https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 14 Aug 2026 09:49:22 +0000 https://vulnerability.circl.lu/sighting/d99b5152-123e-41bd-bb53-230342c20abb/export {"uuid": "d99b5152-123e-41bd-bb53-230342c20abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-33267-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:49:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-33267 \u2014 Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-13T00:00:06.813063Z"} {"uuid": "d99b5152-123e-41bd-bb53-230342c20abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-33267-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:49:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-33267 \u2014 Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-13T00:00:06.813063Z"} https://vulnerability.circl.lu/sighting/d99b5152-123e-41bd-bb53-230342c20abb/export Thu, 13 Aug 2026 00:00:06 +0000 https://vulnerability.circl.lu/sighting/fc4ff259-248e-4bce-a684-6fd136061a16/export {"uuid": "fc4ff259-248e-4bce-a684-6fd136061a16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://t.me/GithubRedTeam/97768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-33267-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:49:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-33267 \u2014 Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-12T19:00:03.535759Z"} {"uuid": "fc4ff259-248e-4bce-a684-6fd136061a16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://t.me/GithubRedTeam/97768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-33267-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:49:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-33267 \u2014 Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-12T19:00:03.535759Z"} https://vulnerability.circl.lu/sighting/fc4ff259-248e-4bce-a684-6fd136061a16/export Wed, 12 Aug 2026 19:00:03 +0000 https://vulnerability.circl.lu/sighting/e454f61e-1b6c-4ade-a878-b15ca516613b/export {"uuid": "e454f61e-1b6c-4ade-a878-b15ca516613b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrriaopnw32v", "content": "\u26a0\ufe0f PATCH NOW\n\nApache Traffic Server has a critical flaw (CVE-2026-33267, CVSS 10) that lets an attacker smuggle hidden requests through the proxy and forge the internal data it trusts.\n\nAffects 9.2.0-9.2.14 and 10.1.0-10.1.3.\n\nFix: upgrade to 9.2.15 or 10.1.4.", "creation_timestamp": "2026-07-29T08:15:02.812674Z"} {"uuid": "e454f61e-1b6c-4ade-a878-b15ca516613b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrriaopnw32v", "content": "\u26a0\ufe0f PATCH NOW\n\nApache Traffic Server has a critical flaw (CVE-2026-33267, CVSS 10) that lets an attacker smuggle hidden requests through the proxy and forge the internal data it trusts.\n\nAffects 9.2.0-9.2.14 and 10.1.0-10.1.3.\n\nFix: upgrade to 9.2.15 or 10.1.4.", "creation_timestamp": "2026-07-29T08:15:02.812674Z"} https://vulnerability.circl.lu/sighting/e454f61e-1b6c-4ade-a878-b15ca516613b/export Wed, 29 Jul 2026 08:15:02 +0000 https://vulnerability.circl.lu/sighting/e697ea1e-756d-4e77-9b18-a816b2cdd22d/export {"uuid": "e697ea1e-756d-4e77-9b18-a816b2cdd22d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrgxocsiq2v", "content": "CVE-2026-33267 - apache traffic server\nApache Traffic Server versions 9.2.0 to 9.2.14 and 10.1.0 to 10.1.3 have a security issue. An attacker could manipulate certain headers to make the server think\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-29T07:52:05.731122Z"} {"uuid": "e697ea1e-756d-4e77-9b18-a816b2cdd22d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33267", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrgxocsiq2v", "content": "CVE-2026-33267 - apache traffic server\nApache Traffic Server versions 9.2.0 to 9.2.14 and 10.1.0 to 10.1.3 have a security issue. An attacker could manipulate certain headers to make the server think\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-29T07:52:05.731122Z"} https://vulnerability.circl.lu/sighting/e697ea1e-756d-4e77-9b18-a816b2cdd22d/export Wed, 29 Jul 2026 07:52:05 +0000 https://vulnerability.circl.lu/sighting/82e6fe94-42d0-4bc7-a137-9114c747b4ce/export {"uuid": "82e6fe94-42d0-4bc7-a137-9114c747b4ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq7oxjbz6v2d", "content": "CVE-2026-33264\nA bug in Apache Airflow allows a malicious DAG author to execute code on the Airflow server. This happens when the server loads a DAG that contains a malicious trigger. To fix this, users should upgrade to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-09T13:02:03.652598Z"} {"uuid": "82e6fe94-42d0-4bc7-a137-9114c747b4ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq7oxjbz6v2d", "content": "CVE-2026-33264\nA bug in Apache Airflow allows a malicious DAG author to execute code on the Airflow server. This happens when the server loads a DAG that contains a malicious trigger. To fix this, users should upgrade to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-09T13:02:03.652598Z"} https://vulnerability.circl.lu/sighting/82e6fe94-42d0-4bc7-a137-9114c747b4ce/export Thu, 09 Jul 2026 13:02:03 +0000 https://vulnerability.circl.lu/sighting/6f4b5eaa-3eb9-478e-9155-410d75ff205b/export {"uuid": "6f4b5eaa-3eb9-478e-9155-410d75ff205b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq6pfc77f32f", "content": "\ud83d\udccc CVE-2026-33264 - A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server l... https://www.cyberhub.blog/cves/CVE-2026-33264", "creation_timestamp": "2026-07-09T03:37:06.086667Z"} {"uuid": "6f4b5eaa-3eb9-478e-9155-410d75ff205b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq6pfc77f32f", "content": "\ud83d\udccc CVE-2026-33264 - A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server l... https://www.cyberhub.blog/cves/CVE-2026-33264", "creation_timestamp": "2026-07-09T03:37:06.086667Z"} https://vulnerability.circl.lu/sighting/6f4b5eaa-3eb9-478e-9155-410d75ff205b/export Thu, 09 Jul 2026 03:37:06 +0000 https://vulnerability.circl.lu/sighting/7438ba62-ee7e-4528-ab45-a6e84892da7b/export {"uuid": "7438ba62-ee7e-4528-ab45-a6e84892da7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq2z7dj6b22i", "content": "CVE-2026-33264 - apache airflow\nA bug in Apache Airflow allowed malicious DAG authors to execute code on the Airflow server, potentially leading to unauthorized access or data breaches. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheairflow #apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-07T16:22:04.705363Z"} {"uuid": "7438ba62-ee7e-4528-ab45-a6e84892da7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq2z7dj6b22i", "content": "CVE-2026-33264 - apache airflow\nA bug in Apache Airflow allowed malicious DAG authors to execute code on the Airflow server, potentially leading to unauthorized access or data breaches. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheairflow #apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-07T16:22:04.705363Z"} https://vulnerability.circl.lu/sighting/7438ba62-ee7e-4528-ab45-a6e84892da7b/export Tue, 07 Jul 2026 16:22:04 +0000 https://vulnerability.circl.lu/sighting/0ec945df-5467-4913-a299-a1ccd45ef6da/export {"uuid": "0ec945df-5467-4913-a299-a1ccd45ef6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2k4insdp2w", "content": "CVE-2026-33264 - Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()\nCVE ID : CVE-2026-33264\n \n Published : July 7, 2026, 10:16 a.m. | 1\u00a0hour, 31\u00a0minutes ago\n \n Description : A bug in `BaseSerialization.deserialize()`...", "creation_timestamp": "2026-07-07T11:52:06.860608Z"} {"uuid": "0ec945df-5467-4913-a299-a1ccd45ef6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2k4insdp2w", "content": "CVE-2026-33264 - Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()\nCVE ID : CVE-2026-33264\n \n Published : July 7, 2026, 10:16 a.m. | 1\u00a0hour, 31\u00a0minutes ago\n \n Description : A bug in `BaseSerialization.deserialize()`...", "creation_timestamp": "2026-07-07T11:52:06.860608Z"} https://vulnerability.circl.lu/sighting/0ec945df-5467-4913-a299-a1ccd45ef6da/export Tue, 07 Jul 2026 11:52:06 +0000 https://vulnerability.circl.lu/sighting/f9bc7807-3cae-4760-a1f7-838499005021/export {"uuid": "f9bc7807-3cae-4760-a1f7-838499005021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jez5o4b27", "content": "CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()", "creation_timestamp": "2026-07-07T11:38:55.238434Z"} {"uuid": "f9bc7807-3cae-4760-a1f7-838499005021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-33264", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jez5o4b27", "content": "CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()", "creation_timestamp": "2026-07-07T11:38:55.238434Z"} https://vulnerability.circl.lu/sighting/f9bc7807-3cae-4760-a1f7-838499005021/export Tue, 07 Jul 2026 11:38:55 +0000 https://vulnerability.circl.lu/sighting/f726afa5-65ce-4b64-bdc6-25b05107873e/export {"uuid": "f726afa5-65ce-4b64-bdc6-25b05107873e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-33264", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23", "content": "CVE-2026-33264: Apache Airflow <3.3.0 has a CRITICAL deserialization bug \u2014 DAG authors could trigger RCE on Scheduler/API Server. Upgrade to 3.3.0+ and restrict deserialization classes now. https://radar.offseq.com/threat/cve-2026-33264-cwe-502-deserialization-of-untruste-8bbc1aa55d6c3415 #OffSeq...", "creation_timestamp": "2026-07-07T10:30:27.679495Z"} {"uuid": "f726afa5-65ce-4b64-bdc6-25b05107873e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-33264", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23", "content": "CVE-2026-33264: Apache Airflow <3.3.0 has a CRITICAL deserialization bug \u2014 DAG authors could trigger RCE on Scheduler/API Server. Upgrade to 3.3.0+ and restrict deserialization classes now. https://radar.offseq.com/threat/cve-2026-33264-cwe-502-deserialization-of-untruste-8bbc1aa55d6c3415 #OffSeq...", "creation_timestamp": "2026-07-07T10:30:27.679495Z"} https://vulnerability.circl.lu/sighting/f726afa5-65ce-4b64-bdc6-25b05107873e/export Tue, 07 Jul 2026 10:30:27 +0000