https://vulnerability.circl.lu/sightings/feed 2026-09-17T08:22:58.536823+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9ffd3d36-7782-4a6c-9a87-9f1bb2d341c7/export 2026-09-17T08:22:58.563142+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9ffd3d36-7782-4a6c-9a87-9f1bb2d341c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58360", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-14)", "content": "", "creation_timestamp": "2026-09-15T10:15:08.941567Z"} 2026-09-15T10:15:08.941567+00:00 https://vulnerability.circl.lu/sighting/c150afaa-3e86-4685-bb6f-a607dc46857e/export 2026-09-17T08:22:58.566806+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c150afaa-3e86-4685-bb6f-a607dc46857e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58726", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102331", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ad-autopwn\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jonaslejon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 84 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 16\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-14 19:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAD AutoPwn v4.13.0 \u2014 automated AD attack chain, zero-auth to Domain Admin. Discover/Kerberoast/AS-REP/AD CS ESC1-16/Shadow Creds/RBCD+KCD/Ghost-SPN/TGS-rewrite/Dollar-Ticket/WPAD/WSUS/PXE/SCCM/BloodHound auto-action/Loot/DCSync/DPAPI + Synacktiv 2026 reflection (CVE-2025-58726/2026-24294/2026-26128). Authorized pentesting only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-15T00:00:08.888010Z"} 2026-09-15T00:00:08.888010+00:00 https://vulnerability.circl.lu/sighting/3ed9d9d1-d897-43cb-b822-a7ff42e497ac/export 2026-09-17T08:22:58.566969+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3ed9d9d1-d897-43cb-b822-a7ff42e497ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58360", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-12)", "content": "", "creation_timestamp": "2026-09-13T10:15:08.336746Z"} 2026-09-13T10:15:08.336746+00:00 https://vulnerability.circl.lu/sighting/d984eaab-c92e-49a9-a6c1-b16f36127b4e/export 2026-09-17T08:22:58.567078+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d984eaab-c92e-49a9-a6c1-b16f36127b4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58074", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:33.834612Z"} 2026-09-13T00:00:33.834612+00:00 https://vulnerability.circl.lu/sighting/a9882c84-eddc-4fec-9e52-979409049b16/export 2026-09-17T08:22:58.567198+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a9882c84-eddc-4fec-9e52-979409049b16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58074", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:16.885253Z"} 2026-09-12T10:00:16.885253+00:00 https://vulnerability.circl.lu/sighting/16475ad9-c897-473a-acf9-ed42cd4c16dd/export 2026-09-17T08:22:58.567318+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "16475ad9-c897-473a-acf9-ed42cd4c16dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58034", "type": "exploited", "source": "https://t.me/cissp/7837", "content": "What the people of the Third World must save is not their homeland, but themselves\nfor most of them dwell in the depths of ignorance, deluded by the illusion of wisdom..!\n\n\u0622\u0646\u0686\u0647 \u0645\u0631\u062f\u0645 \u062c\u0647\u0627\u0646 \u0633\u0648\u0645 \u0628\u0627\u06cc\u062f \u0646\u062c\u0627\u062a \u062f\u0647\u0646\u062f\u060c \u0646\u0647 \u0648\u0637\u0646\u200c\u0634\u0627\u0646\u060c \u0628\u0644\u06a9\u0647 \u062e\u0648\u062f\u0634\u0627\u0646 \u0627\u0633\u062a\u061b \u0686\u0631\u0627\u06a9\u0647 \u0628\u06cc\u0634\u062a\u0631 \u0622\u0646\u200c\u0647\u0627 \u062f\u0631 \u0627\u0639\u0645\u0627\u0642 \u0646\u0627\u062f\u0627\u0646\u06cc \u0632\u0646\u062f\u06af\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u0628\u0647 \u062a\u0648\u0647\u0645 \u062f\u0627\u0646\u0627\u06cc\u06cc \u062f\u0644\u200c\u062e\u0648\u0634\u200c\u0627\u0646\u062f.\n\n\ud83d\udd14Fortinet has confirmed a new FortiWeb flaw CVE-2025-58034 already exploited in the wild.\nIt lets authenticated attackers execute OS commands via crafted requests.\nFull story \u2193 \nhttps://thehackernews.com/2025/11/fortinet-warns-of-new-fortiweb-cve-2025.html\n\n\ud83d\udd14 Update: Fortinet has assigned CVE-2025-64446 (CVSS 9.1) a path traversal flaw letting attackers run admin commands via crafted HTTP/S requests.\nCISA added it to KEV \nExploited in the wild.\nPatch now \nhttps://thehackernews.com/2025/11/fortinet-fortiweb-flaw-actively.html\n\n\u2014 CISO as a Service \u2014\n| Strategic Cyber Defense & GRC\nResilient Through Knowledge\n2025.11.20", "creation_timestamp": "2026-09-10T00:00:55.809461Z"} 2026-09-10T00:00:55.809461+00:00 https://vulnerability.circl.lu/sighting/141a35c2-615f-4236-b1bc-378b90c8248e/export 2026-09-17T08:22:58.567453+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "141a35c2-615f-4236-b1bc-378b90c8248e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58360", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/3374", "content": "\u2728 Vulnerabilities & Exploits \u2728\n\nCVE-2025-58360: GeoServer XXE Vulnerability Analysis\n\n\u2014\n\nSummary:\n submitted by /u/Fit_Wing3352 [link] [comments]\n\n\u2014\n\nSource: Technical Information Security Content & Discussion\nPublished: 2025-11-28 14:48 | Author: /u/Fit_Wing3352\n\n#cve202558360 #vulnerabilities__exploits #geoserver\n\nhttps://www.reddit.com/r/netsec/comments/1p8wnps/cve202558360_geoserver_xxe_vulnerability_analysis/", "creation_timestamp": "2026-09-10T00:00:48.439505Z"} 2026-09-10T00:00:48.439505+00:00 https://vulnerability.circl.lu/sighting/0f217035-a4b7-492d-8233-0d96c028780b/export 2026-09-17T08:22:58.567567+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0f217035-a4b7-492d-8233-0d96c028780b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58034", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/3018", "content": "\u2728 Vulnerabilities & Exploits \u2728\n\nFortinet criticized for \u2018silent\u2019 patching after disclosing second zero-day vulnerability in same equipment\n\n\u2014\n\nSummary:\n\n \n \n \n\n\n\n\nOnly days after Fortinet was criticized by researchers for \u2018silently\u2019 patching a zero-day vulnerability without informing its customers, it has emerged that it did the same for a second zero-day that is being used as part of the same attack chain.\n\n\n\nThis is a story of two zero-day vulnerabilities in the FortiWeb web application firewall made public four days apart: CVE-2025-64446 (FG-IR-25-910), made public on November 14, and a second, \u00a0CVE-2025-58034 (FG-IR-25-513),...\n\n\u2014\n\nSource: CrowdStrike fired insider for sharing internal info with hacking group | CSO Online\nPublished: 2025-11-20 19:29\n\n#vulnerabilities__exploits #criticized #fortinet\n\nhttps://www.csoonline.com/article/4093949/fortinet-criticized-for-silent-patching-after-disclosing-second-zero-day-vulnerability-in-same-equipment.html", "creation_timestamp": "2026-09-10T00:00:46.811809Z"} 2026-09-10T00:00:46.811809+00:00 https://vulnerability.circl.lu/sighting/ff8093b0-dc7d-45f9-8760-5ebe06d52bc7/export 2026-09-17T08:22:58.567680+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ff8093b0-dc7d-45f9-8760-5ebe06d52bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58034", "type": "published-proof-of-concept", "source": "https://t.me/Intel_Encyclopedia/3054", "content": "\u2728 Vulnerabilities & Exploits \u2728\n\nMetasploit Releases New Exploit for Fresh FortiWeb 0-Day Vulnerabilities\n\n\u2014\n\nSummary:\nRapid7\u2019s Metasploit team has released a new exploit module targeting critical zero-day vulnerabilities in Fortinet\u2019s FortiWeb web application firewall, chaining two security flaws to achieve unauthenticated remote code execution with root privileges.\u200b CVE ID Vulnerability Type Affected Product Impact CVE-2025-64446 Authentication Bypass Fortinet FortiWeb Administrative account creation, privilege escalation CVE-2025-58034 Command Injection Fortinet FortiWeb Remote [\u2026]\nThe post...\n\n\u2014\n\nSource: GBHackers Security | #1 Globally Trusted Cyber Security News Platform\nPublished: 2025-11-22 05:05 | Author: Divya\n\n#metasploit #vulnerabilities__exploits #releases\n\nhttps://gbhackers.com/metasploit-releases-new-exploit-for-fresh-fortiweb-0-day/", "creation_timestamp": "2026-09-10T00:00:46.679026Z"} 2026-09-10T00:00:46.679026+00:00 https://vulnerability.circl.lu/sighting/4ef609f5-eaa7-44c1-9d58-86a00dda1fec/export 2026-09-17T08:22:58.567783+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4ef609f5-eaa7-44c1-9d58-86a00dda1fec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58434", "type": "published-proof-of-concept", "source": "Telegram/S_xvhEYkSfwY-06pFLtOx1--AsX0A_rgUo_9aHBHntliw8A", "content": "", "creation_timestamp": "2026-09-10T00:00:45.186467Z"} 2026-09-10T00:00:45.186467+00:00