https://vulnerability.circl.lu/sightings/feed 2026-07-18T13:30:57.173319+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/43cc1a5e-b9fd-4e8e-9f5b-307c764ea966/export 2026-07-18T13:30:57.191900+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "43cc1a5e-b9fd-4e8e-9f5b-307c764ea966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61874", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqs6dskuc23", "content": "\u05d7\u05e9\u05d9\u05e4\u05d4: \u05e4\u05d2\u05d9\u05e2\u05d4 \u05e7\u05e9\u05d4 \u05d1\u05e4\u05e8\u05d5\u05d8\u05d5\u05e7\u05d5\u05dc FileBrowser - \u05de\u05d4 \u05e6\u05e8\u05d9\u05da \u05dc\u05d3\u05e2\u05ea \u05e2\u05dc CVE-2026-61874\n\n\n\nhttps://khesef.xyz/posts/D0A762A3-1DFD-49D3-B395-FE6A0152434A", "creation_timestamp": "2026-07-16T08:14:49.352194Z"} 2026-07-16T08:14:49.352194+00:00 https://vulnerability.circl.lu/sighting/cc78840c-461d-49f9-a0b9-8889471c9803/export 2026-07-18T13:30:57.195005+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "cc78840c-461d-49f9-a0b9-8889471c9803", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61873", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqp4jgjut22x", "content": "CVE-2026-61873 - Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename\nCVE ID : CVE-2026-61873\n \n Published : July 15, 2026, 12:18 p.m. | 2\u00a0hours, 16\u00a0minutes ago\n \n Description : Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's...", "creation_timestamp": "2026-07-15T16:14:39.505205Z"} 2026-07-15T16:14:39.505205+00:00 https://vulnerability.circl.lu/sighting/ef769c4a-3ee9-4d6e-89eb-4ee2c6490c00/export 2026-07-18T13:30:57.195146+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ef769c4a-3ee9-4d6e-89eb-4ee2c6490c00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61874", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkyxtlm5b2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-61874 \u0432 FileBrowser: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/5ED69543-D28D-4272-9B89-CBAA6DF714B5", "creation_timestamp": "2026-07-14T01:00:29.203035Z"} 2026-07-14T01:00:29.203035+00:00 https://vulnerability.circl.lu/sighting/7cbe9be7-a0d6-451f-bd04-afeb50058387/export 2026-07-18T13:30:57.195253+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7cbe9be7-a0d6-451f-bd04-afeb50058387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61876", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mqhv5ijuan2b", "content": "OpenWrt's LuCI web panel has a stored XSS flaw (CVE-2026-61876, CVSS 8.8): a device on the network can hide a script in its DHCPv6 hostname that runs in the admin's browser.\n\nAffects OpenWrt routers serving untrusted devices.\n\nFix: update LuCI to the patched build.", "creation_timestamp": "2026-07-12T19:14:05.048595Z"} 2026-07-12T19:14:05.048595+00:00 https://vulnerability.circl.lu/sighting/cda4d073-60c0-42a6-b711-b655d497ebc3/export 2026-07-18T13:30:57.195361+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "cda4d073-60c0-42a6-b711-b655d497ebc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-61876", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqhbx44fvl2j", "content": "CRITICAL XSS in OpenWrt LuCI (CVE-2026-61876): Attackers on your network can inject scripts via DHCPv6 hostnames, targeting admin browsers. Restrict access & check advisories for patches. https://radar.offseq.com/threat/cve-2026-61876-improper-neutralization-of-input-du-90cbeb597700a4fd #OffSeq #...", "creation_timestamp": "2026-07-12T13:30:29.533687Z"} 2026-07-12T13:30:29.533687+00:00 https://vulnerability.circl.lu/sighting/d11300f6-18d7-442f-aed9-a2353209c517/export 2026-07-18T13:30:57.195463+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d11300f6-18d7-442f-aed9-a2353209c517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-61876", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116907247335811041", "content": "OpenWrt LuCI hit by CRITICAL XSS (CVE-2026-61876, CVSS 9.4): DHCPv6 hostnames not properly encoded, enabling adjacent attackers to inject scripts into admin browsers. Restrict interface access, monitor advisories. https://radar.offseq.com/threat/cve-2026-61876-improper-neutralization-of-input-du-90cbeb597700a4fd #OffSeq #OpenWrt #XSS #Infosec", "creation_timestamp": "2026-07-12T13:30:27.742420Z"} 2026-07-12T13:30:27.742420+00:00 https://vulnerability.circl.lu/sighting/6d4c57c4-703b-40e7-a3d3-711807b4464a/export 2026-07-18T13:30:57.195573+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6d4c57c4-703b-40e7-a3d3-711807b4464a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61875", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqhb7vcc472x", "content": "CVE-2026-61875 - luci-app-upnp Stored XSS via UPnP Port Mapping Description\nCVE ID : CVE-2026-61875\n \n Published : July 12, 2026, 12:16 p.m. | 16\u00a0minutes ago\n \n Description : luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN cli...", "creation_timestamp": "2026-07-12T13:17:30.235451Z"} 2026-07-12T13:17:30.235451+00:00 https://vulnerability.circl.lu/sighting/8d25d237-0ff3-489a-b9b8-47dc1a03555e/export 2026-07-18T13:30:57.195672+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8d25d237-0ff3-489a-b9b8-47dc1a03555e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61876", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqhawwrokk27", "content": "CVE-2026-61876 - LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting\nCVE ID : CVE-2026-61876\n \n Published : July 12, 2026, 12:16 p.m. | 16\u00a0minutes ago\n \n Description : LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing a...", "creation_timestamp": "2026-07-12T13:12:29.728444Z"} 2026-07-12T13:12:29.728444+00:00 https://vulnerability.circl.lu/sighting/98be33ec-09c0-4a6f-9010-04a83b77f3b1/export 2026-07-18T13:30:57.195769+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "98be33ec-09c0-4a6f-9010-04a83b77f3b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61876", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhabnqobz2k", "content": "\ud83d\udfe0 CVE-2026-61876 - High (8.8)\n\nLuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61876/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T13:00:35.941323Z"} 2026-07-12T13:00:35.941323+00:00 https://vulnerability.circl.lu/sighting/8ea01428-6ef3-4039-99c9-e86f1de22bfa/export 2026-07-18T13:30:57.195865+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8ea01428-6ef3-4039-99c9-e86f1de22bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61875", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhabhbgbv2r", "content": "\ud83d\udfe0 CVE-2026-61875 - High (8.8)\n\nluci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LA...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61875/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T13:00:29.465684Z"} 2026-07-12T13:00:29.465684+00:00