https://vulnerability.circl.lu/sightings/feed 2026-09-28T18:06:17.701757+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6690765d-b1f4-41d2-b6d1-149a228acbbf/export 2026-09-28T18:06:17.727865+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6690765d-b1f4-41d2-b6d1-149a228acbbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92969", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mw3rzmaf2h2b", "content": "HUSKY Products Filter, a WooCommerce plugin on 80,000+ sites, has a file-inclusion flaw a logged-out visitor can hit.\n\nIts only gate was a nonce printed on every page.\n\nFixed in 1.4.5. Update now. (CVE-2026-92969)", "creation_timestamp": "2026-09-22T08:17:26.533531Z"} 2026-09-22T08:17:26.533531+00:00 https://vulnerability.circl.lu/sighting/81c7a6a8-0216-4a36-ade6-6f01940dde94/export 2026-09-28T18:06:17.729914+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "81c7a6a8-0216-4a36-ade6-6f01940dde94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-92965", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvwyjmech72b", "content": "TikTok WordPress plugin (v1.2.0 \u2013 1.4.2) hit by HIGH severity auth flaw. Any visitor can redeem sign-in codes via URL \u2014 protect your site by disabling or restricting the plugin until fixed. \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-92965-cwe-862-missing-authorization-in-tiktok-38fbb3b8076a5adb #...", "creation_timestamp": "2026-09-20T10:30:28.077288Z"} 2026-09-20T10:30:28.077288+00:00 https://vulnerability.circl.lu/sighting/7e0dc7b7-d8b0-45c6-80a5-929c3452420f/export 2026-09-28T18:06:17.730048+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7e0dc7b7-d8b0-45c6-80a5-929c3452420f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-92965", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117302901104499285", "content": "HIGH severity: CVE-2026-92965 in TikTok WordPress plugin (1.2.0 \u2013 1.4.2) allows any visitor to redeem sign-in codes via URL, risking ad platform abuse. Restrict or disable the plugin while awaiting a patch. https://radar.offseq.com/threat/cve-2026-92965-cwe-862-missing-authorization-in-tiktok-38fbb3b8076a5adb #OffSeq #WordPress #Vuln #Security", "creation_timestamp": "2026-09-20T10:30:25.352310Z"} 2026-09-20T10:30:25.352310+00:00 https://vulnerability.circl.lu/sighting/23b204fd-c561-4567-9eaf-cf93a36c9ea8/export 2026-09-28T18:06:17.730152+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "23b204fd-c561-4567-9eaf-cf93a36c9ea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92960", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287817060203283", "content": "ICYMI: 19 sev:CRIT CVEs in Node VM2, which is supposed to be a sandbox, but apparently it's built like the AI \"sandboxes.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-92934https://www.cve.org/CVERecord?id=CVE-2026-92935https://www.cve.org/CVERecord?id=CVE-2026-92937https://www.cve.org/CVERecord?id=CVE-2026-92938https://www.cve.org/CVERecord?id=CVE-2026-92939https://www.cve.org/CVERecord?id=CVE-2026-92940https://www.cve.org/CVERecord?id=CVE-2026-92941https://www.cve.org/CVERecord?id=CVE-2026-92944https://www.cve.org/CVERecord?id=CVE-2026-92946https://www.cve.org/CVERecord?id=CVE-2026-92947https://www.cve.org/CVERecord?id=CVE-2026-92948https://www.cve.org/CVERecord?id=CVE-2026-92950https://www.cve.org/CVERecord?id=CVE-2026-92951https://www.cve.org/CVERecord?id=CVE-2026-92953https://www.cve.org/CVERecord?id=CVE-2026-92954https://www.cve.org/CVERecord?id=CVE-2026-92955https://www.cve.org/CVERecord?id=CVE-2026-92956https://www.cve.org/CVERecord?id=CVE-2026-92957https://www.cve.org/CVERecord?id=CVE-2026-92960", "creation_timestamp": "2026-09-17T18:34:22.232911Z"} 2026-09-17T18:34:22.232911+00:00 https://vulnerability.circl.lu/sighting/88e2bb5f-3f21-4089-8b66-4a078661753d/export 2026-09-28T18:06:17.730257+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "88e2bb5f-3f21-4089-8b66-4a078661753d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92960", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvq2h25y6t2p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-92960: vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host proc\u2026\nCVSS 10\nhttps://beta.vulnsea.com/cve/CVE-2026-92960\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-17T16:16:09.541959Z"} 2026-09-17T16:16:09.541959+00:00 https://vulnerability.circl.lu/sighting/373be501-9fc6-4f7c-9cb7-8da6232c70b2/export 2026-09-28T18:06:17.730353+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "373be501-9fc6-4f7c-9cb7-8da6232c70b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92960", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq25lfwjn2g", "content": "\ud83d\udea8 CVE-2026-92960 \u2014 CVSS 10 CRITICAL\n\nvm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92960\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:10:52.928438Z"} 2026-09-17T16:10:52.928438+00:00 https://vulnerability.circl.lu/sighting/0ab4c932-e447-411d-b8c2-17b0b5d7f38f/export 2026-09-28T18:06:17.730451+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0ab4c932-e447-411d-b8c2-17b0b5d7f38f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92960", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvpygmywik24", "content": "CVE-2026-92960 - vm2\nThe vm2 sandbox library, versions earlier than 3.11.6, does not properly block certain system functions. As a result, code running inside the sandbox can see details about the server it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T15:40:08.408768Z"} 2026-09-17T15:40:08.408768+00:00