<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>https://vulnerability.circl.lu/sightings/feed</id>
  <title>Most recent sightings.</title>
  <updated>2026-06-18T04:05:30.932423+00:00</updated>
  <author>
    <name>Vulnerability-Lookup</name>
    <email>info@circl.lu</email>
  </author>
  <link href="https://vulnerability.circl.lu" rel="alternate"/>
  <generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator>
  <subtitle>Contains only the most 10 recent sightings.</subtitle>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/9b44c696-c47c-4704-8c34-7aaacca63883/export</id>
    <title>9b44c696-c47c-4704-8c34-7aaacca63883</title>
    <updated>2026-06-18T04:05:30.943231+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "9b44c696-c47c-4704-8c34-7aaacca63883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mo25bvjog62m", "content": "Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit thehackernews.com/2026/05/atta...", "creation_timestamp": "2026-06-11T21:12:07.020519Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/9b44c696-c47c-4704-8c34-7aaacca63883/export"/>
    <published>2026-06-11T21:12:07.020519+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/5c969a50-bbd2-4fcf-91e4-19e1771cdbb1/export</id>
    <title>5c969a50-bbd2-4fcf-91e4-19e1771cdbb1</title>
    <updated>2026-06-18T04:05:30.943158+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "5c969a50-bbd2-4fcf-91e4-19e1771cdbb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/robsongfreire.bsky.social/post/3mod6dmp6ss2o", "content": "E n\u00e3o em uma armadilha digital. O agente de IA explorou a vulnerabilidade CVE-2026-39987 em um notebook Marimo para obter acesso inicial. A partir da\u00ed, extraiu credenciais da Amazon Web Services, localizou e usou uma chave privada de acesso remoto e lan\u00e7ou oito sess\u00f5es paralelas contra o banco 2/6\ud83d\udc47", "creation_timestamp": "2026-06-15T11:24:53.343602Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/5c969a50-bbd2-4fcf-91e4-19e1771cdbb1/export"/>
    <published>2026-06-15T11:24:53.343602+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/a656fde0-11e6-493f-8c72-0365c8e20b3f/export</id>
    <title>a656fde0-11e6-493f-8c72-0365c8e20b3f</title>
    <updated>2026-06-18T04:05:30.943082+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "a656fde0-11e6-493f-8c72-0365c8e20b3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/robsongfreire.bsky.social/post/3mod6dmplj22o", "content": "E n\u00e3o em uma armadilha digital. O agente de IA explorou a vulnerabilidade CVE-2026-39987 em um notebook Marimo para obter acesso inicial. A partir da\u00ed, extraiu credenciais da Amazon Web Services, localizou e usou uma chave privada de acesso remoto e lan\u00e7ou oito sess\u00f5es paralelas contra o banco 2/6\ud83d\udc47", "creation_timestamp": "2026-06-15T11:24:54.067890Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/a656fde0-11e6-493f-8c72-0365c8e20b3f/export"/>
    <published>2026-06-15T11:24:54.067890+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/ad2a6ea1-6d8e-49a0-b1ee-88691b0e2e86/export</id>
    <title>ad2a6ea1-6d8e-49a0-b1ee-88691b0e2e86</title>
    <updated>2026-06-18T04:05:30.943008+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "ad2a6ea1-6d8e-49a0-b1ee-88691b0e2e86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/robsongfreire.bsky.social/post/3mod6dmpnhk2o", "content": "E n\u00e3o em uma armadilha digital. O agente de IA explorou a vulnerabilidade CVE-2026-39987 em um notebook Marimo para obter acesso inicial. A partir da\u00ed, extraiu credenciais da Amazon Web Services, localizou e usou uma chave privada de acesso remoto e lan\u00e7ou oito sess\u00f5es paralelas contra o banco 2/6\ud83d\udc47", "creation_timestamp": "2026-06-15T11:24:56.568514Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/ad2a6ea1-6d8e-49a0-b1ee-88691b0e2e86/export"/>
    <published>2026-06-15T11:24:56.568514+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/6305930c-af6d-4540-883e-b39d3f81232a/export</id>
    <title>6305930c-af6d-4540-883e-b39d3f81232a</title>
    <updated>2026-06-18T04:05:30.942929+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "6305930c-af6d-4540-883e-b39d3f81232a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/robsongfreire.bsky.social/post/3mod6dmpogs2o", "content": "E n\u00e3o em uma armadilha digital. O agente de IA explorou a vulnerabilidade CVE-2026-39987 em um notebook Marimo para obter acesso inicial. A partir da\u00ed, extraiu credenciais da Amazon Web Services, localizou e usou uma chave privada de acesso remoto e lan\u00e7ou oito sess\u00f5es paralelas contra o banco 2/6\ud83d\udc47", "creation_timestamp": "2026-06-15T11:24:57.156557Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/6305930c-af6d-4540-883e-b39d3f81232a/export"/>
    <published>2026-06-15T11:24:57.156557+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/377a4e18-1f1e-40d8-b495-6abca8b0b464/export</id>
    <title>377a4e18-1f1e-40d8-b495-6abca8b0b464</title>
    <updated>2026-06-18T04:05:30.942852+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "377a4e18-1f1e-40d8-b495-6abca8b0b464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/robsongfreire.bsky.social/post/3mod6dmppg22o", "content": "E n\u00e3o em uma armadilha digital. O agente de IA explorou a vulnerabilidade CVE-2026-39987 em um notebook Marimo para obter acesso inicial. A partir da\u00ed, extraiu credenciais da Amazon Web Services, localizou e usou uma chave privada de acesso remoto e lan\u00e7ou oito sess\u00f5es paralelas contra o banco 2/6\ud83d\udc47", "creation_timestamp": "2026-06-15T11:24:57.686380Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/377a4e18-1f1e-40d8-b495-6abca8b0b464/export"/>
    <published>2026-06-15T11:24:57.686380+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/ca8e3e4e-c578-4c86-8405-ac7c98893a61/export</id>
    <title>ca8e3e4e-c578-4c86-8405-ac7c98893a61</title>
    <updated>2026-06-18T04:05:30.942770+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "ca8e3e4e-c578-4c86-8405-ac7c98893a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/robsongfreire.bsky.social/post/3mod6dmprek2o", "content": "E n\u00e3o em uma armadilha digital. O agente de IA explorou a vulnerabilidade CVE-2026-39987 em um notebook Marimo para obter acesso inicial. A partir da\u00ed, extraiu credenciais da Amazon Web Services, localizou e usou uma chave privada de acesso remoto e lan\u00e7ou oito sess\u00f5es paralelas contra o banco 2/6\ud83d\udc47", "creation_timestamp": "2026-06-15T11:24:58.214687Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/ca8e3e4e-c578-4c86-8405-ac7c98893a61/export"/>
    <published>2026-06-15T11:24:58.214687+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/b07422a5-6959-4e6b-b3fe-c998babbc18b/export</id>
    <title>b07422a5-6959-4e6b-b3fe-c998babbc18b</title>
    <updated>2026-06-18T04:05:30.942689+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "b07422a5-6959-4e6b-b3fe-c998babbc18b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "MISP/d511a704-eba2-411a-9543-41e0e130f522", "content": "", "creation_timestamp": "2026-06-15T17:02:31.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/b07422a5-6959-4e6b-b3fe-c998babbc18b/export"/>
    <published>2026-06-15T17:02:31+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/832ed5fe-97bd-4562-a190-004597a0818a/export</id>
    <title>832ed5fe-97bd-4562-a190-004597a0818a</title>
    <updated>2026-06-18T04:05:30.942586+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "832ed5fe-97bd-4562-a190-004597a0818a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3moeqyf377y2r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-35273: 57 interactions\nCVE-2026-11645: 30 interactions\nCVE-2025-10263: 25 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-39987: 18 interactions\nCVE-2026-0257: 7 interactions\nCVE-2026-12221: 6 interactions\n", "creation_timestamp": "2026-06-16T02:31:16.680831Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/832ed5fe-97bd-4562-a190-004597a0818a/export"/>
    <published>2026-06-16T02:31:16.680831+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/040b7757-9c90-4e25-b8d9-7e324271b4ce/export</id>
    <title>040b7757-9c90-4e25-b8d9-7e324271b4ce</title>
    <updated>2026-06-18T04:05:30.941443+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cvepremium.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "040b7757-9c90-4e25-b8d9-7e324271b4ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mojrwgzt3f2d", "content": "Top 3 CVE for last 7 days:\nCVE-2026-35273: 64 interactions\nCVE-2026-54420: 26 interactions\nCVE-2026-39987: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-9697: 16 interactions\nCVE-2026-50656: 13 interactions\nCVE-2026-42824: 11 interactions\n", "creation_timestamp": "2026-06-18T02:31:23.422090Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/040b7757-9c90-4e25-b8d9-7e324271b4ce/export"/>
    <published>2026-06-18T02:31:23.422090+00:00</published>
  </entry>
</feed>
