{"metadata": {"vulnerability": "cve-2025-27591", "count": 68, "kinds": {"milestone": 6, "sighting": 44, "kev": 0, "other": 18}}, "data": [{"timestamp": "2025-03-03T00:00:00Z", "date_only": false, "value": "2025-03-03T00:00:00.000Z", "kind": "other", "label": "Date Assigned", "source": "cvelistv5 / facebook", "record": "cve-2025-27591", "field": "containers.cna.dateAssigned"}, {"timestamp": "2025-03-03T11:36:32.537Z", "date_only": false, "value": "2025-03-03T11:36:32.537Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-27591", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-11T18:29:21.569Z", "date_only": false, "value": "2025-03-11T18:29:21.569Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-27591", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-11T18:29:21.569Z", "date_only": false, "value": "2025-03-11T18:29:21.569Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / facebook", "record": "cve-2025-27591", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-11T19:15:43Z", "date_only": false, "value": "2025-03-11T19:15:43Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9MC5-7QHG-FP3W", "record": "GHSA-9MC5-7QHG-FP3W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-03-11T19:15:43.390Z", "date_only": false, "value": "2025-03-11T19:15:43.390", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27591", "record": "FKIE_CVE-2025-27591", "field": "published"}, {"timestamp": "2025-03-11T21:12:54Z", "date_only": false, "value": "2025-03-11T21:12:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9MC5-7QHG-FP3W", "record": "GHSA-9MC5-7QHG-FP3W", "field": "published"}, {"timestamp": "2025-03-11T21:48:55Z", "date_only": false, "value": "2025-03-11T21:48:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/20126", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "abb701d7-e55f-42e6-b01d-832ae5178d32", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27591 - Below Privilege Escalation Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27591 \nPublished : March 11, 2025, 7:15 p.m. | 1\u00a0hour, 11\u00a0minutes ago \nDescription : A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20126"}, {"timestamp": "2025-03-12T12:00:00Z", "date_only": false, "value": "2025-03-12T12:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_rustsec \u00b7 RUSTSEC-2025-0149", "record": "RUSTSEC-2025-0149", "field": "published"}, {"timestamp": "2025-03-12T12:00:41.259Z", "date_only": false, "value": "2025-03-12T12:00:41.259547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3lk6ju6fw642e", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "168556dd-3fec-4aea-a397-d9f090872aa0", "url": "https://bsky.app/profile/buherator.bsky.social/post/3lk6ju6fw642e"}, {"timestamp": "2025-03-12T12:09:31.009Z", "date_only": false, "value": "2025-03-12T12:09:31.009447Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lk6kdxpl5i2b", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "2babc8c4-2b31-456b-9a05-03d9a946452d", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lk6kdxpl5i2b"}, {"timestamp": "2025-03-12T13:08:26.252Z", "date_only": false, "value": "2025-03-12T13:08:26.252Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2025-27591", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-12T13:41:39Z", "date_only": false, "value": "2025-03-12T13:41:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/7296", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "92eaeab5-09e1-451c-8fc5-74302bcc83d5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-27591\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.\n\ud83d\udccf Published: 2025-03-11T18:29:21.569Z\n\ud83d\udccf Modified: 2025-03-12T13:08:26.252Z\n\ud83d\udd17 References:\n1. https://www.facebook.com/security/advisories/cve-2025-27591\n2. https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3", "url": "https://t.me/DarkWebInformer_CVEAlerts/7296"}, {"timestamp": "2025-03-21T20:37:38.689Z", "date_only": false, "value": "2025-03-21T20:37:38.689510Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-27591", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-03-21T20:37:38.689Z", "date_only": false, "value": "2025-03-21T20:37:38.689510Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27591", "record": "FKIE_CVE-2025-27591", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-03-21T20:38:10.292Z", "date_only": false, "value": "2025-03-21T20:38:10.292Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-27591", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-21T20:38:10.292Z", "date_only": false, "value": "2025-03-21T20:38:10.292Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-27591", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-07-12T21:21:10Z", "date_only": false, "value": "2025-07-12T21:21:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/43824", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "446f9389-c451-4ff8-b622-3642e04ce89f", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591\nURL\uff1ahttps://github.com/obamalaolu/CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/43824"}, {"timestamp": "2025-07-12T22:52:20Z", "date_only": false, "value": "2025-07-12T22:52:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/43832", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "5e09feb4-7e73-4eb9-82e6-38ecae6de564", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591\nURL\uff1ahttps://github.com/rvizx/CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/43832"}, {"timestamp": "2025-07-13T03:00:05Z", "date_only": false, "value": "2025-07-13T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qSyM_CObkKGA7Q7HpzeouiC5p1gyRUk9NSeKtBswwYL551E", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "8f75f0d4-7548-466e-9f80-aaa99d4ebb65"}, {"timestamp": "2025-07-13T08:56:45Z", "date_only": false, "value": "2025-07-13T08:56:45.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/43876", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "c146e8d2-e214-4198-aeac-c2a9af964784", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0\nURL\uff1ahttps://github.com/BridgerAlderson/CVE-2025-27591-PoC\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/43876"}, {"timestamp": "2025-07-13T15:00:06Z", "date_only": false, "value": "2025-07-13T15:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/G-kx-DTDWfPOp5cJepg92j2e9E9yyQ0k9SVYaxiupb8kGRk", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "7ad2dc72-6d7f-412a-afef-b5eaf356aac0"}, {"timestamp": "2025-07-15T05:17:07Z", "date_only": false, "value": "2025-07-15T05:17:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/44083", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "88ae60fc-62a0-4a9f-b34e-e8ea0e3e375c", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591\nURL\uff1ahttps://github.com/DarksBlackSk/CVE-2025-27591-Proof-Of-Concept\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/44083"}, {"timestamp": "2025-07-15T06:25:38Z", "date_only": false, "value": "2025-07-15T06:25:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/44088", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "1b7e9c5d-e4d6-4ae6-9e1f-558ac1138e40", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591 is a known privilege escalation vulnerability in the Below service (version < v0.9.0)\nURL\uff1ahttps://github.com/dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/44088"}, {"timestamp": "2025-07-15T09:00:04Z", "date_only": false, "value": "2025-07-15T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/T40TgjeWGWGsXoUl8seqwuPrYGUpdj-sMthNdJApG881fE0", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "4e0ba820-f149-4879-aa9a-cfa0edc542b6"}, {"timestamp": "2025-07-15T13:46:29Z", "date_only": false, "value": "2025-07-15T13:46:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/44128", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "94c5923c-ecdd-449c-93d9-f22e7e8adee3", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591\nURL\uff1ahttps://github.com/sanjay70023/AutoVAPT-AI-Based-Vulnerability-Scanner-Pentest-Tool\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/44128"}, {"timestamp": "2025-07-18T03:31:52Z", "date_only": false, "value": "2025-07-18T03:31:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/44420", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "b91edf8d-362f-43d1-98d0-5355699ceee1", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aA Proof of Concept for CVE-2025-27591, a local privilege escalation in Below \u2264 v0.8.1\nURL\uff1ahttps://github.com/incommatose/CVE-2025-27591-PoC\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/44420"}, {"timestamp": "2025-07-18T09:00:04Z", "date_only": false, "value": "2025-07-18T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Qu1cbmejEeKAGFL3IdDZp2oTdnW34dPtOka-zLQLfx2beHc", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "614f472b-0ada-4650-8f8b-0b6525622989"}, {"timestamp": "2025-07-20T03:00:05Z", "date_only": false, "value": "2025-07-20T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Si59L7B2mOOUAr8_144HFqGZOWLjbuFEGSaFRpGyejiLY0E", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "a0da1f5b-0951-4809-aff8-d5b27d08f9fb"}, {"timestamp": "2025-07-21T19:06:46Z", "date_only": false, "value": "2025-07-21T19:06:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/44872", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "c0f84a37-2b38-434f-9ca8-b98f53ea337d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1a\ud83d\udd25 Local Privilege Escalation Exploit for CVE-2025-27591 | Abuses world-writable log dir in Below to gain root via /etc/passwd injection\nURL\uff1ahttps://github.com/00xCanelo/CVE-2025-27591-PoC\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/44872"}, {"timestamp": "2025-07-31T12:25:27Z", "date_only": false, "value": "2025-07-31T12:25:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/46055", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "fa924cba-8721-44bc-b956-bd1f0c41a8a6", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aa C exploit for CVE-2025-27591, which allow an attacker to escalate privilege to root.\nURL\uff1ahttps://github.com/Cythonic1/CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/46055"}, {"timestamp": "2025-07-31T15:00:06Z", "date_only": false, "value": "2025-07-31T15:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cWtiHx103QDqzsPEFibXmjg0nuYdbQyVZSdVVV_BXQwi1FA", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "2f702160-b26d-42cf-ac8e-336a4afb31d6"}, {"timestamp": "2025-08-12T13:33:28Z", "date_only": false, "value": "2025-08-12T13:33:28.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/02fb130c-7874-4693-9b66-81ed91a2e996", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "1e8d696c-45b9-4068-bfad-4f7218a80f93"}, {"timestamp": "2025-08-16T15:00:08Z", "date_only": false, "value": "2025-08-16T15:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0M5jO4VIK8AI8C1mAkrE9XFqeLJqz32SrznEd5MdyL5tahc", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "fccff728-5f78-4b22-9be8-88aa64e3079c"}, {"timestamp": "2025-08-21T03:19:29Z", "date_only": false, "value": "2025-08-21T03:19:29.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/02fb130c-7874-4693-9b66-81ed91a2e996", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "c40818d2-e2c6-4ed1-93d2-837ad7a3a070"}, {"timestamp": "2025-08-22T12:34:40Z", "date_only": false, "value": "2025-08-22T12:34:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/48659", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "30257e99-714e-4bdd-b212-c5f0d55bf42e", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aPoC exploit for Below privilege escalation (CVE-2025-27591) allowing local root access via symlink manipulation in world-writable log directory.\nURL\uff1ahttps://github.com/Diabl0xE/CVE-2025-27519\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/48659"}, {"timestamp": "2025-09-01T12:25:21Z", "date_only": false, "value": "2025-09-01T12:25:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/49863", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "f45386bf-91ba-4bee-adab-4e9cc57f16ae", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aPoC for CVE-2025-27591 \u2013 Local privilege escalation in the below monitoring tool. By symlinking its log file to /etc/passwd, an attacker can inject a root account and gain full system compromise.\nURL\uff1ahttps://github.com/danil-koltsov/below-log-race-poc\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/49863"}, {"timestamp": "2025-09-01T15:00:07Z", "date_only": false, "value": "2025-09-01T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WmTbZAwJq4oeu1oQbw_9scJeNK9TlkQDYUtF5SwroIlUcq4", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "be5922e3-9ed3-4fd1-8523-7499f898ac3d"}, {"timestamp": "2025-09-03T16:20:53Z", "date_only": false, "value": "2025-09-03T16:20:53.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/50140", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "f0911fec-031c-4348-acd1-1f810261449c", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aLocal Privilege Escalation vai `below` (CVE-2025-27591) - PoC Exploit\nURL\uff1ahttps://github.com/HOEUN-Visai/CVE-2025-27591-below-\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/50140"}, {"timestamp": "2025-09-03T21:00:04Z", "date_only": false, "value": "2025-09-03T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7VaWiDiZCdClD5jKnwGdCFY3BMT4SvcYbJTGW3v_R4In6yE", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "68c28682-497e-4bb7-87b4-532cb1c74122"}, {"timestamp": "2025-10-18T21:27:30Z", "date_only": false, "value": "2025-10-18T21:27:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/56022", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "49791d67-9a82-46ec-b764-8eac28b6dd3e", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-27591\nURL\uff1ahttps://github.com/krn966/CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/56022"}, {"timestamp": "2025-10-19T03:00:05Z", "date_only": false, "value": "2025-10-19T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8nM03Hy1pf_JWfEIa0g2-4Thr39zfhDpEe0Vm6CK6uASuGo", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "68787e54-30af-465e-8d84-dac2eee1ae9e"}, {"timestamp": "2025-11-13T17:48:19Z", "date_only": false, "value": "2025-11-13T17:48:19.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/59600", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "4be309de-1ce5-4160-9010-9e06b9a97170", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aPath traversal tool based on CVE-2025-8088\nURL\uff1ahttps://github.com/0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/59600"}, {"timestamp": "2025-11-13T21:00:05Z", "date_only": false, "value": "2025-11-13T21:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Q-s80O6b5uVlmhryR8-ZciI2tLabDBtdKOXSX3QDtGfzYSw", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "6851ce9d-596f-48a7-b585-7170cec4e554"}, {"timestamp": "2025-11-17T07:26:08Z", "date_only": false, "value": "2025-11-17T07:26:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/strikoder/49a945eeff34362d58ae0eea2caa2fa5", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "f1ff042f-1e01-4aae-971c-1cc4c3d0ebe8", "url": "https://gist.github.com/strikoder/49a945eeff34362d58ae0eea2caa2fa5"}, {"timestamp": "2025-11-19T20:01:14Z", "date_only": false, "value": "2025-11-19T20:01:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/60220", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "8d03eb2c-e954-4341-b17b-3e115584784b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aself cleaning CVE-2025-27591 Poc that grants a root reverse shell instead of modifying passwd files\nURL\uff1ahttps://github.com/0x00Jeff/CVE-2025-27591\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/60220"}, {"timestamp": "2025-11-20T03:00:06Z", "date_only": false, "value": "2025-11-20T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uEOlrUu1_l--1w6IndjXIiiKl78HQvEFFzlmBtSlWW7XloE", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "55fd2b6e-05de-4020-b1c6-c4178c346c3a"}, {"timestamp": "2025-12-11T16:18:48.521Z", "date_only": false, "value": "2025-12-11T16:18:48.521206Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3m7pxxuttzgs2", "record": "cve-2025-27591", "field": "creation_timestamp", "uuid": "e4775edf-9eb4-458c-a336-b15db535c189", "url": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3m7pxxuttzgs2"}, {"timestamp": "2026-01-02T21:00:05Z", "date_only": false, "value": "2026-01-02T21:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Ph5XVLoVKPKzeNd3zHbruXHl3wn31oqUjoUVrNk6if5Q2TM", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "a22a0f5b-f7be-4202-92a1-9959ceaeaa02"}, {"timestamp": "2026-02-08T01:00:10Z", "date_only": false, "value": "2026-02-08T01:00:10Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9MC5-7QHG-FP3W", "record": "GHSA-9MC5-7QHG-FP3W", "field": "modified"}, {"timestamp": "2026-02-08T07:26:28Z", "date_only": false, "value": "2026-02-08T07:26:28Z", "kind": "other", "label": "Updated", "source": "osv_rustsec \u00b7 RUSTSEC-2025-0149", "record": "RUSTSEC-2025-0149", "field": "modified"}, {"timestamp": "2026-02-13T00:00:00Z", "date_only": false, "value": "2026-02-13T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-13T00:00:00Z", "date_only": false, "value": "2026-02-13T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-02-13T00:00:00Z", "date_only": false, "value": "2026-02-13T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-02-13T00:00:00Z", "date_only": false, "value": "2026-02-13T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-04-16T09:00:04Z", "date_only": false, "value": "2026-04-16T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/yG0q3IpDztUHkWGWcBfSkFN1RblCcRFZP5pQldEwVfp_P8g", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "cbde60f7-9d88-48d1-868c-f655fffd12c0"}, {"timestamp": "2026-06-17T09:03:52.557Z", "date_only": false, "value": "2026-06-17T09:03:52.557", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27591", "record": "FKIE_CVE-2025-27591", "field": "lastModified"}, {"timestamp": "2026-07-16T19:00:06.903Z", "date_only": false, "value": "2026-07-16T19:00:06.903642Z", "kind": "sighting", "label": "Seen", "source": "Telegram/gEg0EOaWFFZnEfHhBHmpZpiTrHvldsjFXSF402VZoO1TzNg", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "cd78afea-0b23-4ef2-95db-b5d21955c043"}, {"timestamp": "2026-07-17T00:00:11.301Z", "date_only": false, "value": "2026-07-17T00:00:11.301282Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gEg0EOaWFFZnEfHhBHmpZpiTrHvldsjFXSF402VZoO1TzNg", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "6b244e7a-c001-4349-8181-784515821723"}, {"timestamp": "2026-08-14T16:00:21.912Z", "date_only": false, "value": "2026-08-14T16:00:21.912324Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/395", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "5a960955-7951-4c35-9810-ac1002ee9989", "content": "\u0421\u043e\u0431\u0440\u0430\u043b \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CVE, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435\n\n\ud83d\udd35 CVE-2025-29891 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Camel, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 Camel, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a camel-bean \u0438 camel-exec.\n\n\ud83d\udd35 CVE-2025-27591 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 openSUSE, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043b\u043e\u0433-\u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u0443\u0433\u0440\u043e\u0437\u0443 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0434\u0430\u043d\u043d\u044b\u0445. \u041b\u043e\u0433-\u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044f /var/log/below \u0438\u043c\u0435\u0435\u0442 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043c\u0435\u043d\u044f\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u043e\u0433\u043e\u0432 \u0438\u043b\u0438 \u0434\u0430\u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0441\u0438\u043c\u043b\u0438\u043d\u043a\u0438, \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a \u0432\u0430\u0436\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c.\n\n\ud83d\udd35 CVE-2024-27564 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ChatGPT, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0442\u0438\u043f\u0430 SSRF (Server-Side Request Forgery). \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 URL \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0431\u0430\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u0435\u0449\u0435 \u0441 2023 \u0433\u043e\u0434\u0430, \u043e\u043d \u0432\u0441\u0435 \u0435\u0449\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u0435\u043d. \u0422\u043e\u043b\u044c\u043a\u043e \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0442\u044b\u0441\u044f\u0447 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0442\u0430\u043a \u0441 \u043e\u0434\u043d\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430.\n\n\ud83d\udd35 CVE-2025-25599 \u2014 \u0431\u0430\u0433 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Bolt CMS, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432. \u0417\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0430\u0432\u0430\u0442\u0430\u0440\u0430 \u0438\u0437 URL.\n\n\ud83d\udd35 CVE-2024-28000 \u2014 \u0430\u043d\u0430\u043b\u0438\u0437 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 LiteSpeed Cache. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u0430\u0439\u0442\u0430.\n\n#blue_team #CVE_\u0434\u043d\u044f", "url": "https://t.me/purp_sec/395"}, {"timestamp": "2026-08-27T12:00:09.209Z", "date_only": false, "value": "2026-08-27T12:00:09.209637Z", "kind": "sighting", "label": "Seen", "source": "Telegram/FMxKlI5Q8oe-wqfdJhLf519zmPU2wTxgtOLa-sFM77th6qo", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "ac6cc9a5-f228-4ed8-8c3d-be0a0fbdfce0"}, {"timestamp": "2026-08-29T00:00:28.255Z", "date_only": false, "value": "2026-08-29T00:00:28.255631Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FMxKlI5Q8oe-wqfdJhLf519zmPU2wTxgtOLa-sFM77th6qo", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "b3a07b21-d5f9-4ce8-a335-57a34c2dc293"}, {"timestamp": "2026-09-02T01:00:06.705Z", "date_only": false, "value": "2026-09-02T01:00:06.705312Z", "kind": "sighting", "label": "Seen", "source": "Telegram/zbOkxYY_zAluor3Y7uOLusXS9OsJZvZ7mv8JI_Sd5cs7MNw", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "d054f227-e0da-4d8e-b957-92c5182ae59c"}, {"timestamp": "2026-09-03T00:00:58.919Z", "date_only": false, "value": "2026-09-03T00:00:58.919976Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/zbOkxYY_zAluor3Y7uOLusXS9OsJZvZ7mv8JI_Sd5cs7MNw", "record": "CVE-2025-27591", "field": "creation_timestamp", "uuid": "b82d2c36-ef7a-45e4-82a6-ed11917a3540"}, {"timestamp": "2026-09-16T19:59:48Z", "date_only": false, "value": "2026-09-16T19:59:48Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-16T21:01:48Z", "date_only": false, "value": "2026-09-16T21:01:48Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-17T16:53:45Z", "date_only": false, "value": "2026-09-17T16:53:45Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-09-17T16:53:45Z", "date_only": false, "value": "2026-09-17T16:53:45Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10194-1", "record": "OPENSUSE-SU-2026:10194-1", "field": "document.tracking.current_release_date"}]}