https://vulnerability.circl.lu/sightings/feed 2026-09-12T21:40:51.008445+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/13d04c4f-2913-4a97-8233-b42bb3b6babe/export 2026-09-12T21:40:51.025776+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "13d04c4f-2913-4a97-8233-b42bb3b6babe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117243130997619084", "content": "CVE-2026-9317: Nango <0.71.6 has a missing auth flaw in its runner tRPC server. Attackers can send requests to the unpatched start procedure, bypassing RUNNER_SECRET_KEY to trigger RCE. CVSS 8.1. Patch or isolate the runner port immediately. https://www.valtersit.com/cve/CVE-2026", "creation_timestamp": "2026-09-09T21:10:10.880070Z"} 2026-09-09T21:10:10.880070+00:00 https://vulnerability.circl.lu/sighting/15723a6c-04dc-4abf-a0c8-73ff8551ae07/export 2026-09-12T21:40:51.028757+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "15723a6c-04dc-4abf-a0c8-73ff8551ae07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mv4h5ayftb2v", "content": "CVE-2026-9317: Nango <0.71.6 has a missing auth flaw in its runner tRPC server. Attackers can send requests to the unpatched start procedure, bypassing RUNNER_SECRET_KEY to trigger RCE. CVSS 8.1. Patch or isolate the runner port immediately. https://www.valtersit.com/cve/CVE-2026", "creation_timestamp": "2026-09-09T21:10:05.355623Z"} 2026-09-09T21:10:05.355623+00:00 https://vulnerability.circl.lu/sighting/efdfb4b5-a716-4877-b611-b3784db23e76/export 2026-09-12T21:40:51.028898+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "efdfb4b5-a716-4877-b611-b3784db23e76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muprehmnuv2y", "content": "\ud83d\udea8 CVE-2026-9317 \u2014 CVSS 9.2 CRITICAL\n\nNango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-9317\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-04T20:08:27.682226Z"} 2026-09-04T20:08:27.682226+00:00 https://vulnerability.circl.lu/sighting/b040281e-0753-41ff-996a-4a6669b57c91/export 2026-09-12T21:40:51.029013+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b040281e-0753-41ff-996a-4a6669b57c91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqy7uxmd2l", "content": "\ud83d\udfe0 CVE-2026-9317 - High (8.1)\n\nNango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server tha...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9317/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-04T20:01:37.916431Z"} 2026-09-04T20:01:37.916431+00:00 https://vulnerability.circl.lu/sighting/a0864715-2d0e-44d6-b75f-79ff72bf26df/export 2026-09-12T21:40:51.029119+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a0864715-2d0e-44d6-b75f-79ff72bf26df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mupp7ul4sb2w", "content": "CVE-2026-9317 - nango\nThe Nango service version earlier than 0.71.6 does not check who can start its runner component. Anyone who can reach the runner\u2019s network port can tell it to start and run any JavaScript\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nango #nangohq #CVE #infosec", "creation_timestamp": "2026-09-04T19:30:06.182303Z"} 2026-09-04T19:30:06.182303+00:00 https://vulnerability.circl.lu/sighting/aaba095f-2363-4b0b-b537-b8461b7c1222/export 2026-09-12T21:40:51.029224+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "aaba095f-2363-4b0b-b537-b8461b7c1222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hmahqdrfdyv4b", "content": "CVE-2026-9317 - Nango\nCVE ID : CVE-2026-9317\n \n Published : Sept. 4, 2026, 6:18 p.m. | 19\u00a0minutes ago\n \n Description : Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaS...", "creation_timestamp": "2026-09-04T19:04:51.799983Z"} 2026-09-04T19:04:51.799983+00:00