{"vulnerability": "cve-2026-5998", "sightings": [{"uuid": "2aefb707-5e77-448b-8584-3e1a044587ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5998", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj4bayjzu52j", "content": "", "creation_timestamp": "2026-04-10T02:22:28.702478Z"}, {"uuid": "1413888a-7de3-4af1-97eb-51515bbc040f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59989", "type": "seen", "source": "https://gist.github.com/alon710/6c6dab5e1a3a671fb5c0adb7c14c9092", "content": "# CVE-2026-59989: CVE-2026-59989: Remote Code Execution via Server-Side Template Injection in Phalcon Volt Engine\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59989\n\n## Summary\nA critical server-side template injection (SSTI) vulnerability exists in the Volt template engine of the Phalcon PHP framework. In versions 5.15.0 and earlier, raw AST token values for filter arguments in the 'join' filter are directly spliced into the generated PHP template code. This allows an attacker who can influence Volt templates to execute arbitrary PHP code during template rendering.\n\n## TL;DR\nPhalcon Volt template engine directly concatenates raw AST tokens in the 'join' filter, allowing remote code execution if template contents are user-controlled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-1336\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **Exploit Status**: PoC (Proof of Concept)\n- **KEV Status**: Not Listed\n- **Affected Component**: Volt Template Compiler (join filter)\n\n## Affected Systems\n\n- Phalcon Framework (phalcon/cphalcon)\n- **cphalcon**: <= 5.15.0 (Fixed in: `5.16.0`)\n\n## Mitigation\n\n- Upgrade Phalcon framework to version 5.16.0 or later.\n- Perform code audits to eliminate dynamic Volt template generation patterns from untrusted variables.\n- Implement restrictive input validation to sanitize characters like single quotes in dynamic configurations.\n\n**Remediation Steps:**\n1. Verify the installed Phalcon version using 'php --ri phalcon' or composer.lock.\n2. Update Phalcon via composer using 'composer update phalcon/cphalcon'.\n3. Clear existing Volt template caches to force recompilation of all templates using the updated secure compiler.\n\n## References\n\n- [GitHub Security Advisory GHSA-hrwp-4hh9-c8r8](https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8)\n- [GitHub Pull Request 17217](https://github.com/phalcon/cphalcon/pull/17217)\n- [Fix Commit e434061be3b7161930476c1368c868badc71e1bd](https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd)\n- [Phalcon Release Tag 5.16.0](https://github.com/phalcon/cphalcon/releases/tag/v5.16.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59989) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T04:31:35.532584Z"}, {"uuid": "26a33868-ca89-4b90-9078-c6e2ee8fcc78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59989", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtmriifpph2p", "content": "\ud83d\udea8 CVE-2026-59989 \u2014 CVSS 9.2 CRITICAL\n\nPhalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mv...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-59989\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-21T22:07:31.855733Z"}, {"uuid": "68dd0bd1-092c-4b98-9685-a14e8921f52f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59989", "type": "published-proof-of-concept", "source": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8", "content": "", "creation_timestamp": "2026-08-21T22:35:15.145179Z"}, {"uuid": "c35f3d44-b2f3-4132-b0cf-99e3647cbc08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59989", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmvka7mu62y", "content": "CVE-2026-59989 - cphalcon\nIf a website uses Phalcon's Volt template engine and allows users to influence the text passed to the\u202fjoin\u202ffilter, the engine can insert that text directly into generated\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cphalcon #phalcon #composer #CVE #infosec", "creation_timestamp": "2026-08-21T23:20:05.582148Z"}, {"uuid": "2344b7e3-7883-4e10-b0dc-177b45329881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59981", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/423m46wxqajap", "content": "CVE-2026-59981 - OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow\nCVE ID : CVE-2026-59981\n \n Published : Aug. 25, 2026, 7:58 p.m. | 7\u00a0minutes ago\n \n Description : OpenEXR is the reference implementation and specification for the EXR image file for...", "creation_timestamp": "2026-08-25T20:37:49.869037Z"}, {"uuid": "dab04059-61e1-4c3b-b693-1b833334871a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59980", "type": "seen", "source": "https://gist.github.com/alon710/256195b8da831d2851e64a796d5d077f", "content": "# CVE-2026-59980: CVE-2026-59980: Uncontrolled Resource Consumption in python-hyper/hpack\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59980\n\n## Summary\nCVE-2026-59980 is a CPU exhaustion vulnerability in python-hyper/hpack, where an unauthenticated remote attacker can trigger an infinite loop or high computational complexity overhead by sending a crafted HTTP/2 stream containing excessive variable-length integer continuation octets.\n\n## TL;DR\nUnbounded variable-length integer decoding in the python-hyper/hpack library enables unauthenticated remote attackers to trigger 100% CPU exhaustion and Denial of Service via malformed HTTP/2 frame headers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.3\n- **EPSS Score**: 0.00301 (20.30% percentile)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-hyper/hpack\n- **hpack**: >= 1.0.0, < 4.2.0 (Fixed in: `4.2.0`)\n\n## Mitigation\n\n- Upgrade python-hyper/hpack to version 4.2.0 or higher.\n- Deploy Nginx, HAProxy, or Cloudflare as a reverse proxy/WAF to terminate and validate HTTP/2 frames.\n- Implement network-level rate limits on HTTP/2 stream headers.\n\n**Remediation Steps:**\n1. Identify the environment dependency of python-hyper/hpack by running 'pip show hpack'.\n2. Update the dependency using 'pip install --upgrade hpack' or specifying 'hpack>=4.2.0' in the requirements file.\n3. Restart the application server (e.g., Gunicorn, Uvicorn, Hypercorn) to apply the updated library.\n4. Conduct functional tests of HTTP/2 headers to ensure compatibility.\n\n## References\n\n- [GitHub Security Advisory GHSA-8v8h-hg4w-mvq2](https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2)\n- [Official Patch Commit](https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c)\n- [hpack v4.2.0 Release Notes](https://github.com/python-hyper/hpack/releases/tag/v4.2.0)\n- [CVE-2026-59980 Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-59980)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59980) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T08:30:31.000000Z"}]}