https://vulnerability.circl.lu/sightings/feed 2026-09-17T22:03:21.380883+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/eddadc77-6d54-44d9-8334-2d335240fe35/export 2026-09-17T22:03:21.408353+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "eddadc77-6d54-44d9-8334-2d335240fe35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42048", "type": "seen", "source": "https://t.me/shimiscyberworld/1411", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-42048 \u2014 CVSS 9.6\nCVE-2026-42048: Langflow Path Traversal Exposes Servers to Arbitrary Deletion\n\nCVE-2026-42048 \u2014 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API \n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve #critical #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-42048 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:52.414743Z"} 2026-09-13T00:00:52.414743+00:00 https://vulnerability.circl.lu/sighting/a9219fe8-5652-4122-99f4-39dfbc203fde/export 2026-09-17T22:03:21.410920+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a9219fe8-5652-4122-99f4-39dfbc203fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42047", "type": "seen", "source": "https://t.me/shimiscyberworld/1317", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-08\n\n\ud83d\udcca 65 vulnerabilities detected today \u2014 16 \ud83d\udd34 Critical, 49 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42826 (10) \u2014 Azure DevOps Critical Info Disclosure: CVE-2026-42826\n \u2022 CVE-2026-41070 (10) \u2014 CVE-2026-41070: openvpn-auth-oauth2 Critical Bypass in\u2026\n \u2022 CVE-2026-33109 (9.9) \u2014 CVE-2026-33109: Critical RCE in Azure Managed Instance for\u2026\n \u2022 CVE-2026-41512 (9.9) \u2014 ai-scanner RCE: Critical JavaScript Injection in\u2026\n \u2022 CVE-2026-41500 (9.8) \u2014 electerm CVE-2026-41500: Critical Command Injection in\u2026\n \u2022 CVE-2026-41501 (9.8) \u2014 Electerm Critical Command Injection Flaw Patched\u2026\n \u2022 CVE-2026-8153 (9.8) \u2014 Universal Robots PolyScope Critical OS Command Injection\u2026\n \u2022 CVE-2026-41497 (9.8) \u2014 CVE-2026-41497: PraisonAI Multi-Agent System Critical RCE\n \u2026 and 8 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2026-32207 (8.8) \u2014 Azure Machine Learning XSS Exposes Data, Allows Spoofing\n \u2022 CVE-2026-41900 (8.8) \u2014 CVE-2026-41900: OpenLearnX RCE Allows Sandbox Escape and\u2026\n \u2022 CVE-2026-8137 (8.8) \u2014 Totolink X5000R Buffer Overflow (CVE-2026-8137) Exposed\n \u2022 CVE-2026-8138 (8.8) \u2014 Tenda CX12L Stack Buffer Overflow (CVE-2026-8138) Risks\u2026\n \u2022 CVE-2026-5127 (8.8) \u2014 WordPress Plugin Vulnerability: CVE-2026-5127 Allows Code\u2026\n \u2022 CVE-2026-42275 (8.7) \u2014 zrok WebDAV Vulnerability (CVE-2026-42275) Allows Remote\u2026\n \u2022 CVE-2026-41524 (8.7) \u2014 Brave CMS XSS Vulnerability: Editor Role Leads to\u2026\n \u2022 CVE-2026-42047 (8.6) \u2014 CVE-2026-42047: Inngest Exposes Environment Variables via\u2026\n \u2022 CVE-2026-35435 (8.6) \u2014 Azure AI Foundry M365 Flaw Allows Network Privilege\u2026\n \u2022 CVE-2026-44339 (8.6) \u2014 PraisonAI Vulnerability Allows Undeclared Tool Invocation\u2026\n \u2026 and 39 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:39.790276Z"} 2026-09-13T00:00:39.790276+00:00 https://vulnerability.circl.lu/sighting/26619bba-5fbe-4bac-9aa4-b686e7cc1476/export 2026-09-17T22:03:21.411104+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "26619bba-5fbe-4bac-9aa4-b686e7cc1476", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42047", "type": "seen", "source": "https://t.me/shimiscyberworld/1317", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-08\n\n\ud83d\udcca 65 vulnerabilities detected today \u2014 16 \ud83d\udd34 Critical, 49 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42826 (10) \u2014 Azure DevOps Critical Info Disclosure: CVE-2026-42826\n \u2022 CVE-2026-41070 (10) \u2014 CVE-2026-41070: openvpn-auth-oauth2 Critical Bypass in\u2026\n \u2022 CVE-2026-33109 (9.9) \u2014 CVE-2026-33109: Critical RCE in Azure Managed Instance for\u2026\n \u2022 CVE-2026-41512 (9.9) \u2014 ai-scanner RCE: Critical JavaScript Injection in\u2026\n \u2022 CVE-2026-41500 (9.8) \u2014 electerm CVE-2026-41500: Critical Command Injection in\u2026\n \u2022 CVE-2026-41501 (9.8) \u2014 Electerm Critical Command Injection Flaw Patched\u2026\n \u2022 CVE-2026-8153 (9.8) \u2014 Universal Robots PolyScope Critical OS Command Injection\u2026\n \u2022 CVE-2026-41497 (9.8) \u2014 CVE-2026-41497: PraisonAI Multi-Agent System Critical RCE\n \u2026 and 8 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2026-32207 (8.8) \u2014 Azure Machine Learning XSS Exposes Data, Allows Spoofing\n \u2022 CVE-2026-41900 (8.8) \u2014 CVE-2026-41900: OpenLearnX RCE Allows Sandbox Escape and\u2026\n \u2022 CVE-2026-8137 (8.8) \u2014 Totolink X5000R Buffer Overflow (CVE-2026-8137) Exposed\n \u2022 CVE-2026-8138 (8.8) \u2014 Tenda CX12L Stack Buffer Overflow (CVE-2026-8138) Risks\u2026\n \u2022 CVE-2026-5127 (8.8) \u2014 WordPress Plugin Vulnerability: CVE-2026-5127 Allows Code\u2026\n \u2022 CVE-2026-42275 (8.7) \u2014 zrok WebDAV Vulnerability (CVE-2026-42275) Allows Remote\u2026\n \u2022 CVE-2026-41524 (8.7) \u2014 Brave CMS XSS Vulnerability: Editor Role Leads to\u2026\n \u2022 CVE-2026-42047 (8.6) \u2014 CVE-2026-42047: Inngest Exposes Environment Variables via\u2026\n \u2022 CVE-2026-35435 (8.6) \u2014 Azure AI Foundry M365 Flaw Allows Network Privilege\u2026\n \u2022 CVE-2026-44339 (8.6) \u2014 PraisonAI Vulnerability Allows Undeclared Tool Invocation\u2026\n \u2026 and 39 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:11.965927Z"} 2026-09-12T10:00:11.965927+00:00 https://vulnerability.circl.lu/sighting/6e0889eb-e352-4680-9160-5e7b00009a22/export 2026-09-17T22:03:21.411249+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6e0889eb-e352-4680-9160-5e7b00009a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42048", "type": "seen", "source": "https://t.me/shimiscyberworld/1411", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-42048 \u2014 CVSS 9.6\nCVE-2026-42048: Langflow Path Traversal Exposes Servers to Arbitrary Deletion\n\nCVE-2026-42048 \u2014 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API \n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve #critical #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-42048 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:06.681856Z"} 2026-09-12T10:00:06.681856+00:00 https://vulnerability.circl.lu/sighting/6befd64f-813d-4d5d-b4a1-464d7722678d/export 2026-09-17T22:03:21.411370+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6befd64f-813d-4d5d-b4a1-464d7722678d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42043", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/186229", "content": "How We Bypassed an Axios Security Patch (CVE-2026\u201342043): The 16-Million IP Loophole\nhttps://infosecwriteups.com/how-we-bypassed-an-axios-security-patch-cve-2026-42043-the-16-million-ip-loophole-6f2dd8968757?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:20.120972Z"} 2026-09-02T01:00:20.120972+00:00 https://vulnerability.circl.lu/sighting/8bf56738-d72e-421e-b993-4b4b24f4a405/export 2026-09-17T22:03:21.411489+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8bf56738-d72e-421e-b993-4b4b24f4a405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42043", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/186231", "content": "When a patch for a critical vulnerability drops in a library downloaded over 500 million times a week, you expect it to be bulletproof\u2026Continue reading on InfoSec Write-ups \u00bb (https://infosecwriteups.com/how-we-bypassed-an-axios-security-patch-cve-2026-42043-the-16-million-ip-loophole-6f2dd8968757?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:20.061389Z"} 2026-09-02T01:00:20.061389+00:00 https://vulnerability.circl.lu/sighting/34611a7f-7eb0-4037-b346-75e54e97b288/export 2026-09-17T22:03:21.411608+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "34611a7f-7eb0-4037-b346-75e54e97b288", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42043", "type": "seen", "source": "https://t.me/hacking_Attack/186231", "content": "When a patch for a critical vulnerability drops in a library downloaded over 500 million times a week, you expect it to be bulletproof\u2026Continue reading on InfoSec Write-ups \u00bb (https://infosecwriteups.com/how-we-bypassed-an-axios-security-patch-cve-2026-42043-the-16-million-ip-loophole-6f2dd8968757?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:10.164166Z"} 2026-09-01T20:00:10.164166+00:00 https://vulnerability.circl.lu/sighting/c2d9c38c-7cbf-4c54-9d8d-427bffd0146e/export 2026-09-17T22:03:21.411718+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c2d9c38c-7cbf-4c54-9d8d-427bffd0146e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42043", "type": "seen", "source": "https://t.me/hacking_Attack/186229", "content": "How We Bypassed an Axios Security Patch (CVE-2026\u201342043): The 16-Million IP Loophole\nhttps://infosecwriteups.com/how-we-bypassed-an-axios-security-patch-cve-2026-42043-the-16-million-ip-loophole-6f2dd8968757?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:10.120705Z"} 2026-09-01T20:00:10.120705+00:00 https://vulnerability.circl.lu/sighting/8b91c4db-9970-4626-9adb-2ae80deacb76/export 2026-09-17T22:03:21.411824+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8b91c4db-9970-4626-9adb-2ae80deacb76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42043", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5txabhww2x", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-42043](https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7)\nAxios is...\nhttps://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7 #PatchManagement #Vulnerability #CVE", "creation_timestamp": "2026-07-21T12:51:15.134120Z"} 2026-07-21T12:51:15.134120+00:00 https://vulnerability.circl.lu/sighting/5a557e7c-74fd-43be-a02f-3396d856fb4e/export 2026-09-17T22:03:21.411930+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5a557e7c-74fd-43be-a02f-3396d856fb4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42049", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqnnimr6di26", "content": "CVE-2026-42049 - jadx: RCE Via Groovy Code Injection in Gradle Export\nCVE ID : CVE-2026-42049\n \n Published : July 14, 2026, 10:16 p.m. | 2\u00a0hours, 17\u00a0minutes ago\n \n Description : jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from a...", "creation_timestamp": "2026-07-15T02:13:06.580092Z"} 2026-07-15T02:13:06.580092+00:00