{"vulnerability": "cve-2026-2763", "sightings": [{"uuid": "68d101af-9aa8-4ad7-895d-46afdb85dfff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27633", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvydkhxm32k", "content": "", "creation_timestamp": "2026-02-28T10:11:17.876557Z"}, {"uuid": "cc159135-430c-4c4a-a667-36025eb37028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27630", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvydrlsv22c", "content": "", "creation_timestamp": "2026-02-28T10:11:25.451714Z"}, {"uuid": "d7dde988-f28a-4bb3-8d80-484440164134", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27631", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg4h3g2gcr2y", "content": "", "creation_timestamp": "2026-03-02T23:51:08.937545Z"}, {"uuid": "8be848bc-8ba6-4b57-9256-47741e14206d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27637", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfu2ap3bvu2q", "content": "", "creation_timestamp": "2026-02-27T15:40:10.060401Z"}, {"uuid": "ee0845ef-fe12-4c72-b531-88e030bc3e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27637", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfnt5toixi2t", "content": "", "creation_timestamp": "2026-02-25T04:17:20.019082Z"}, {"uuid": "fd520188-9f4b-490c-b78a-e9234dbc193c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfntilhnhi2v", "content": "", "creation_timestamp": "2026-02-25T04:23:20.512594Z"}, {"uuid": "de29da11-59a6-438f-bcda-c84b96043666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27639", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnwtp4pcf2x", "content": "", "creation_timestamp": "2026-02-25T05:23:13.991554Z"}, {"uuid": "8f10fbf7-6892-4481-aab0-7baee81b852b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfny6rwzef2x", "content": "", "creation_timestamp": "2026-02-25T05:47:19.798776Z"}, {"uuid": "8786c3d8-be7b-40c5-ba25-c2e08e0a14a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27637", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnzljzhyx27", "content": "", "creation_timestamp": "2026-02-25T06:12:21.516944Z"}, {"uuid": "338ad42e-a873-479c-b002-6e2f578d349c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27633", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfpziyfnk42o", "content": "", "creation_timestamp": "2026-02-26T01:16:15.508919Z"}, {"uuid": "6ce026c1-58f6-4a53-a487-d20f78806e51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2763", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mfxi64wf2c2x", "content": "", "creation_timestamp": "2026-03-01T00:27:17.142988Z"}, {"uuid": "08e79b76-2f2d-4e7b-96d0-9185c8fa8997", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27637", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116130449342302707", "content": "", "creation_timestamp": "2026-02-25T09:00:31.020335Z"}, {"uuid": "31591a39-d473-42fa-b21f-6ef101c75038", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27630", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfq25dwtkr27", "content": "", "creation_timestamp": "2026-02-26T01:27:38.495086Z"}, {"uuid": "fafc9340-a281-46f5-ad0d-a1e47495db62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27637", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfocybjggj2h", "content": "", "creation_timestamp": "2026-02-25T09:00:33.068948Z"}, {"uuid": "5786fe35-6254-4c7f-996c-dc0e476a1cc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfrqieggte2m", "content": "", "creation_timestamp": "2026-02-26T17:40:10.167131Z"}, {"uuid": "4ee2eca5-2d7c-4be3-8fab-8801f7a30f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2763", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mfv4ybtzip2c", "content": "", "creation_timestamp": "2026-02-28T02:01:49.179452Z"}, {"uuid": "0953e875-7026-4a50-afe4-5f90c71d73ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27635", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfvftg5w6b2h", "content": "", "creation_timestamp": "2026-02-28T04:40:09.354338Z"}, {"uuid": "a73776f8-6671-4510-97ac-c079bd6be91a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgdbjh473q2m", "content": "", "creation_timestamp": "2026-03-05T17:00:15.975264Z"}, {"uuid": "e8169686-856a-4402-8da6-a40b52abe538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3mg6y4akg2p2d", "content": "", "creation_timestamp": "2026-03-04T00:01:09.849009Z"}, {"uuid": "1fba224d-68c3-4dc1-a35a-953dd4fa970e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27635", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqmo6hs4r2x", "content": "", "creation_timestamp": "2026-02-26T06:59:11.459738Z"}, {"uuid": "31f03b07-b378-4c42-9167-8df966f463e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27635", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqmp5efp22s", "content": "", "creation_timestamp": "2026-02-26T06:59:43.394790Z"}, {"uuid": "67b703e3-39df-49fa-9243-966662295487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2763", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mfnevnkbfq2y", "content": "", "creation_timestamp": "2026-02-25T00:02:12.543490Z"}, {"uuid": "5a811062-7008-4221-8701-fe3b239667fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/freescout_htaccess_rce.rb", "content": "", "creation_timestamp": "2026-03-31T16:18:43.000000Z"}, {"uuid": "36035e96-4441-4429-b091-a3f191ca4cb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mihlnmsdmk2g", "content": "", "creation_timestamp": "2026-04-01T21:02:38.808566Z"}, {"uuid": "e95fafc6-97e9-4424-a8a4-9a2f098fb3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27634", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mimsrx2lih27", "content": "", "creation_timestamp": "2026-04-03T22:53:35.524378Z"}, {"uuid": "e3d70a74-a647-41ed-b6d4-80656432fbe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27634", "type": "published-proof-of-concept", "source": "Telegram/6UgEKYpuzuWLxLktBSFu6z7cSh4q5naaHoBaDBfOi0oKaqw", "content": "", "creation_timestamp": "2026-04-03T23:21:15.000000Z"}, {"uuid": "b6db0fd5-fbb9-4f89-8b52-07020d91f863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://t.me/true_secator/7962", "content": "Ox Security \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 FreeScout, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0441\u043b\u0443\u0436\u0431 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0438 \u043e\u0431\u0449\u0438\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u044f\u0449\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043a\u043b\u0438\u043a\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-28289 (CVSS 10/10) \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0439 \u043f\u0443\u0442\u044c \u0434\u043b\u044f CVE-2026-27636, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043a \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0444\u0430\u0439\u043b\u0430 .htaccess \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0444\u0430\u0439\u043b .htaccess, \u0432\u043c\u0435\u0448\u0430\u0442\u044c\u0441\u044f \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c RCE.\n\n\u041f\u0430\u0442\u0447 \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE,\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 Ox Security, \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0438\u043c\u0432\u043e\u043b \u043f\u0440\u043e\u0431\u0435\u043b\u0430 \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u0448\u0438\u0440\u0438\u043d\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u0432\u0438\u0434\u0438\u043c \u0438 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043d\u0430 \u0442\u043e\u0447\u043a\u0443, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u043d\u0430 \u0434\u0438\u0441\u043a \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0435 \u0438\u043c\u044f \u0444\u0430\u0439\u043b\u0430 .htaccess.\n\n\u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 FreeScout, CVE-2026-28289 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f (TOCTOU) \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0438\u043c\u0435\u043d \u0444\u0430\u0439\u043b\u043e\u0432, \u00ab\u0433\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u0430 \u0442\u043e\u0447\u043a\u0438 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b\u00bb.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 CVE-2026-27636 \u0431\u044b\u043b\u043e \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0438\u043c\u0435\u043d \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u043b\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u0441 \u0442\u043e\u0447\u043a\u0438 (\u00ab.\u00bb) \u043f\u0443\u0442\u0435\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f \u043a \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044e \u0444\u0430\u0439\u043b\u0430.\n\n\u0414\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u0448\u0438\u0440\u0438\u043d\u044b (Unicode U+200B). \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u043e\u0442 \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0432\u0438\u0434\u0438\u043c\u043e\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435, \u043e\u043d\u043e \u043e\u0431\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443, \u0441\u0438\u043c\u0432\u043e\u043b U+200B \u0443\u0434\u0430\u043b\u044f\u0435\u0442\u0441\u044f, \u0438 \u0444\u0430\u0439\u043b \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0410\u0442\u0430\u043a\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430 \u043d\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u044f\u0449\u0438\u043a, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0432 FreeScout.\n\n\u0412\u0430\u0436\u043d\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0434\u0438\u0441\u043a \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 FreeScout, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 Ox Security, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u0433\u0434\u0435 \u0444\u0430\u0439\u043b \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d \u043d\u0430 \u0434\u0438\u0441\u043a\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0435\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u043a\u043e\u0434\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0438 \u0432 \u0441\u0430\u043f\u043e\u0440\u0442, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u044f\u0449\u0438\u043a\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 FreeScout, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u0441\u0435\u0442\u0438.\n\n\u0412\u0441\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 FreeScout 1.8.206 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u043d\u0430 Apache \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u043e\u043f\u0446\u0438\u0435\u0439 AllowOverride All (\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f). CVE-2026-28289 \u0431\u044b\u043b\u0430\u00a0\u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 FreeScout 1.8.207.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f.", "creation_timestamp": "2026-03-04T13:42:17.000000Z"}, {"uuid": "35d31492-d4da-40ce-bb06-1b595e37d7f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-29T20:00:18.986413Z"}, {"uuid": "c15aed6e-0540-4c74-946d-e761f50cdfeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-27638", "type": "published-proof-of-concept", "source": "https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv", "content": "", "creation_timestamp": "2026-02-26T22:04:01.000000Z"}, {"uuid": "dd98ef1b-13c2-43a6-90ca-b54fbf411463", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-30T00:00:44.662852Z"}, {"uuid": "3b645d20-ddc4-44c0-9609-8c3856760430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-31T00:00:25.432033Z"}, {"uuid": "79ce37fa-9370-4a3f-ac6a-345c66d8da20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2763", "type": "seen", "source": "https://gist.github.com/alon710/3acd0d8a46cc6e62f0e5fb066cee0b00", "content": "# CVE-2026-2763: CVE-2026-2763: Use-After-Free in SpiderMonkey Generator for-in Loops\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-02-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-2763\n\n## Summary\nA critical use-after-free vulnerability exists in the SpiderMonkey JavaScript engine of Mozilla Firefox and Thunderbird. The flaw occurs when a generator object containing an active for-in loop is garbage-collected before the loop's iterator scope is finalized. This leaves a dangling pointer in the compartment's active enumerators list, allowing attackers to corrupt memory and execute arbitrary code.\n\n## TL;DR\nA use-after-free in Mozilla's SpiderMonkey engine allows unauthenticated attackers to perform a 1-bit memory corruption, altering bytecode to achieve an out-of-bounds read/write primitive.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 9.8\n- **EPSS Score**: 0.00469\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mozilla Firefox\n- Mozilla Firefox ESR\n- Mozilla Thunderbird\n- Mozilla Thunderbird ESR\n- **Firefox**: < 148 (Fixed in: `148`)\n- **Firefox ESR**: < 115.33 (Fixed in: `115.33`)\n- **Firefox ESR**: < 140.8 (Fixed in: `140.8`)\n- **Thunderbird**: < 148 (Fixed in: `148`)\n- **Thunderbird ESR**: < 140.8 (Fixed in: `140.8`)\n\n## Mitigation\n\n- Upgrade to Firefox 148, ESR 115.33, ESR 140.8, or Thunderbird equivalents.\n- Apply sandboxing to isolate browser processes.\n- Disable or restrict JIT optimization in high-risk environments.\n\n**Remediation Steps:**\n1. Identify all systems running vulnerable Firefox or Thunderbird versions.\n2. Deploy the latest vendor patches (v148 or respective ESR updates).\n3. Verify that the installed application binaries match the patched versions.\n\n## References\n\n- [Mozilla Foundation Security Advisory (Firefox ESR 115.33)](https://www.mozilla.org/security/advisories/mfsa2026-13/)\n- [Mozilla Foundation Security Advisory (Firefox 148)](https://www.mozilla.org/security/advisories/mfsa2026-15/)\n- [Mozilla Bugzilla Bug 2012018](https://bugzilla.mozilla.org/show_bug.cgi?id=2012018)\n- [Public Proof of Concept Repository](https://github.com/ppwwiinn/CVE-2026-2763-POC)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-2763) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T10:32:33.757477Z"}, {"uuid": "524a0147-f9e8-4d76-9132-4b21177e509c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/freescout_htaccess_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd, x86, x64\", \"author\": [\"offensiveee\", \"Nir Zadok (nirzadokox) \", \"Moses Bhardwaj (MosesOX) \", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443, 25, 465, 587, 2525, 25025, 25000], \"autofilter_services\": [\"http\", \"https\", \"smtp\", \"smtps\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution vulnerability\\n          in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName()\\n          function checks for dot-prefixed filenames before stripping Unicode format\\n          characters (ZWSP U+200B), allowing .htaccess upload via email attachment.\\n\\n          A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by\\n          the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the\\n          attachment is stored as .htaccess. The file uses SetHandler to make itself\\n          executable as PHP, achieving code execution when requested via HTTP.\\n\\n          Requires a valid mailbox email address and web-accessible attachment\\n          storage (storage:link pointing to storage/app/).\", \"disclosure_date\": \"2026-03-01\", \"fullname\": \"exploit/multi/http/freescout_htaccess_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Mail2Shell\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/freescout_htaccess_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/freescout_htaccess_rce\", \"references\": [\"CVE-2026-28289\", \"CVE-2026-27636\", \"GHSA-5gpc-65p8-ffwp\", \"GHSA-mw88-x7j3-74vc\", \"URL-https://www.ox.security/blog/freescout-rce-cve-2026-28289/\", \"URL-https://www.ox.security/blog/freescout-rce-cve-2026-27636/\"], \"rport\": 25, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Linux Dropper\", \"Windows Command Shell\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:47.308968Z"}]}