{"vulnerability": "cve-2026-8647", "sightings": [{"uuid": "256e17f2-d948-4fc7-a89e-0bd7f6fd1974", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8647", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mmsazkwpzd2s", "content": "CVE-2026-8647: Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available", "creation_timestamp": "2026-05-27T00:32:28.584827Z"}, {"uuid": "a23863d8-9199-4b62-888b-e672b08f3195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8647", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmscr5cl2r2v", "content": "CVE-2026-8647 - Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available\nCVE ID : CVE-2026-8647\n \n Published : May 26, 2026, 11:16 p.m. | 1\u00a0hour, 15\u00a0minutes ago\n \n Description : Crypt::ScryptKDF versions through 0.0...", "creation_timestamp": "2026-05-27T01:03:33.172694Z"}, {"uuid": "050d934c-4b6d-43ec-ba2e-442c924556f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86479", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mux3oi6n4n2m", "content": "\ud83d\udfe0 CVE-2026-86479 - High (8.1)\n\nIn JetBrains YouTrack before 2026.2.18788, \n2026.1.14055, \n2025.3.161254 missing authorisation al...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86479/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-07T18:01:41.055379Z"}, {"uuid": "20a5147f-74a0-4b48-8f44-546ee8440680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86478", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mux3z4eb5a25", "content": "\ud83d\udea8 CVE-2026-86478 \u2014 CVSS 9.8 CRITICAL\n\nIn JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allow...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86478\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-07T18:07:36.418969Z"}, {"uuid": "53f91a07-7fba-47e3-b3d7-22b2f5e4b1fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86478", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117231296587754066", "content": "JetBrains YouTrack CRITICAL vulnerability (CVE-2026-86478, CVSS 9.8) in versions <2025.3.161254, <2026.1.14042: improper authentication enables unauthenticated account takeover. Patch status pending \u2014 check vendor advisory. https://radar.offseq.com/threat/cve-2026-86478-cwe-290-in-jetbrains-youtrack-04f74ce17c2670a8 #OffSeq #Infosec #CVE202686478", "creation_timestamp": "2026-09-07T19:00:26.879284Z"}, {"uuid": "29e04c6e-09f1-427e-9a0d-0adb3c83f2b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86478", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mux6xnigg52z", "content": "CRITICAL CVE-2026-86478 in JetBrains YouTrack (<2025.3.161254, <2026.1.14042): improper authentication lets attackers take over accounts. Check the vendor advisory for patch info. https://radar.offseq.com/threat/cve-2026-86478-cwe-290-in-jetbrains-youtrack-04f74ce17c2670a8 #OffSeq #YouTrack #CVE2...", "creation_timestamp": "2026-09-07T19:00:28.946837Z"}, {"uuid": "e84a13a6-7e67-4eab-a845-44201f967f90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86478", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muyrabjc2w2b", "content": "CVE-2026-86478 - youtrack\nThe YouTrack helpdesk feature in older versions can be tricked into accepting a forged email address, letting an attacker take over a user\u2019s account without logging in. This puts\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#youtrack #jetbrains #CVE #infosec", "creation_timestamp": "2026-09-08T10:00:05.215146Z"}, {"uuid": "3dcb7520-fc66-48d2-b9b4-a7a8c812103d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86472", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mvkgflt3wc25", "content": "\ud83d\udea8 Medium-severity security fix in fast-uri 4.1.5, 3.1.8, and 2.4.7 just released!\n\nPatches CVE-2026-86472: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-09-15T10:34:09.943347Z"}, {"uuid": "67ff1f90-5455-4af9-8853-fb73de8a7461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86473", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw2glmqmmz2g", "content": "CVE-2026-86473 - apache airflow\nWhen users sign out of Apache Airflow using a bearer token in the Authorization header, the system only clears the browser cookie and leaves the token active\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheairflow #apachefoundation #CVE #infosec", "creation_timestamp": "2026-09-21T19:20:05.701711Z"}, {"uuid": "e9308016-dab5-4e10-b510-afef1aa27726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86473", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw2j7obtdm25", "content": "\ud83d\udea8 CVE-2026-86473 \u2014 CVSS 9.1 CRITICAL\n\nApache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. W...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86473\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-21T20:07:05.989695Z"}, {"uuid": "2795e5dd-f156-4cbd-9bed-b0cbec3b1225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86473", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwfrn7e6zu2i", "content": "\ud83d\udccc CVE-2026-86473 - Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its creden... https://www.cyberhub.blog/cves/CVE-2026-86473", "creation_timestamp": "2026-09-26T07:37:07.922923Z"}, {"uuid": "370492a4-733d-4881-9837-251a006095bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86472", "type": "seen", "source": "https://gist.github.com/alon710/88f917dec8f03c60e71606b2529f278c", "content": "# CVE-2026-86472: CVE-2026-86472: Hostname Canonicalization Bypass in fast-uri via Scheme-Relative URLs\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86472\n\n## Summary\nCVE-2026-86472 is a validation bypass vulnerability in fast-uri (a high-performance RFC 3986 URI toolbox heavily used by popular Node.js frameworks like Fastify and validation libraries like AJV). The vulnerability stems from improper handling of case sensitivity (CWE-178) due to an incorrect order of operations during hostname canonicalization in scheme-relative URLs. An attacker can leverage percent-encoded uppercase characters within scheme-relative URLs to bypass domain blocklists/allowlists in downstream applications. Because hostname resolution in DNS and HTTP is case-insensitive, the bypassed host representation still routes to the target destination, resulting in potential Server-Side Request Forgery (SSRF) or security control bypasses.\n\n## TL;DR\nAn incorrect sequence of case folding and percent-decoding in fast-uri allows attackers to bypass case-sensitive domain filters using percent-encoded uppercase hostnames in scheme-relative URLs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.00253\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri < 2.4.7\n- fast-uri 3.x < 3.1.8\n- fast-uri 4.x < 4.1.5\n- **fast-uri**: < 2.4.7 (Fixed in: `2.4.7`)\n- **fast-uri**: 3.0.0 - 3.1.7 (Fixed in: `3.1.8`)\n- **fast-uri**: 4.0.0 - 4.1.4 (Fixed in: `4.1.5`)\n\n## Mitigation\n\n- Upgrade fast-uri dependency to patched versions.\n- Enforce manual lowercasing on all parsed hostname outputs before comparison.\n- Deploy Web Application Firewall rules to detect and drop scheme-relative URLs with percent-encoded characters.\n\n**Remediation Steps:**\n1. Check project dependency tree for fast-uri versions using `npm ls fast-uri`.\n2. Apply package overrides or resolutions in package.json to force safe versions.\n3. Run `npm install` or `yarn install` to update lockfiles with patched versions (2.4.7, 3.1.8, or 4.1.5).\n4. Verify parsed output normalization by adding test cases for '//%41.com' in the integration suite.\n\n## References\n\n- [GitHub Security Advisory GHSA-hrr3-gc8f-f4qj](https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Entry CVE-2026-86472](https://nvd.nist.gov/vuln/detail/CVE-2026-86472)\n- [CVE Record CVE-2026-86472](https://www.cve.org/CVERecord?id=CVE-2026-86472)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86472) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T01:30:28.000000Z"}]}