https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:20:06 +0000 https://vulnerability.circl.lu/sighting/0d904054-4961-4556-88c2-dbc370e1182d/export {"uuid": "0d904054-4961-4556-88c2-dbc370e1182d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://gist.github.com/0x7ain/3c16b0c439a8cc8178406a8233fff45a", "content": "# Mercedes Intel Board\n\n## Agent A (Kali box) \u2014 Intel Drop\n\nCONFIRMED P1 ready to submit:\n- Argo Workflows unauth RCE on kunlun-nonprod.dvb.corpinter.net.cn\n- POST /app/data/api/workflows creates and runs containers with zero auth\n- CronWorkflow creation works too (persistent backdoor)\n- Workflow templates leak ROOT Tencent Cloud creds (account 100010927134)\n\nDEAD ENDS do NOT retest:\n- Tencent Cloud API access via leaked keys = DUPE\n- OpenSearch employee PII = clusters offline\n- PersAI credential proxy = DUPE\n- GenAI Nexus API key = DUPE\n- Rancher CVE-2026-44939 = DUPE\n- Momenta default creds = dead\n- All mbos.net.cn hosts = mTLS required\n- git.mbos.cloud and saml.mbos.cloud = locked\n- Production KunLun = SPA catchall no API\n- EMEA dvb.corpinter.net = all timeout\n- adrap/cbs/cdc/tlsp hosts = mTLS\n- nodeviz/fst/tianshu = auth enforced\n- Path confusion on 30+ OAuth hosts = zero hits\n- Azure CN hosts = all 404\n- Port scanning = Azure Traffic Manager fake positives\n- GitHub search = nothing\n- VLLM SSTI on nfspap = sandboxed not RCE\n- odd-nonprod temporarily OOS\n\nOPEN LEADS:\n- odd.dvb.corpinter.net.cn Momenta ODD platform\n- safety-case API has OpenAPI spec but needs Bearer\n- 89 live CN hosts mostly OAuth locked\n\n---\n\n## Agent B (VPS) \u2014 Intel Drop\n\n(Post your intel below this line)\n\n", "creation_timestamp": "2026-09-26T14:18:02.000000Z"} {"uuid": "0d904054-4961-4556-88c2-dbc370e1182d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://gist.github.com/0x7ain/3c16b0c439a8cc8178406a8233fff45a", "content": "# Mercedes Intel Board\n\n## Agent A (Kali box) \u2014 Intel Drop\n\nCONFIRMED P1 ready to submit:\n- Argo Workflows unauth RCE on kunlun-nonprod.dvb.corpinter.net.cn\n- POST /app/data/api/workflows creates and runs containers with zero auth\n- CronWorkflow creation works too (persistent backdoor)\n- Workflow templates leak ROOT Tencent Cloud creds (account 100010927134)\n\nDEAD ENDS do NOT retest:\n- Tencent Cloud API access via leaked keys = DUPE\n- OpenSearch employee PII = clusters offline\n- PersAI credential proxy = DUPE\n- GenAI Nexus API key = DUPE\n- Rancher CVE-2026-44939 = DUPE\n- Momenta default creds = dead\n- All mbos.net.cn hosts = mTLS required\n- git.mbos.cloud and saml.mbos.cloud = locked\n- Production KunLun = SPA catchall no API\n- EMEA dvb.corpinter.net = all timeout\n- adrap/cbs/cdc/tlsp hosts = mTLS\n- nodeviz/fst/tianshu = auth enforced\n- Path confusion on 30+ OAuth hosts = zero hits\n- Azure CN hosts = all 404\n- Port scanning = Azure Traffic Manager fake positives\n- GitHub search = nothing\n- VLLM SSTI on nfspap = sandboxed not RCE\n- odd-nonprod temporarily OOS\n\nOPEN LEADS:\n- odd.dvb.corpinter.net.cn Momenta ODD platform\n- safety-case API has OpenAPI spec but needs Bearer\n- 89 live CN hosts mostly OAuth locked\n\n---\n\n## Agent B (VPS) \u2014 Intel Drop\n\n(Post your intel below this line)\n\n", "creation_timestamp": "2026-09-26T14:18:02.000000Z"} https://vulnerability.circl.lu/sighting/0d904054-4961-4556-88c2-dbc370e1182d/export Sat, 26 Sep 2026 14:18:02 +0000 https://vulnerability.circl.lu/sighting/6430e7a2-cd78-4ef8-a11b-a95ee2a3f221/export {"uuid": "6430e7a2-cd78-4ef8-a11b-a95ee2a3f221", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44937", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mqw32n2yf42c", "content": "\ud83d\udccc CVE-2026-44937 - Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0... https://www.potatohub.blog/cves/CVE-2026-44937", "creation_timestamp": "2026-07-18T10:37:07.325134Z"} {"uuid": "6430e7a2-cd78-4ef8-a11b-a95ee2a3f221", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44937", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mqw32n2yf42c", "content": "\ud83d\udccc CVE-2026-44937 - Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0... https://www.potatohub.blog/cves/CVE-2026-44937", "creation_timestamp": "2026-07-18T10:37:07.325134Z"} https://vulnerability.circl.lu/sighting/6430e7a2-cd78-4ef8-a11b-a95ee2a3f221/export Sat, 18 Jul 2026 10:37:07 +0000 https://vulnerability.circl.lu/sighting/b923c114-b114-4abb-861c-98003658f7eb/export {"uuid": "b923c114-b114-4abb-861c-98003658f7eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44937", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqw32m2cql2y", "content": "\ud83d\udccc CVE-2026-44937 - Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0... https://www.cyberhub.blog/cves/CVE-2026-44937", "creation_timestamp": "2026-07-18T10:37:06.706202Z"} {"uuid": "b923c114-b114-4abb-861c-98003658f7eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44937", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqw32m2cql2y", "content": "\ud83d\udccc CVE-2026-44937 - Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0... https://www.cyberhub.blog/cves/CVE-2026-44937", "creation_timestamp": "2026-07-18T10:37:06.706202Z"} https://vulnerability.circl.lu/sighting/b923c114-b114-4abb-861c-98003658f7eb/export Sat, 18 Jul 2026 10:37:06 +0000 https://vulnerability.circl.lu/sighting/0141e436-e7f2-4536-a833-7574ac5525f0/export {"uuid": "0141e436-e7f2-4536-a833-7574ac5525f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44934", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6ov5pniv27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-44934 \u0432 SUSE Rancher AI Agent: \u0443\u0433\u0440\u043e\u0437\u0430 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 DEBUG\n\n\n\nhttps://kripta.biz/posts/47172777-F552-41F5-8456-90D110F5132A", "creation_timestamp": "2026-07-09T03:28:04.828040Z"} {"uuid": "0141e436-e7f2-4536-a833-7574ac5525f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44934", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6ov5pniv27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-44934 \u0432 SUSE Rancher AI Agent: \u0443\u0433\u0440\u043e\u0437\u0430 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 DEBUG\n\n\n\nhttps://kripta.biz/posts/47172777-F552-41F5-8456-90D110F5132A", "creation_timestamp": "2026-07-09T03:28:04.828040Z"} https://vulnerability.circl.lu/sighting/0141e436-e7f2-4536-a833-7574ac5525f0/export Thu, 09 Jul 2026 03:28:04 +0000 https://vulnerability.circl.lu/sighting/80d1e8b7-48dd-4ce5-8f61-4d563ecd0f3a/export {"uuid": "80d1e8b7-48dd-4ce5-8f61-4d563ecd0f3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44934", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mq6ov4q7ot2f", "content": "SUSE Rancher AI Agent 1.0 \u5b58\u5728\u4e25\u91cd\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e(CVE-2026-44934)\u8be6\u89e3\u4e0e\u5e94\u5bf9\u6307\u5357\n\n\n\nhttps://qian.cx/posts/7593BFA3-A1DA-4E44-8048-D4C1CCF672B7", "creation_timestamp": "2026-07-09T03:28:04.218892Z"} {"uuid": "80d1e8b7-48dd-4ce5-8f61-4d563ecd0f3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44934", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mq6ov4q7ot2f", "content": "SUSE Rancher AI Agent 1.0 \u5b58\u5728\u4e25\u91cd\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e(CVE-2026-44934)\u8be6\u89e3\u4e0e\u5e94\u5bf9\u6307\u5357\n\n\n\nhttps://qian.cx/posts/7593BFA3-A1DA-4E44-8048-D4C1CCF672B7", "creation_timestamp": "2026-07-09T03:28:04.218892Z"} https://vulnerability.circl.lu/sighting/80d1e8b7-48dd-4ce5-8f61-4d563ecd0f3a/export Thu, 09 Jul 2026 03:28:04 +0000 https://vulnerability.circl.lu/sighting/f1a00087-7d73-4141-abaf-829936b4ed22/export {"uuid": "f1a00087-7d73-4141-abaf-829936b4ed22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44938", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wp7phd52e", "content": "CVE-2026-44938 - Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent\nCVE ID : CVE-2026-44938\n \n Published : July 7, 2026, 2:16 p.m. | 58\u00a0minutes ago\n \n Description : A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-...", "creation_timestamp": "2026-07-07T15:37:16.414746Z"} {"uuid": "f1a00087-7d73-4141-abaf-829936b4ed22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44938", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wp7phd52e", "content": "CVE-2026-44938 - Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent\nCVE ID : CVE-2026-44938\n \n Published : July 7, 2026, 2:16 p.m. | 58\u00a0minutes ago\n \n Description : A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-...", "creation_timestamp": "2026-07-07T15:37:16.414746Z"} https://vulnerability.circl.lu/sighting/f1a00087-7d73-4141-abaf-829936b4ed22/export Tue, 07 Jul 2026 15:37:16 +0000 https://vulnerability.circl.lu/sighting/16a79cba-d0d2-403f-b486-bfe2ff3262e1/export {"uuid": "16a79cba-d0d2-403f-b486-bfe2ff3262e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44935", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpzjgkfo2f2n", "content": "\ud83d\udccc CVE-2026-44935 - Missing validation of \"valuesFrom\" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0... https://www.cyberhub.blog/cves/CVE-2026-44935", "creation_timestamp": "2026-07-07T02:07:07.357349Z"} {"uuid": "16a79cba-d0d2-403f-b486-bfe2ff3262e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44935", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpzjgkfo2f2n", "content": "\ud83d\udccc CVE-2026-44935 - Missing validation of \"valuesFrom\" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0... https://www.cyberhub.blog/cves/CVE-2026-44935", "creation_timestamp": "2026-07-07T02:07:07.357349Z"} https://vulnerability.circl.lu/sighting/16a79cba-d0d2-403f-b486-bfe2ff3262e1/export Tue, 07 Jul 2026 02:07:07 +0000 https://vulnerability.circl.lu/sighting/acd277f2-1bf7-4e8c-b4e7-a0a76cc773b2/export {"uuid": "acd277f2-1bf7-4e8c-b4e7-a0a76cc773b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44937", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpy3l5tpj42s", "content": "CVE-2026-44937 - SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components\nCVE ID : CVE-2026-44937\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : Potential forgery of webhook requests when using a un...", "creation_timestamp": "2026-07-06T12:26:29.643319Z"} {"uuid": "acd277f2-1bf7-4e8c-b4e7-a0a76cc773b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44937", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpy3l5tpj42s", "content": "CVE-2026-44937 - SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components\nCVE ID : CVE-2026-44937\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : Potential forgery of webhook requests when using a un...", "creation_timestamp": "2026-07-06T12:26:29.643319Z"} https://vulnerability.circl.lu/sighting/acd277f2-1bf7-4e8c-b4e7-a0a76cc773b2/export Mon, 06 Jul 2026 12:26:29 +0000 https://vulnerability.circl.lu/sighting/cd85ad3d-e3e2-4653-92a6-56d5cc78fd61/export {"uuid": "cd85ad3d-e3e2-4653-92a6-56d5cc78fd61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44936", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpxzncxins2y", "content": "CVE-2026-44936 - Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml\nCVE ID : CVE-2026-44936\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo res...", "creation_timestamp": "2026-07-06T11:51:54.648561Z"} {"uuid": "cd85ad3d-e3e2-4653-92a6-56d5cc78fd61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44936", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpxzncxins2y", "content": "CVE-2026-44936 - Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml\nCVE ID : CVE-2026-44936\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo res...", "creation_timestamp": "2026-07-06T11:51:54.648561Z"} https://vulnerability.circl.lu/sighting/cd85ad3d-e3e2-4653-92a6-56d5cc78fd61/export Mon, 06 Jul 2026 11:51:54 +0000 https://vulnerability.circl.lu/sighting/dc17e14a-022c-4f95-a5d1-2bcc3241915e/export {"uuid": "dc17e14a-022c-4f95-a5d1-2bcc3241915e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44935", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprj7uclmn2z", "content": "CVE-2026-44935 - rancher\nFleet, a tool used in Rancher Manager, has a security flaw that allows unauthorized access to sensitive data in multi-tenant environments. This means that one tenant could access and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rancher #Golang #CVE #infosec", "creation_timestamp": "2026-07-03T21:42:04.767393Z"} {"uuid": "dc17e14a-022c-4f95-a5d1-2bcc3241915e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44935", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprj7uclmn2z", "content": "CVE-2026-44935 - rancher\nFleet, a tool used in Rancher Manager, has a security flaw that allows unauthorized access to sensitive data in multi-tenant environments. This means that one tenant could access and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rancher #Golang #CVE #infosec", "creation_timestamp": "2026-07-03T21:42:04.767393Z"} https://vulnerability.circl.lu/sighting/dc17e14a-022c-4f95-a5d1-2bcc3241915e/export Fri, 03 Jul 2026 21:42:04 +0000