{"vulnerability": "cve-2026-7616", "sightings": [{"uuid": "4cb0352e-d091-41ef-bbfb-59b824829100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7616", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mlnvnmaz2s2s", "content": "CVE-2026-7616 zawgyi-embed (CVSS Score 4.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-12T13:33:05.631513Z"}, {"uuid": "f0755c16-77ad-4e62-a96e-cf65e06c8d7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76164", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ezfgh7wvf5bun", "content": "CVE-2026-76164 - Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources\nCVE ID : CVE-2026-76164\n \n Published : Aug. 19, 2026, 9:17 a.m. | 14\u00a0minutes ago\n \n Description : AIL Framework contains a server-side request forger...", "creation_timestamp": "2026-08-19T10:00:32.007305Z"}, {"uuid": "f050adfd-51cb-40f0-902e-bd275534086d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76169", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3muop2ikyjc25", "content": "\ud83d\udea8 High-severity security fix in fastify@5.12.2 just released!\n\nPatches CVE-2026-76169: authentication bypass via malformed URLs reaching encapsulated not-found handlers.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-09-04T09:54:28.433819Z"}, {"uuid": "55e071d7-ef3d-4eea-b33e-de186d247647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76163", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22", "content": "BIND 9\u306e\u8106\u5f31\u6027(High: CVE-2026-19666, CVE-2026-19667, CVE-2026-76163, CVE-2026-77692, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736, Medium: CVE-2026-19033, \u305d\u306e\u4ed6)\u3068\u4fee\u6b63\u30d0\u30fc\u30b8\u30e7\u30f3(9.20.29, 9.21.26)\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #dns #bind\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-09-16T23:04:36.562826Z"}, {"uuid": "d72361ef-95d6-4ee9-9e1b-6118b9cc37df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76163", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvpprlqyto23", "content": "\ud83d\udd17 CVE : CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736", "creation_timestamp": "2026-09-17T13:05:12.548717Z"}, {"uuid": "fb72526f-551a-4063-bf34-2214c4181135", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-76163", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/isc-bind-multiple-vulnerabilities_20260918", "content": "", "creation_timestamp": "2026-09-18T04:45:42.380349Z"}, {"uuid": "6d3cdd3f-f669-4bb8-b62a-d381c2ecaa12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76169", "type": "seen", "source": "https://gist.github.com/alon710/a1265d04bb89bd5ad393ac2683538928", "content": "# CVE-2026-76169: CVE-2026-76169: Authentication Bypass and Encapsulation Violation via Malformed URL Routing Fallback in Fastify\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76169\n\n## Summary\nAn authentication bypass vulnerability in the Fastify web framework allows remote attackers to access private custom not-found handlers by submitting requests with malformed URLs. This bypasses the typical request lifecycle and its associated authorization hooks.\n\n## TL;DR\nUnauthenticated remote attackers can bypass route-level security hooks and access protected not-found handlers in sibling plugins by crafting malformed HTTP requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- Fastify applications utilizing prefix-encapsulated custom not-found handlers\n- **fastify**: >= 4.0.0, < 5.12.2 (Fixed in: `5.12.2`)\n\n## Mitigation\n\n- Upgrade Fastify package to version 5.12.2 or higher\n- Configure front-end reverse proxies or WAFs to strictly validate URI structures and drop malformed percent-encoded sequences\n- Avoid embedding sensitive information or logic inside custom not-found handlers\n\n**Remediation Steps:**\n1. Run 'npm install fastify@latest' or the equivalent for your package manager\n2. Deploy and verify the updated dependencies in your testing and staging environments\n3. Confirm that requests containing invalid percent encoding return 400 Bad Request with FST_ERR_BAD_URL\n\n## References\n\n- [Fastify Security Advisory GHSA-p68q-wchp-6fh7](https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7)\n- [Fix Commit in Fastify Repository](https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc)\n- [Fastify Release v5.12.2](https://github.com/fastify/fastify/releases/tag/v5.12.2)\n- [NVD CVE-2026-76169 Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-76169)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76169) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T10:30:31.000000Z"}]}