https://vulnerability.circl.lu/sightings/feed 2026-08-14T18:58:53.992885+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f4d6e975-4717-4bbf-a423-647e0f44f05e/export 2026-08-14T18:58:54.021046+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f4d6e975-4717-4bbf-a423-647e0f44f05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-07 05:21:48 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:09.462793Z"} 2026-08-10T10:02:09.462793+00:00 https://vulnerability.circl.lu/sighting/c7299fb3-0b54-4a4a-b83f-1238eb6c4810/export 2026-08-14T18:58:54.023372+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c7299fb3-0b54-4a4a-b83f-1238eb6c4810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mrizj7i2ye2c", "content": "Active exploit! CVE-2026-29059 (CVSS 7.5) affects Windmill's get_log_file endpoint via unauthenticated path traversal. Urgent patch needed to prevent compromise. #CyberSecurity", "creation_timestamp": "2026-07-25T23:30:04.467075Z"} 2026-07-25T23:30:04.467075+00:00 https://vulnerability.circl.lu/sighting/2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa/export 2026-08-14T18:58:54.023500+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrhrrsvpcz2k", "content": "\ud83d\udd34 EXPLOITED\n\nWindmill, the open-source automation platform, has an unauthenticated flaw (CVE-2026-29059) that lets a stranger read files off the server. It is being exploited now.\n\nRun Windmill? Update to 1.603.3 and rotate exposed secrets.", "creation_timestamp": "2026-07-25T11:39:03.559948Z"} 2026-07-25T11:39:03.559948+00:00 https://vulnerability.circl.lu/sighting/3c69b1e0-c70e-4d01-9c63-98e65369f5ec/export 2026-08-14T18:58:54.023612+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3c69b1e0-c70e-4d01-9c63-98e65369f5ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "https://t.me/thehackernews/9581", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.\n\nFull details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "creation_timestamp": "2026-07-24T00:00:11.399037Z"} 2026-07-24T00:00:11.399037+00:00 https://vulnerability.circl.lu/sighting/bfd26d90-f4f8-4298-92ab-24629da0e4c7/export 2026-08-14T18:58:54.023709+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "bfd26d90-f4f8-4298-92ab-24629da0e4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "Telegram/D39b8odzloEyVSPfYMfhmnBgzft4qdO2zImNqzlw4Q0WVA", "content": "", "creation_timestamp": "2026-07-24T00:00:09.387494Z"} 2026-07-24T00:00:09.387494+00:00 https://vulnerability.circl.lu/sighting/bb7c9cb6-0ddd-40d4-887a-0487db343817/export 2026-08-14T18:58:54.023807+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "bb7c9cb6-0ddd-40d4-887a-0487db343817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mrcpcyh5ge2r", "content": "VulnCheck says attackers are exploiting Windmill CVE-2026-29059 to read server files, with about 170 vulnerable systems exposed in 24 countries.", "creation_timestamp": "2026-07-23T11:11:40.105112Z"} 2026-07-23T11:11:40.105112+00:00 https://vulnerability.circl.lu/sighting/b44530ea-8f16-47eb-af81-812e1bd8246d/export 2026-08-14T18:58:54.023911+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b44530ea-8f16-47eb-af81-812e1bd8246d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "Telegram/D39b8odzloEyVSPfYMfhmnBgzft4qdO2zImNqzlw4Q0WVA", "content": "", "creation_timestamp": "2026-07-23T10:00:02.719287Z"} 2026-07-23T10:00:02.719287+00:00 https://vulnerability.circl.lu/sighting/3f3f4f00-df3c-4874-9418-922bda395f67/export 2026-08-14T18:58:54.024007+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3f3f4f00-df3c-4874-9418-922bda395f67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrc4s5vdwk2a", "content": "Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication\n\nA high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.\n\nThe vulnerability in question is CVE-2026-29059 (CVS\u2026\n#hackernews #news", "creation_timestamp": "2026-07-23T05:40:07.736949Z"} 2026-07-23T05:40:07.736949+00:00 https://vulnerability.circl.lu/sighting/d87486a5-5d41-4fc0-abbb-20911fca9d89/export 2026-08-14T18:58:54.024104+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d87486a5-5d41-4fc0-abbb-20911fca9d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://t.me/thehackernews/9581", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.\n\nFull details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "creation_timestamp": "2026-07-23T05:00:04.023344Z"} 2026-07-23T05:00:04.023344+00:00 https://vulnerability.circl.lu/sighting/4d92f94b-9737-4793-9ebd-c5f4dcd6690b/export 2026-08-14T18:58:54.024198+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4d92f94b-9737-4793-9ebd-c5f4dcd6690b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "content": "A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.\n\nThe vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's \"get_log_file\" endpoint (\"/api/w/{workspace}/jobs_u/get_log_file/{filename}\").\n\n\"The filename parameter is concatenated into", "creation_timestamp": "2026-07-23T01:00:40.662599Z"} 2026-07-23T01:00:40.662599+00:00