{"vulnerability": "cve-2026-10721", "sightings": [{"uuid": "617f23bc-5786-43c7-b8a0-6f9a4c1a8a07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10721", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnwltabaqc2p", "content": "CVE-2026-10721 - Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components\nCVE ID : CVE-2026-10721\n \n Published : June 10, 2026, 8:16 a.m. | 2\u00a0hours, 22\u00a0minutes ago\n \n Description : Concrete CMS be...", "creation_timestamp": "2026-06-10T11:22:01.632254Z"}, {"uuid": "e78a8c3a-6035-472b-bf5d-65dfb4c4ba53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107214", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcld2jozu2b", "content": "\ud83d\udfe0 CVE-2026-107214 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107214/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T18:31:16.707788Z"}, {"uuid": "05ebbe77-7d0c-4146-90e8-d9e9028bf9cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107215", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcldarw3a2r", "content": "\ud83d\udfe0 CVE-2026-107215 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107215/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T18:31:24.027575Z"}, {"uuid": "ebaa2b42-9353-463f-9f3a-8b09d8d98e88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107216", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcmyclynb2g", "content": "\ud83d\udfe0 CVE-2026-107216 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107216/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T19:01:04.728981Z"}, {"uuid": "dfa43ef5-13e5-4e50-8467-b17699409dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107212", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcmyitfpa2s", "content": "\ud83d\udfe0 CVE-2026-107212 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107212/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T19:01:10.172366Z"}, {"uuid": "53e35d20-48c9-4f05-b28d-3af0db1c2bdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107219", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcpimkcos2k", "content": "\ud83d\udfe0 CVE-2026-107219 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107219/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T19:45:59.260592Z"}, {"uuid": "2b14ad88-108e-4238-bc46-acaf1b2d1e04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107217", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcpisrwfh2b", "content": "\ud83d\udfe0 CVE-2026-107217 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107217/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T19:46:04.899888Z"}, {"uuid": "4c7ff0fd-f218-4f3c-8476-4e09843a43b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-107217", "type": "published-proof-of-concept", "source": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75", "content": "", "creation_timestamp": "2026-09-10T07:10:04.000000Z"}, {"uuid": "9c458693-040e-4040-95bb-e4ae5712cfce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107212", "type": "seen", "source": "https://gist.github.com/alon710/b9dd9cdea0790c847d9158c76d8625f3", "content": "# CVE-2026-107212: CVE-2026-107212: CPU Exhaustion Denial of Service via Look-Ahead Row Parsing in Excelize\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107212\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-770) in the Excelize library allows remote attackers to cause resource exhaustion (100% CPU usage) via a crafted Microsoft Excel spreadsheet. This occurs because the look-ahead row index parsing in Rows.Columns() fails to enforce upper boundary limits, enabling an out-of-bounds row index to trigger an infinite seek loop inside the Rows iterator.\n\n## TL;DR\nA vulnerability in Excelize allows unauthenticated remote attackers to trigger a sustained Denial of Service (100% CPU exhaustion) by uploading an Excel file containing a row index that exceeds the platform's architectural maximum.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00339 (Percentile: 25.26%)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: PoC / Tested\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- github.com/xuri/excelize\n- github.com/qax-os/excelize\n- **excelize**: >= 2.1.0, <= 2.11.0 (Fixed in: `Commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23`)\n\n## Mitigation\n\n- Update Excelize dependency to a patched version or commit hash\n- Implement context-based execution timeouts on parsing routines\n- Configure strict container-level CPU quotas to prevent host-wide starvation\n- Reject spreadsheet uploads containing abnormal metadata via perimeter inspection\n\n**Remediation Steps:**\n1. Open the project's go.mod file\n2. Update the github.com/xuri/excelize/v2 dependency to commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 or newer\n3. Run 'go mod tidy' to update the dependency tree\n4. Recompile the application and redeploy to staging environments\n5. Run verification tests with crafted out-of-bounds spreadsheet files\n\n## References\n\n- [GitHub Security Advisory GHSA-jw42-f3rr-4cc3](https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3)\n- [Official Fix Pull Request #2438](https://github.com/qax-os/excelize/pull/2438)\n- [Official Fix Commit](https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23)\n- [National Vulnerability Database (NVD) Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-107212)\n- [CVE Org Record](https://www.cve.org/CVERecord?id=CVE-2026-107212)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107212) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T17:30:30.000000Z"}]}