https://vulnerability.circl.lu/sightings/feed 2026-07-14T20:44:11.508720+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1ed2baf0-8380-46c3-be54-b427ff40c80a/export 2026-07-14T20:44:11.534181+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1ed2baf0-8380-46c3-be54-b427ff40c80a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59707", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdemnzsjd2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59707 \u0432 LocalAI: \u0443\u0433\u0440\u043e\u0437\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/72D35637-2EC1-48C7-BA74-DE777C1EC56C", "creation_timestamp": "2026-07-11T00:07:41.219131Z"} 2026-07-11T00:07:41.219131+00:00 https://vulnerability.circl.lu/sighting/8609f02c-e8f2-41c7-b666-114ecf64fdab/export 2026-07-14T20:44:11.536356+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8609f02c-e8f2-41c7-b666-114ecf64fdab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59704", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdeherda22s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59704 \u0432 Cap: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/B0A919C5-932F-4B2A-8EC7-82B0EA0F5741", "creation_timestamp": "2026-07-11T00:04:43.335895Z"} 2026-07-11T00:04:43.335895+00:00 https://vulnerability.circl.lu/sighting/9b8d2355-8cca-4f40-8146-bf97ac8ca5c2/export 2026-07-14T20:44:11.536460+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9b8d2355-8cca-4f40-8146-bf97ac8ca5c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59702", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqddq4mvug2z", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59702 \u0432 Repomix: \u0443\u0433\u0440\u043e\u0437\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/E5DD7C40-69F9-4C24-AFF5-9AB19269707B", "creation_timestamp": "2026-07-10T23:51:43.190457Z"} 2026-07-10T23:51:43.190457+00:00 https://vulnerability.circl.lu/sighting/f76aa55c-fcf9-49f7-8a53-ced46a4bb66d/export 2026-07-14T20:44:11.536532+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f76aa55c-fcf9-49f7-8a53-ced46a4bb66d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59706", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/116890266111536679", "content": "I keep hearing how AI and LLMs are the future but they sure keep feeling like shitty applications from 20 years ago.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59706\n\nmem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm endpoint.", "creation_timestamp": "2026-07-09T13:31:54.921466Z"} 2026-07-09T13:31:54.921466+00:00 https://vulnerability.circl.lu/sighting/d45fe9fd-f09d-4101-b557-c86a41b08ce8/export 2026-07-14T20:44:11.536608+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d45fe9fd-f09d-4101-b557-c86a41b08ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59702", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ptfkrs52x", "content": "CVE-2026-59702 - repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack\nCVE ID : CVE-2026-59702\n \n Published : July 8, 2026, 4:16 p.m. | 58\u00a0minutes ago\n \n Description : repomix contains a server-side request forgery vulnerability in the POST /a...", "creation_timestamp": "2026-07-08T18:12:19.890908Z"} 2026-07-08T18:12:19.890908+00:00 https://vulnerability.circl.lu/sighting/4b629588-d5e5-483f-92d3-543afc21ca4e/export 2026-07-14T20:44:11.536674+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4b629588-d5e5-483f-92d3-543afc21ca4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59703", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pbiipf427", "content": "CVE-2026-59703 - repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint\nCVE ID : CVE-2026-59703\n \n Published : July 8, 2026, 3:16 p.m. | 1\u00a0hour, 58\u00a0minutes ago\n \n Description : repomix contains a local file inclusion vulnerability in the git clone endpoint...", "creation_timestamp": "2026-07-08T18:02:18.795791Z"} 2026-07-08T18:02:18.795791+00:00 https://vulnerability.circl.lu/sighting/1a4d537d-a549-40d2-8be0-d6e3f5e3fb3f/export 2026-07-14T20:44:11.536739+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1a4d537d-a549-40d2-8be0-d6e3f5e3fb3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59702", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq5kogjzv52f", "content": "CVE-2026-59702 - repomix\nThe Repomix API endpoint is vulnerable to attacks that can access private network addresses, GCP metadata services, or local filesystem paths. This means that an attacker could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#repomix #CVE #infosec", "creation_timestamp": "2026-07-08T16:40:04.423234Z"} 2026-07-08T16:40:04.423234+00:00 https://vulnerability.circl.lu/sighting/b1375f60-6d78-4d3e-ba52-79eddf4d6f19/export 2026-07-14T20:44:11.536808+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b1375f60-6d78-4d3e-ba52-79eddf4d6f19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59704", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3wocgs4626", "content": "CVE-2026-59704 - Cap - Missing Access Control in Video AI Metadata Endpoint\nCVE ID : CVE-2026-59704\n \n Published : July 7, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning privat...", "creation_timestamp": "2026-07-08T01:09:26.667150Z"} 2026-07-08T01:09:26.667150+00:00 https://vulnerability.circl.lu/sighting/43e0b2b8-8b59-42cf-9566-6a4b5861905c/export 2026-07-14T20:44:11.536872+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "43e0b2b8-8b59-42cf-9566-6a4b5861905c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59707", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3rytpkdd26", "content": "CVE-2026-59707 - LocalAI - Server-Side Request Forgery via POST /models/apply\nCVE ID : CVE-2026-59707\n \n Published : July 7, 2026, 9:17 p.m. | 1\u00a0hour, 57\u00a0minutes ago\n \n Description : LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /mod...", "creation_timestamp": "2026-07-07T23:45:50.423460Z"} 2026-07-07T23:45:50.423460+00:00 https://vulnerability.circl.lu/sighting/3f9d1005-184b-44ec-97f1-8f321d0e5ca2/export 2026-07-14T20:44:11.536940+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3f9d1005-184b-44ec-97f1-8f321d0e5ca2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59706", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3rokhsrv2g", "content": "CVE-2026-59706 - mem0 - Server-Side Request Forgery and Plaintext API Key Exposure via Unauthenticated Config Endpoints\nCVE ID : CVE-2026-59706\n \n Published : July 7, 2026, 10:16 p.m. | 58\u00a0minutes ago\n \n Description : mem0 contains unauthenticated config API endpoints that exp...", "creation_timestamp": "2026-07-07T23:40:06.213808Z"} 2026-07-07T23:40:06.213808+00:00