer resp.Body.Close()\n\n\tbody, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))\n\ttitle := \"\"\n\tif s := string(body); len(s) > 0 {\n\t\tif i := strings.Index(s, \"\"); i >= 0 {\n\t\t\tif j := strings.Index(s[i:], \"\"); j > 0 {\n\t\t\t\ttitle = s[i+7 : i+j]\n\t\t\t}\n\t\t}\n\t}\n\n\tfmt.Fprintf(w, \"unfurled %s\\n status : %s\\n time : %v\\n title : %s\\n\",\n\t\tu, resp.Status, elapsed, strings.TrimSpace(title))\n}\n\nfunc main() {\n\thttp.HandleFunc(\"/unfurl\", unfurl)\n\thttp.HandleFunc(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\tfmt.Fprintf(w, \"Tripper unfurler (vulnerable build)\\nTry: /unfurl?url=https://example.com\\n\")\n\t})\n\tlog.Println(\"Tripper listening on :8080\")\n\tlog.Fatal(http.ListenAndServe(\":8080\", nil))\n}\n", "creation_timestamp": "2026-08-30T12:06:22.342042Z"} 2026-08-30T12:06:22.342042+00:00 https://vulnerability.circl.lu/sighting/6ad35d5b-0ce2-441a-b4ba-895f5207bf85/export 2026-10-05T20:06:17.335387+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6ad35d5b-0ce2-441a-b4ba-895f5207bf85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25676", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17138", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 GitHub Fresh PoC CVE TOP 5 (Today / Verified & Non-Posted Priority)\nBelow are recent CVE vulnerabilities with active PoC repositories on GitHub, filtered for freshness and non-duplicate usage.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-0756\n\ud83c\udfaf Command Injection \u2192 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-0756\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper input validation allows attackers to inject system commands without authentication.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Full system takeover\n\u2022 No authentication required\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-25763\n\ud83c\udfaf OpenProject \u2013 Command Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-25763\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper handling of Git-related parameters allows attackers to inject commands and execute them on the server.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 File system access\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-25769\n\ud83c\udfaf Wazuh Cluster \u2013 Insecure Deserialization RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hakaioffsec/CVE-2026-25769\n\n\ud83e\udde0 Overview\nA deserialization flaw in Wazuh cluster communication allows attackers to execute arbitrary commands remotely.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Cluster compromise\n\u2022 Lateral movement risk\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-25676\n\ud83c\udfaf M-Track Duo Installer \u2013 DLL Hijacking (Privilege Escalation)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Nexxus67/cve-2026-25676\n\n\ud83e\udde0 Overview\nA DLL search path hijacking vulnerability allows malicious libraries to be loaded by a trusted installer process.\n\n\u2699\ufe0f Impact\n\u2022 Local privilege escalation\n\u2022 Arbitrary code execution\n\u2022 Persistence opportunities\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-30951\n\ud83c\udfaf Sequelize ORM \u2013 SQL Injection\n\n\ud83d\udd17 Reference / PoC Source\nhttps://github.com/ycdxsb/PocOrExp_in_Github/blob/main/Today.md\n\n\ud83e\udde0 Overview\nImproper handling of JSON path casting allows attackers to inject arbitrary SQL queries into database operations.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data exfiltration\n\u2022 Application-level breach\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Fresh PoC tracking\n\u2022 RCE / Injection pattern analysis\n\u2022 CI / backend / ORM attack surface study\n\u2022 Threat intelligence enrichment\n\n\u26a0\ufe0f Intelligence Note\nCurrent GitHub trend:\n\u2022 PoC repositories are published within hours of disclosure\n\u2022 Many CVEs appear first in GitHub before full advisory propagation\n\u2022 ORM / CI / DevOps-related vulnerabilities increasing\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:11.200602Z"} 2026-08-28T00:00:11.200602+00:00 https://vulnerability.circl.lu/sighting/e41a2fe7-5270-493d-8095-024350a1ea89/export 2026-10-05T20:06:17.335533+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e41a2fe7-5270-493d-8095-024350a1ea89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25676", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17138", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 GitHub Fresh PoC CVE TOP 5 (Today / Verified & Non-Posted Priority)\nBelow are recent CVE vulnerabilities with active PoC repositories on GitHub, filtered for freshness and non-duplicate usage.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-0756\n\ud83c\udfaf Command Injection \u2192 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-0756\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper input validation allows attackers to inject system commands without authentication.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Full system takeover\n\u2022 No authentication required\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-25763\n\ud83c\udfaf OpenProject \u2013 Command Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-25763\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper handling of Git-related parameters allows attackers to inject commands and execute them on the server.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 File system access\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-25769\n\ud83c\udfaf Wazuh Cluster \u2013 Insecure Deserialization RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hakaioffsec/CVE-2026-25769\n\n\ud83e\udde0 Overview\nA deserialization flaw in Wazuh cluster communication allows attackers to execute arbitrary commands remotely.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Cluster compromise\n\u2022 Lateral movement risk\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-25676\n\ud83c\udfaf M-Track Duo Installer \u2013 DLL Hijacking (Privilege Escalation)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Nexxus67/cve-2026-25676\n\n\ud83e\udde0 Overview\nA DLL search path hijacking vulnerability allows malicious libraries to be loaded by a trusted installer process.\n\n\u2699\ufe0f Impact\n\u2022 Local privilege escalation\n\u2022 Arbitrary code execution\n\u2022 Persistence opportunities\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-30951\n\ud83c\udfaf Sequelize ORM \u2013 SQL Injection\n\n\ud83d\udd17 Reference / PoC Source\nhttps://github.com/ycdxsb/PocOrExp_in_Github/blob/main/Today.md\n\n\ud83e\udde0 Overview\nImproper handling of JSON path casting allows attackers to inject arbitrary SQL queries into database operations.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data exfiltration\n\u2022 Application-level breach\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Fresh PoC tracking\n\u2022 RCE / Injection pattern analysis\n\u2022 CI / backend / ORM attack surface study\n\u2022 Threat intelligence enrichment\n\n\u26a0\ufe0f Intelligence Note\nCurrent GitHub trend:\n\u2022 PoC repositories are published within hours of disclosure\n\u2022 Many CVEs appear first in GitHub before full advisory propagation\n\u2022 ORM / CI / DevOps-related vulnerabilities increasing\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:05.221887Z"} 2026-08-27T20:00:05.221887+00:00 https://vulnerability.circl.lu/sighting/f81adaa9-f1ef-487a-9675-21063f2bf717/export 2026-10-05T20:06:17.335676+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f81adaa9-f1ef-487a-9675-21063f2bf717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25676", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30707", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 GitHub Fresh PoC CVE TOP 5 (Today / Verified & Non-Posted Priority)\nBelow are recent CVE vulnerabilities with active PoC repositories on GitHub, filtered for freshness and non-duplicate usage.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-0756\n\ud83c\udfaf Command Injection \u2192 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-0756\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper input validation allows attackers to inject system commands without authentication.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Full system takeover\n\u2022 No authentication required\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-25763\n\ud83c\udfaf OpenProject \u2013 Command Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-25763\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper handling of Git-related parameters allows attackers to inject commands and execute them on the server.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 File system access\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-25769\n\ud83c\udfaf Wazuh Cluster \u2013 Insecure Deserialization RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hakaioffsec/CVE-2026-25769\n\n\ud83e\udde0 Overview\nA deserialization flaw in Wazuh cluster communication allows attackers to execute arbitrary commands remotely.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Cluster compromise\n\u2022 Lateral movement risk\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-25676\n\ud83c\udfaf M-Track Duo Installer \u2013 DLL Hijacking (Privilege Escalation)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Nexxus67/cve-2026-25676\n\n\ud83e\udde0 Overview\nA DLL search path hijacking vulnerability allows malicious libraries to be loaded by a trusted installer process.\n\n\u2699\ufe0f Impact\n\u2022 Local privilege escalation\n\u2022 Arbitrary code execution\n\u2022 Persistence opportunities\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-30951\n\ud83c\udfaf Sequelize ORM \u2013 SQL Injection\n\n\ud83d\udd17 Reference / PoC Source\nhttps://github.com/ycdxsb/PocOrExp_in_Github/blob/main/Today.md\n\n\ud83e\udde0 Overview\nImproper handling of JSON path casting allows attackers to inject arbitrary SQL queries into database operations.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data exfiltration\n\u2022 Application-level breach\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Fresh PoC tracking\n\u2022 RCE / Injection pattern analysis\n\u2022 CI / backend / ORM attack surface study\n\u2022 Threat intelligence enrichment\n\n\u26a0\ufe0f Intelligence Note\nCurrent GitHub trend:\n\u2022 PoC repositories are published within hours of disclosure\n\u2022 Many CVEs appear first in GitHub before full advisory propagation\n\u2022 ORM / CI / DevOps-related vulnerabilities increasing\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:04.773927Z"} 2026-08-15T11:00:04.773927+00:00 https://vulnerability.circl.lu/sighting/095bdb85-4b9b-4ea8-947a-7d2b4820032a/export 2026-10-05T20:06:17.335793+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "095bdb85-4b9b-4ea8-947a-7d2b4820032a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25676", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30706", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 GitHub Fresh PoC CVE TOP 5 (Today / Verified & Non-Posted Priority)\nBelow are recent CVE vulnerabilities with active PoC repositories on GitHub, filtered for freshness and non-duplicate usage.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-0756\n\ud83c\udfaf Command Injection \u2192 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-0756\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper input validation allows attackers to inject system commands without authentication.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Full system takeover\n\u2022 No authentication required\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-25763\n\ud83c\udfaf OpenProject \u2013 Command Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/official-security-research/CVE-2026-25763\n (PoC reference class)\n\n\ud83e\udde0 Overview\nImproper handling of Git-related parameters allows attackers to inject commands and execute them on the server.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 File system access\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-25769\n\ud83c\udfaf Wazuh Cluster \u2013 Insecure Deserialization RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hakaioffsec/CVE-2026-25769\n\n\ud83e\udde0 Overview\nA deserialization flaw in Wazuh cluster communication allows attackers to execute arbitrary commands remotely.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Cluster compromise\n\u2022 Lateral movement risk\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-25676\n\ud83c\udfaf M-Track Duo Installer \u2013 DLL Hijacking (Privilege Escalation)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Nexxus67/cve-2026-25676\n\n\ud83e\udde0 Overview\nA DLL search path hijacking vulnerability allows malicious libraries to be loaded by a trusted installer process.\n\n\u2699\ufe0f Impact\n\u2022 Local privilege escalation\n\u2022 Arbitrary code execution\n\u2022 Persistence opportunities\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-30951\n\ud83c\udfaf Sequelize ORM \u2013 SQL Injection\n\n\ud83d\udd17 Reference / PoC Source\nhttps://github.com/ycdxsb/PocOrExp_in_Github/blob/main/Today.md\n\n\ud83e\udde0 Overview\nImproper handling of JSON path casting allows attackers to inject arbitrary SQL queries into database operations.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data exfiltration\n\u2022 Application-level breach\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Fresh PoC tracking\n\u2022 RCE / Injection pattern analysis\n\u2022 CI / backend / ORM attack surface study\n\u2022 Threat intelligence enrichment\n\n\u26a0\ufe0f Intelligence Note\nCurrent GitHub trend:\n\u2022 PoC repositories are published within hours of disclosure\n\u2022 Many CVEs appear first in GitHub before full advisory propagation\n\u2022 ORM / CI / DevOps-related vulnerabilities increasing\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:04.242325Z"} 2026-08-15T11:00:04.242325+00:00 https://vulnerability.circl.lu/sighting/1086398f-518d-4b21-9924-46900a0596b9/export 2026-10-05T20:06:17.335920+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1086398f-518d-4b21-9924-46900a0596b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp7drvhp62o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-25679: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 URL\n\n\n\nhttps://kripta.biz/posts/76BD5E44-6F20-405D-BEA4-102A40D39C04", "creation_timestamp": "2026-07-02T23:39:59.499350Z"} 2026-07-02T23:39:59.499350+00:00 https://vulnerability.circl.lu/sighting/f6a474a0-8d56-4290-b75a-a0f9d02eb51b/export 2026-10-05T20:06:17.336031+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f6a474a0-8d56-4290-b75a-a0f9d02eb51b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp74lf4i4222", "content": "ELSA-2026-29703: atualiza\u00e7\u00e3o cr\u00edtica para container-networking-plugins no Oracle Linux 9. Quatro CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283) corrigidos. Vers\u00e3o 1.9.0-3.el9_8. Saiba mais: -> tinyurl.com/4ua596y4 #Oracle", "creation_timestamp": "2026-06-26T14:07:58.459210Z"} 2026-06-26T14:07:58.459210+00:00 https://vulnerability.circl.lu/sighting/20480ffa-9d47-4d29-897a-b872421a5d3a/export 2026-10-05T20:06:17.336129+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "20480ffa-9d47-4d29-897a-b872421a5d3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp74le66es22", "content": "ELSA-2026-29703: atualiza\u00e7\u00e3o cr\u00edtica para container-networking-plugins no Oracle Linux 9. Quatro CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283) corrigidos. Vers\u00e3o 1.9.0-3.el9_8. Saiba mais: -> tinyurl.com/4ua596y4 #Oracle", "creation_timestamp": "2026-06-26T14:07:57.871513Z"} 2026-06-26T14:07:57.871513+00:00 https://vulnerability.circl.lu/sighting/3f31a0aa-4b7b-4e09-a85c-092bc1ffa83a/export 2026-10-05T20:06:17.336229+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3f31a0aa-4b7b-4e09-a85c-092bc1ffa83a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp6xsn3kck22", "content": "\ud83d\udd12 ELSA-2026-29702: Atualiza\u00e7\u00e3o IMPORTANTE do runc no Oracle Linux 9 corrige 3 CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281). Saiba mais: -> tinyurl.com/ub67wkx3 #Oracle", "creation_timestamp": "2026-06-26T12:42:33.684383Z"} 2026-06-26T12:42:33.684383+00:00