https://vulnerability.circl.lu/sightings/feed 2026-07-01T19:49:17.329465+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/da4debd7-723f-4a9e-b198-8d99b313b7f0/export 2026-07-01T19:49:17.345288+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "da4debd7-723f-4a9e-b198-8d99b313b7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mowbt3vgh62r", "content": "\u26a0\ufe0f PATCH NOW\n\nOne account-sync message can corrupt every object in your app.\n\nA widely-used identity library, scim-patch, applies the update straight onto JavaScript's shared prototype, and admin checks can flip true.\n\nPatch to 0.9.1 now. (CVE-2026-48170)", "creation_timestamp": "2026-06-23T01:47:50.618705Z"} 2026-06-23T01:47:50.618705+00:00 https://vulnerability.circl.lu/sighting/3a984043-2e7d-4846-9a56-d9109b8f2de7/export 2026-07-01T19:49:17.346426+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "3a984043-2e7d-4846-9a56-d9109b8f2de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48170", "type": "published-proof-of-concept", "source": "https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c", "content": "", "creation_timestamp": "2026-05-21T13:04:48.000000Z"} 2026-05-21T13:04:48+00:00