https://vulnerability.circl.lu/sightings/feed 2026-08-29T12:43:44.629759+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1e5dc709-ca1c-4742-8900-a72bbb4eb3e2/export 2026-08-29T12:43:44.655139+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1e5dc709-ca1c-4742-8900-a72bbb4eb3e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48172", "type": "exploited", "source": "https://t.me/cve0day/425", "content": "CVE-2026-48172\n\nLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE \"cpaneljsonapifunc=redisAble\" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.", "creation_timestamp": "2026-08-28T00:00:33.375406Z"} 2026-08-28T00:00:33.375406+00:00 https://vulnerability.circl.lu/sighting/617a30cd-12c7-40c9-9696-22ca36018f4e/export 2026-08-29T12:43:44.657575+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "617a30cd-12c7-40c9-9696-22ca36018f4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48172", "type": "seen", "source": "https://t.me/cve0day/425", "content": "CVE-2026-48172\n\nLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE \"cpaneljsonapifunc=redisAble\" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.", "creation_timestamp": "2026-08-27T15:00:07.156722Z"} 2026-08-27T15:00:07.156722+00:00 https://vulnerability.circl.lu/sighting/8178ccbf-b407-4ae3-85a6-bca8eb1d2661/export 2026-08-29T12:43:44.657709+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8178ccbf-b407-4ae3-85a6-bca8eb1d2661", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msnhfuth6w2z", "content": "CVE-2026-48170 - Critical prototype pollution in scim-patch <0.9.1. Attacker-controlled SCIM PATCH can pollute Object.prototype process-wide. CVSS 9.1. Unpatched - update immediately. #CVE #NodeJS #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-48170/", "creation_timestamp": "2026-08-09T11:14:35.429350Z"} 2026-08-09T11:14:35.429350+00:00 https://vulnerability.circl.lu/sighting/516b02c1-ce7c-4477-8623-ccb3ced463f1/export 2026-08-29T12:43:44.657812+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "516b02c1-ce7c-4477-8623-ccb3ced463f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48170", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msjrbv2itj24", "content": "CRITICAL: Prototype pollution in scim-patch <0.9.1 risks privilege escalation in Node.js. Patch by upgrading to 0.9.1+ or freeze core prototypes at startup. https://radar.offseq.com/threat/cve-2026-48170-cwe-1321-improperly-controlled-modification-of-object-prototype-attributes-prototype-1a8d5ec6...", "creation_timestamp": "2026-08-08T00:00:40.929793Z"} 2026-08-08T00:00:40.929793+00:00 https://vulnerability.circl.lu/sighting/b7fbc5e3-bc88-4139-bd88-0117f48499eb/export 2026-08-29T12:43:44.657909+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b7fbc5e3-bc88-4139-bd88-0117f48499eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48170", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117056945353010722", "content": "CVE-2026-48170 (CRITICAL, CVSS 9.1): Prototype pollution in scim-patch <0.9.1 lets attackers alter Object.prototype globally in Node.js. Upgrade to 0.9.1+ or freeze prototypes for mitigation. https://radar.offseq.com/threat/cve-2026-48170-cwe-1321-improperly-controlled-modification-of-object-prototype-attributes-prototype-1a8d5ec623a7b014 #OffSeq #CVE202648170 #NodeJS #InfoSec", "creation_timestamp": "2026-08-08T00:00:38.293650Z"} 2026-08-08T00:00:38.293650+00:00 https://vulnerability.circl.lu/sighting/a03b30c0-66cc-477c-8dcd-e63635c833b6/export 2026-08-29T12:43:44.658004+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a03b30c0-66cc-477c-8dcd-e63635c833b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msjnwacjmj25", "content": "\ud83d\udd34 CVE-2026-48170 - Critical (9.1)\n\n`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollutio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-48170/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-07T23:00:28.498394Z"} 2026-08-07T23:00:28.498394+00:00 https://vulnerability.circl.lu/sighting/bcc634e2-5dd7-4b2b-aaca-7f9ed0dc1f66/export 2026-08-29T12:43:44.658099+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "bcc634e2-5dd7-4b2b-aaca-7f9ed0dc1f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i3wvb2yauzyfz", "content": "CVE-2026-48170 - scimPatch vulnerable to prototype pollution via unfiltered keys in patch\nCVE ID : CVE-2026-48170\n \n Published : Aug. 7, 2026, 9:26 p.m. | 57\u00a0minutes ago\n \n Description : `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype p...", "creation_timestamp": "2026-08-07T22:48:08.852132Z"} 2026-08-07T22:48:08.852132+00:00 https://vulnerability.circl.lu/sighting/ae915018-0f84-4ed0-877e-7fda0e077b92/export 2026-08-29T12:43:44.658193+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ae915018-0f84-4ed0-877e-7fda0e077b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msjldc4i7t2r", "content": "CVE-2026-48170 - scim-patch\nThe scimPatch library in Node.js versions up to 0.9.0 can be exploited by an attacker to modify system settings and potentially gain unauthorized access or disrupt\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#scimpatch #thomaspoignant #npm #CVE #infosec", "creation_timestamp": "2026-08-07T22:14:04.579036Z"} 2026-08-07T22:14:04.579036+00:00 https://vulnerability.circl.lu/sighting/81c1fc72-d39e-4cf0-bcc0-c8d619f14e38/export 2026-08-29T12:43:44.658288+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "81c1fc72-d39e-4cf0-bcc0-c8d619f14e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48172", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/21766", "content": "LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root \u2013 thehackernews.com\n\nSat, 23 May 2026 15:35:13", "creation_timestamp": "2026-07-20T00:00:22.511477Z"} 2026-07-20T00:00:22.511477+00:00 https://vulnerability.circl.lu/sighting/da86e0d2-248e-4095-8e9f-3ede405d9cb9/export 2026-08-29T12:43:44.658377+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "da86e0d2-248e-4095-8e9f-3ede405d9cb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48172", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/21766", "content": "LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root \u2013 thehackernews.com\n\nSat, 23 May 2026 15:35:13", "creation_timestamp": "2026-07-19T16:00:04.782486Z"} 2026-07-19T16:00:04.782486+00:00