{"vulnerability": "cve-2026-5463", "sightings": [{"uuid": "3358a57b-d558-441b-9304-9a4e2723f917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mil25ysway2p", "content": "", "creation_timestamp": "2026-04-03T06:00:16.936353Z"}, {"uuid": "cee25236-6210-4ad9-b561-b7a51e66f480", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mil26a6y7b27", "content": "", "creation_timestamp": "2026-04-03T06:00:26.426708Z"}, {"uuid": "4b3516f4-825f-486d-a1e5-b701ec8cfabf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5463", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116339246858412689", "content": "", "creation_timestamp": "2026-04-03T06:00:28.194173Z"}, {"uuid": "19d95a71-9f0c-4b4f-9238-14282a8a4b0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5463", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mil26fhffy2f", "content": "", "creation_timestamp": "2026-04-03T06:00:30.546779Z"}, {"uuid": "a09cd9aa-a783-429b-9c5a-9c7fbc656ac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mil2a4asyi2p", "content": "", "creation_timestamp": "2026-04-03T06:01:27.442179Z"}, {"uuid": "ddebda3d-b02d-4f6c-8808-88255ec39636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mil6fykjzs27", "content": "", "creation_timestamp": "2026-04-03T07:16:19.837964Z"}, {"uuid": "042de15d-bd1b-4897-bf47-ce250d9b8d41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "https://bsky.app/profile/cyber-news-fi.bsky.social/post/3min7vlzkc322", "content": "", "creation_timestamp": "2026-04-04T02:48:16.562199Z"}, {"uuid": "ffdff2f7-e8a3-456f-b8b2-020f5643644f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "Telegram/A5UZ2oyBVNNJX5Wa4LER5v-0-0dFFVXEqLDkZYQ_ngP9k5Q", "content": "", "creation_timestamp": "2026-04-03T07:15:40.000000Z"}, {"uuid": "cd03e710-8b3a-4228-b2f1-742568066396", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5463", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mndist3yut24", "content": "\ud83d\udccc CVE-2026-5463 - Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characte... https://www.cyberhub.blog/cves/CVE-2026-5463", "creation_timestamp": "2026-06-02T21:07:08.029716Z"}, {"uuid": "c39a3ee3-98e4-49b8-a6f1-09e5daa87583", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54636", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7khj3szc2p", "content": "CVE-2026-54636 - Dokku: OS Command Injection via app.json managed Cron\nCVE ID : CVE-2026-54636\n \n Published : June 26, 2026, 4:23 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json f...", "creation_timestamp": "2026-06-26T18:16:20.003934Z"}, {"uuid": "abb6e671-910b-4c49-a28d-b7fc1c225d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54636", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpe55gm63o2y", "content": "CVE-2026-54636 - Critical OS Command Injection in Dokku. App.json cron commands with shell chars can break container isolation. CVSS 9.0. Update to 0.38.7 immediately. #CVE #Dokku #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-54636/", "creation_timestamp": "2026-06-28T14:01:21.957171Z"}, {"uuid": "08f538a7-f90b-4737-a9f8-1bc0bf1de855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54636", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mphnruqvj324", "content": "\ud83d\udccc CVE-2026-54636 - Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku use... https://www.cyberhub.blog/cves/CVE-2026-54636", "creation_timestamp": "2026-06-29T23:37:06.852347Z"}, {"uuid": "a06530ad-2f55-4b2c-969d-0fb7365b5225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54636", "type": "seen", "source": "https://bsky.app/profile/smit-artem.bsky.social/post/3mpyp46ghoh2j", "content": "Heads up: an important security fix just landed for Dokku. Open its settings and let it update. A couple of taps now keeps your data safer. CVE-2026-54636", "creation_timestamp": "2026-07-06T18:16:01.777376Z"}, {"uuid": "73fd2011-1a8b-4b71-8939-84379e3cfaba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54637", "type": "published-proof-of-concept", "source": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-chwm-m7g7-685g", "content": "", "creation_timestamp": "2026-07-06T22:35:14.091119Z"}, {"uuid": "57edde7f-9930-4718-b145-021fe9e54574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54632", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mrpve7kkpq24", "content": "SIPSorcery has a high-severity DoS (CVE-2026-54632): one malformed UDP packet on the RTP/ICE socket ends a media session. The receive loop turned a parse exception into a channel close, and it is reachable during ICE checks \u2014 before DTLS, so no auth needed. #dev", "creation_timestamp": "2026-07-28T17:04:21.767997Z"}, {"uuid": "377887fe-9ecf-4073-840a-e1624e732fd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54635", "type": "seen", "source": "https://gist.github.com/alon710/49b30b9938ae88ab2f795a5eb6f5b0cc", "content": "# CVE-2026-54635: CVE-2026-54635: Authentication Bypass via Custom Webhook Paths in pytonapi\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54635\n\n## Summary\nAn authentication bypass vulnerability exists in the pytonapi library when custom paths are registered in the TonapiWebhookDispatcher. The application fails to retrieve or store secure tokens for custom paths, leading to a fail-open authorization check that allows unauthenticated remote attackers to send spoofed webhook events directly to internal handlers.\n\n## TL;DR\nUnauthenticated remote attackers can bypass webhook authorization and spoof transaction events by exploiting a fail-open design when custom registration paths are configured in the pytonapi dispatcher.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 (Improper Authentication)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Impact**: High Integrity Compromise\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- pytonapi Webhook Dispatcher Component\n- **pytonapi**: >= 2.0.0, < 2.2.1 (Fixed in: `2.2.1`)\n\n## Mitigation\n\n- Upgrade pytonapi dependency to version 2.2.1 or newer.\n- Remove the custom 'path' argument in handler registrations to fall back to safe default suffixes.\n- Implement source IP restriction at the firewall or reverse proxy level to only allow legitimate TONAPI servers.\n\n**Remediation Steps:**\n1. Execute 'pip install --upgrade pytonapi>=2.2.1' in the target environment.\n2. Inspect source code for occurrences of @dispatcher.account_tx with a custom path argument.\n3. Deploy the updated application and monitor log endpoints for unauthorized access attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-3fcr-jvgp-7f58](https://github.com/nessshon/tonapi/security/advisories/GHSA-3fcr-jvgp-7f58)\n- [GitHub Patch Commit](https://github.com/nessshon/tonapi/commit/854222b7ee68d3fb7b4d6d899d200f388483bd86)\n- [pytonapi v2.2.1 Release Details](https://github.com/nessshon/tonapi/releases/tag/v2.2.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54635) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T18:31:38.114347Z"}, {"uuid": "0e4f8c42-5d92-47d8-b5b9-a134ad508fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54635", "type": "published-proof-of-concept", "source": "https://github.com/nessshon/tonapi/security/advisories/GHSA-3fcr-jvgp-7f58", "content": "", "creation_timestamp": "2026-07-28T18:35:03.702723Z"}, {"uuid": "302c4d63-a3a9-4402-b780-20e613cbe955", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54635", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq3u4srea2l", "content": "\ud83d\udfe0 CVE-2026-54635 - High (7.5)\n\npytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54635/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T19:00:36.385763Z"}, {"uuid": "2f0b0805-7265-4f11-b1dd-f0c1f0cc1af2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54635", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrq5nfgcky2o", "content": "CVE-2026-54635 - pytonapi has a Webhook Custom Path Authentication Bypass\nCVE ID : CVE-2026-54635\n \n Published : July 28, 2026, 6:17 p.m. | 23\u00a0minutes ago\n \n Description : pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON bloc...", "creation_timestamp": "2026-07-28T19:32:37.478454Z"}, {"uuid": "d41b18ff-e160-45be-8677-ee298c3a7673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54638", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdflp4f2w", "content": "\ud83d\udfe0 CVE-2026-54638 - High (7.5)\n\ngotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Deco...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54638/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T02:00:45.035880Z"}, {"uuid": "41c2ad9f-0f18-49f8-91e1-5a37382152ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54639", "type": "seen", "source": "https://gist.github.com/alon710/f56e7fea90184a0067b486a540ca3738", "content": "# CVE-2026-54639: CVE-2026-54639: Prototype Pollution and Patch Bypass in style-dictionary\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54639\n\n## Summary\nA critical prototype pollution vulnerability (CVE-2026-54639) exists in style-dictionary versions 4.3.0 through 5.4.3 due to unsafe object traversal in the convertTokenData utility. Although a patch was released in version 5.4.4 targeting '__proto__', a complete bypass is possible using 'constructor.prototype', leading to persistent global prototype pollution and potential remote code execution.\n\n## TL;DR\nstyle-dictionary is vulnerable to prototype pollution via convertTokenData. An incomplete patch in v5.4.4 can be bypassed using constructor.prototype, allowing global runtime pollution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Vulnerability Class**: Prototype Pollution\n- **CVSS v3.1 Score**: 8.8 (High)\n- **Attack Vector**: Local (escalatible to Remote)\n- **EPSS Score**: 0.00132 (3.12 percentile)\n- **Patch Status**: Incomplete (v5.4.4 bypass identified)\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- style-dictionary NPM package\n- **style-dictionary**: >= 4.3.0, <= 5.4.3 (Fixed in: `5.4.4 (Incomplete fix)`)\n\n## Mitigation\n\n- Validate and sanitize all design token input keys before passing to the conversion function.\n- Override convertToTokenObject behavior or use Object.create(null) for dynamic dictionary construction.\n- Upgrade to a secure patched version once a complete remediation block is deployed.\n\n**Remediation Steps:**\n1. Identify applications utilizing style-dictionary's convertTokenData utility dynamically with user-controlled input.\n2. Deploy a custom input sanitizer regex pattern to block keys containing '__proto__', 'constructor', or 'prototype'.\n3. Refactor code to construct design token maps using secure JSON Schema validation.\n\n## References\n\n- [GHSA-vj5c-m527-mpff](https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff)\n- [NVD - CVE-2026-54639](https://nvd.nist.gov/vuln/detail/CVE-2026-54639)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54639) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T02:31:53.724323Z"}, {"uuid": "fba277d0-f9df-457a-8213-9bfdd75bc2de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54638", "type": "seen", "source": "https://gist.github.com/alon710/7cdf75a52c50aebac3f872ab5cf7bfbf", "content": "# CVE-2026-54638: CVE-2026-54638: Pre-Authentication Denial of Service via Unbounded Memory Allocation in gotd/td MTProto Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54638\n\n## Summary\nAn unauthenticated remote Denial of Service (DoS) vulnerability exists in the plaintext message parsing implementation of gotd/td, a Go-based Telegram MTProto client and server library. The security flaw is located within the unencrypted message decoding pipeline, where the parser reads an untrusted length header and immediately performs a heap-based memory allocation without checking if the buffer contains the corresponding bytes. An attacker can exploit this behavior by sending a single crafted 20-byte packet containing an extremely large length value, leading to immediate memory exhaustion and process termination by the operating system Out-Of-Memory (OOM) killer.\n\n## TL;DR\nA critical pre-authentication vulnerability in gotd/td (< 0.145.1) allows a remote attacker to crash the MTProto server or client with a single 20-byte TCP packet. The parser immediately allocates heap memory based on an unverified length header in unencrypted packets, triggering an out-of-memory crash or severe resource exhaustion prior to any validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770, CWE-789\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Maturity**: PoC Available\n- **Impact**: Denial of Service (OOM Crash)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- github.com/gotd/td\n- **github.com/gotd/td**: < 0.145.1 (Fixed in: `0.145.1`)\n\n## Mitigation\n\n- Upgrade gotd/td dependency to version v0.145.1 or later\n- Deploy rate-limiting policies for incoming unauthenticated TCP connections\n- Implement application-level reverse proxies to filter out anomalous handshake packets\n- Enforce memory limits and automated container restart policies in orchestration platforms\n\n**Remediation Steps:**\n1. Identify all microservices and Go binaries utilizing github.com/gotd/td\n2. Update the go.mod file of the affected services to request github.com/gotd/td v0.145.1\n3. Run 'go mod tidy' to update the dependency tree and lockfile\n4. Recompile the binaries using the patched version of the dependency\n5. Redeploy the updated services to production environments\n\n## References\n\n- [Official GitHub Advisory](https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2)\n- [Vulnerability Disclosure Issue](https://github.com/gotd/td/issues/1711)\n- [Fix Commit Link](https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa)\n- [Official v0.145.1 Release Details](https://github.com/gotd/td/releases/tag/v0.145.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54638) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T05:32:48.014593Z"}]}