https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 14 Sep 2026 05:13:31 +0000 https://vulnerability.circl.lu/sighting/e12052f1-0073-4f77-a5e8-fb0f84a81089/export {"uuid": "e12052f1-0073-4f77-a5e8-fb0f84a81089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59160", "type": "seen", "source": "https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d", "content": "This threat intelligence brief covers two unauthenticated vulnerabilities published in September 2026:\n\n\u2022 **CVE-2026-18351 (CRITICAL, 9.8):** Affects the WordPress plugin *Drag and Drop File Upload for Elementor Forms* (\u22641.6.0). Flawed MIME validation allows unauthenticated arbitrary file uploads, enabling remote code execution (RCE).\n\n\u2022 **CVE-2026-59160 (HIGH, 8.8):** Affects the Node.js package *@yeger/turbo-graph* v2.8.8. Combines insecure network binding (`0.0.0.0`) with an unauthenticated API endpoint, allowing adjacent-network attackers to execute arbitrary tasks via CLI argument injection, potentially resulting in RCE and infrastructure compromise.\n\nBoth vulnerabilities require no authentication, though CVE-2026-59160 is limited to attackers on the same local network segment.", "creation_timestamp": "2026-09-10T04:01:24.879130Z"} {"uuid": "e12052f1-0073-4f77-a5e8-fb0f84a81089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59160", "type": "seen", "source": "https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d", "content": "This threat intelligence brief covers two unauthenticated vulnerabilities published in September 2026:\n\n\u2022 **CVE-2026-18351 (CRITICAL, 9.8):** Affects the WordPress plugin *Drag and Drop File Upload for Elementor Forms* (\u22641.6.0). Flawed MIME validation allows unauthenticated arbitrary file uploads, enabling remote code execution (RCE).\n\n\u2022 **CVE-2026-59160 (HIGH, 8.8):** Affects the Node.js package *@yeger/turbo-graph* v2.8.8. Combines insecure network binding (`0.0.0.0`) with an unauthenticated API endpoint, allowing adjacent-network attackers to execute arbitrary tasks via CLI argument injection, potentially resulting in RCE and infrastructure compromise.\n\nBoth vulnerabilities require no authentication, though CVE-2026-59160 is limited to attackers on the same local network segment.", "creation_timestamp": "2026-09-10T04:01:24.879130Z"} https://vulnerability.circl.lu/sighting/e12052f1-0073-4f77-a5e8-fb0f84a81089/export Thu, 10 Sep 2026 04:01:24 +0000 https://vulnerability.circl.lu/sighting/60033c0b-19ba-4b87-8a27-d0b20916f3c9/export {"uuid": "60033c0b-19ba-4b87-8a27-d0b20916f3c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59160", "type": "published-proof-of-concept", "source": "https://github.com/DerYeger/yeger/security/advisories/GHSA-2r5q-h53f-9rp3", "content": "", "creation_timestamp": "2026-09-10T00:35:15.574962Z"} {"uuid": "60033c0b-19ba-4b87-8a27-d0b20916f3c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59160", "type": "published-proof-of-concept", "source": "https://github.com/DerYeger/yeger/security/advisories/GHSA-2r5q-h53f-9rp3", "content": "", "creation_timestamp": "2026-09-10T00:35:15.574962Z"} https://vulnerability.circl.lu/sighting/60033c0b-19ba-4b87-8a27-d0b20916f3c9/export Thu, 10 Sep 2026 00:35:15 +0000