https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 13 Aug 2026 03:52:07 +0000 https://vulnerability.circl.lu/sighting/f4d6e975-4717-4bbf-a423-647e0f44f05e/export {"uuid": "f4d6e975-4717-4bbf-a423-647e0f44f05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-07 05:21:48 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:09.462793Z"} {"uuid": "f4d6e975-4717-4bbf-a423-647e0f44f05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-07 05:21:48 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:09.462793Z"} https://vulnerability.circl.lu/sighting/f4d6e975-4717-4bbf-a423-647e0f44f05e/export Mon, 10 Aug 2026 10:02:09 +0000 https://vulnerability.circl.lu/sighting/c7299fb3-0b54-4a4a-b83f-1238eb6c4810/export {"uuid": "c7299fb3-0b54-4a4a-b83f-1238eb6c4810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mrizj7i2ye2c", "content": "Active exploit! CVE-2026-29059 (CVSS 7.5) affects Windmill's get_log_file endpoint via unauthenticated path traversal. Urgent patch needed to prevent compromise. #CyberSecurity", "creation_timestamp": "2026-07-25T23:30:04.467075Z"} {"uuid": "c7299fb3-0b54-4a4a-b83f-1238eb6c4810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mrizj7i2ye2c", "content": "Active exploit! CVE-2026-29059 (CVSS 7.5) affects Windmill's get_log_file endpoint via unauthenticated path traversal. Urgent patch needed to prevent compromise. #CyberSecurity", "creation_timestamp": "2026-07-25T23:30:04.467075Z"} https://vulnerability.circl.lu/sighting/c7299fb3-0b54-4a4a-b83f-1238eb6c4810/export Sat, 25 Jul 2026 23:30:04 +0000 https://vulnerability.circl.lu/sighting/2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa/export {"uuid": "2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrhrrsvpcz2k", "content": "\ud83d\udd34 EXPLOITED\n\nWindmill, the open-source automation platform, has an unauthenticated flaw (CVE-2026-29059) that lets a stranger read files off the server. It is being exploited now.\n\nRun Windmill? Update to 1.603.3 and rotate exposed secrets.", "creation_timestamp": "2026-07-25T11:39:03.559948Z"} {"uuid": "2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrhrrsvpcz2k", "content": "\ud83d\udd34 EXPLOITED\n\nWindmill, the open-source automation platform, has an unauthenticated flaw (CVE-2026-29059) that lets a stranger read files off the server. It is being exploited now.\n\nRun Windmill? Update to 1.603.3 and rotate exposed secrets.", "creation_timestamp": "2026-07-25T11:39:03.559948Z"} https://vulnerability.circl.lu/sighting/2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa/export Sat, 25 Jul 2026 11:39:03 +0000 https://vulnerability.circl.lu/sighting/3c69b1e0-c70e-4d01-9c63-98e65369f5ec/export {"uuid": "3c69b1e0-c70e-4d01-9c63-98e65369f5ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "https://t.me/thehackernews/9581", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.\n\nFull details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "creation_timestamp": "2026-07-24T00:00:11.399037Z"} {"uuid": "3c69b1e0-c70e-4d01-9c63-98e65369f5ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "https://t.me/thehackernews/9581", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.\n\nFull details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "creation_timestamp": "2026-07-24T00:00:11.399037Z"} https://vulnerability.circl.lu/sighting/3c69b1e0-c70e-4d01-9c63-98e65369f5ec/export Fri, 24 Jul 2026 00:00:11 +0000 https://vulnerability.circl.lu/sighting/bfd26d90-f4f8-4298-92ab-24629da0e4c7/export {"uuid": "bfd26d90-f4f8-4298-92ab-24629da0e4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "Telegram/D39b8odzloEyVSPfYMfhmnBgzft4qdO2zImNqzlw4Q0WVA", "content": "", "creation_timestamp": "2026-07-24T00:00:09.387494Z"} {"uuid": "bfd26d90-f4f8-4298-92ab-24629da0e4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "Telegram/D39b8odzloEyVSPfYMfhmnBgzft4qdO2zImNqzlw4Q0WVA", "content": "", "creation_timestamp": "2026-07-24T00:00:09.387494Z"} https://vulnerability.circl.lu/sighting/bfd26d90-f4f8-4298-92ab-24629da0e4c7/export Fri, 24 Jul 2026 00:00:09 +0000 https://vulnerability.circl.lu/sighting/bb7c9cb6-0ddd-40d4-887a-0487db343817/export {"uuid": "bb7c9cb6-0ddd-40d4-887a-0487db343817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mrcpcyh5ge2r", "content": "VulnCheck says attackers are exploiting Windmill CVE-2026-29059 to read server files, with about 170 vulnerable systems exposed in 24 countries.", "creation_timestamp": "2026-07-23T11:11:40.105112Z"} {"uuid": "bb7c9cb6-0ddd-40d4-887a-0487db343817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mrcpcyh5ge2r", "content": "VulnCheck says attackers are exploiting Windmill CVE-2026-29059 to read server files, with about 170 vulnerable systems exposed in 24 countries.", "creation_timestamp": "2026-07-23T11:11:40.105112Z"} https://vulnerability.circl.lu/sighting/bb7c9cb6-0ddd-40d4-887a-0487db343817/export Thu, 23 Jul 2026 11:11:40 +0000 https://vulnerability.circl.lu/sighting/b44530ea-8f16-47eb-af81-812e1bd8246d/export {"uuid": "b44530ea-8f16-47eb-af81-812e1bd8246d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "Telegram/D39b8odzloEyVSPfYMfhmnBgzft4qdO2zImNqzlw4Q0WVA", "content": "", "creation_timestamp": "2026-07-23T10:00:02.719287Z"} {"uuid": "b44530ea-8f16-47eb-af81-812e1bd8246d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "Telegram/D39b8odzloEyVSPfYMfhmnBgzft4qdO2zImNqzlw4Q0WVA", "content": "", "creation_timestamp": "2026-07-23T10:00:02.719287Z"} https://vulnerability.circl.lu/sighting/b44530ea-8f16-47eb-af81-812e1bd8246d/export Thu, 23 Jul 2026 10:00:02 +0000 https://vulnerability.circl.lu/sighting/3f3f4f00-df3c-4874-9418-922bda395f67/export {"uuid": "3f3f4f00-df3c-4874-9418-922bda395f67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrc4s5vdwk2a", "content": "Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication\n\nA high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.\n\nThe vulnerability in question is CVE-2026-29059 (CVS\u2026\n#hackernews #news", "creation_timestamp": "2026-07-23T05:40:07.736949Z"} {"uuid": "3f3f4f00-df3c-4874-9418-922bda395f67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrc4s5vdwk2a", "content": "Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication\n\nA high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.\n\nThe vulnerability in question is CVE-2026-29059 (CVS\u2026\n#hackernews #news", "creation_timestamp": "2026-07-23T05:40:07.736949Z"} https://vulnerability.circl.lu/sighting/3f3f4f00-df3c-4874-9418-922bda395f67/export Thu, 23 Jul 2026 05:40:07 +0000 https://vulnerability.circl.lu/sighting/d87486a5-5d41-4fc0-abbb-20911fca9d89/export {"uuid": "d87486a5-5d41-4fc0-abbb-20911fca9d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://t.me/thehackernews/9581", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.\n\nFull details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "creation_timestamp": "2026-07-23T05:00:04.023344Z"} {"uuid": "d87486a5-5d41-4fc0-abbb-20911fca9d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://t.me/thehackernews/9581", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.\n\nFull details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "creation_timestamp": "2026-07-23T05:00:04.023344Z"} https://vulnerability.circl.lu/sighting/d87486a5-5d41-4fc0-abbb-20911fca9d89/export Thu, 23 Jul 2026 05:00:04 +0000 https://vulnerability.circl.lu/sighting/4d92f94b-9737-4793-9ebd-c5f4dcd6690b/export {"uuid": "4d92f94b-9737-4793-9ebd-c5f4dcd6690b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "content": "A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.\n\nThe vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's \"get_log_file\" endpoint (\"/api/w/{workspace}/jobs_u/get_log_file/{filename}\").\n\n\"The filename parameter is concatenated into", "creation_timestamp": "2026-07-23T01:00:40.662599Z"} {"uuid": "4d92f94b-9737-4793-9ebd-c5f4dcd6690b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html", "content": "A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.\n\nThe vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's \"get_log_file\" endpoint (\"/api/w/{workspace}/jobs_u/get_log_file/{filename}\").\n\n\"The filename parameter is concatenated into", "creation_timestamp": "2026-07-23T01:00:40.662599Z"} https://vulnerability.circl.lu/sighting/4d92f94b-9737-4793-9ebd-c5f4dcd6690b/export Thu, 23 Jul 2026 01:00:40 +0000