https://vulnerability.circl.lu/sightings/feed 2026-08-14T09:49:14.374944+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d99b5152-123e-41bd-bb53-230342c20abb/export 2026-08-14T09:49:14.405452+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d99b5152-123e-41bd-bb53-230342c20abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-33267-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:49:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-33267 \u2014 Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-13T00:00:06.813063Z"} 2026-08-13T00:00:06.813063+00:00 https://vulnerability.circl.lu/sighting/fc4ff259-248e-4bce-a684-6fd136061a16/export 2026-08-14T09:49:14.409035+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "fc4ff259-248e-4bce-a684-6fd136061a16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://t.me/GithubRedTeam/97768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-33267-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:49:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-33267 \u2014 Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-12T19:00:03.535759Z"} 2026-08-12T19:00:03.535759+00:00 https://vulnerability.circl.lu/sighting/e454f61e-1b6c-4ade-a878-b15ca516613b/export 2026-08-14T09:49:14.409224+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e454f61e-1b6c-4ade-a878-b15ca516613b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrriaopnw32v", "content": "\u26a0\ufe0f PATCH NOW\n\nApache Traffic Server has a critical flaw (CVE-2026-33267, CVSS 10) that lets an attacker smuggle hidden requests through the proxy and forge the internal data it trusts.\n\nAffects 9.2.0-9.2.14 and 10.1.0-10.1.3.\n\nFix: upgrade to 9.2.15 or 10.1.4.", "creation_timestamp": "2026-07-29T08:15:02.812674Z"} 2026-07-29T08:15:02.812674+00:00 https://vulnerability.circl.lu/sighting/e697ea1e-756d-4e77-9b18-a816b2cdd22d/export 2026-08-14T09:49:14.409344+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e697ea1e-756d-4e77-9b18-a816b2cdd22d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrgxocsiq2v", "content": "CVE-2026-33267 - apache traffic server\nApache Traffic Server versions 9.2.0 to 9.2.14 and 10.1.0 to 10.1.3 have a security issue. An attacker could manipulate certain headers to make the server think\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-29T07:52:05.731122Z"} 2026-07-29T07:52:05.731122+00:00 https://vulnerability.circl.lu/sighting/82e6fe94-42d0-4bc7-a137-9114c747b4ce/export 2026-08-14T09:49:14.409451+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "82e6fe94-42d0-4bc7-a137-9114c747b4ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq7oxjbz6v2d", "content": "CVE-2026-33264\nA bug in Apache Airflow allows a malicious DAG author to execute code on the Airflow server. This happens when the server loads a DAG that contains a malicious trigger. To fix this, users should upgrade to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-09T13:02:03.652598Z"} 2026-07-09T13:02:03.652598+00:00 https://vulnerability.circl.lu/sighting/6f4b5eaa-3eb9-478e-9155-410d75ff205b/export 2026-08-14T09:49:14.409570+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6f4b5eaa-3eb9-478e-9155-410d75ff205b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq6pfc77f32f", "content": "\ud83d\udccc CVE-2026-33264 - A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server l... https://www.cyberhub.blog/cves/CVE-2026-33264", "creation_timestamp": "2026-07-09T03:37:06.086667Z"} 2026-07-09T03:37:06.086667+00:00 https://vulnerability.circl.lu/sighting/7438ba62-ee7e-4528-ab45-a6e84892da7b/export 2026-08-14T09:49:14.409679+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7438ba62-ee7e-4528-ab45-a6e84892da7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq2z7dj6b22i", "content": "CVE-2026-33264 - apache airflow\nA bug in Apache Airflow allowed malicious DAG authors to execute code on the Airflow server, potentially leading to unauthorized access or data breaches. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheairflow #apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-07T16:22:04.705363Z"} 2026-07-07T16:22:04.705363+00:00 https://vulnerability.circl.lu/sighting/0ec945df-5467-4913-a299-a1ccd45ef6da/export 2026-08-14T09:49:14.409810+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0ec945df-5467-4913-a299-a1ccd45ef6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2k4insdp2w", "content": "CVE-2026-33264 - Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()\nCVE ID : CVE-2026-33264\n \n Published : July 7, 2026, 10:16 a.m. | 1\u00a0hour, 31\u00a0minutes ago\n \n Description : A bug in `BaseSerialization.deserialize()`...", "creation_timestamp": "2026-07-07T11:52:06.860608Z"} 2026-07-07T11:52:06.860608+00:00 https://vulnerability.circl.lu/sighting/f9bc7807-3cae-4760-a1f7-838499005021/export 2026-08-14T09:49:14.409918+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f9bc7807-3cae-4760-a1f7-838499005021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jez5o4b27", "content": "CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()", "creation_timestamp": "2026-07-07T11:38:55.238434Z"} 2026-07-07T11:38:55.238434+00:00 https://vulnerability.circl.lu/sighting/f726afa5-65ce-4b64-bdc6-25b05107873e/export 2026-08-14T09:49:14.410020+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f726afa5-65ce-4b64-bdc6-25b05107873e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-33264", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23", "content": "CVE-2026-33264: Apache Airflow <3.3.0 has a CRITICAL deserialization bug \u2014 DAG authors could trigger RCE on Scheduler/API Server. Upgrade to 3.3.0+ and restrict deserialization classes now. https://radar.offseq.com/threat/cve-2026-33264-cwe-502-deserialization-of-untruste-8bbc1aa55d6c3415 #OffSeq...", "creation_timestamp": "2026-07-07T10:30:27.679495Z"} 2026-07-07T10:30:27.679495+00:00