https://vulnerability.circl.lu/sightings/feed 2026-09-18T12:13:44.019913+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/156bdc56-1300-4a8f-bfea-40f33e8505ed/export 2026-09-18T12:13:44.030541+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "156bdc56-1300-4a8f-bfea-40f33e8505ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://t.me/VulnerabilityNews/44177", "content": "CISA Warns of Exploited Gitea Vulnerability\n\nCVE-2026-60004 is a remote code execution vulnerability patched by Gitea developers in late July with the release of version 1.27.1.\nThe post CISA Warns of Exploited Gitea Vulnerability appeared first on SecurityWeek.\nhttps://www.securityweek.com/cisa-warns-of-exploited-gitea-vulnerability/", "creation_timestamp": "2026-09-18T12:00:06.387521Z"} 2026-09-18T12:00:06.387521+00:00 https://vulnerability.circl.lu/sighting/dd741990-2d29-44ab-bc2f-dee9e2381389/export 2026-09-18T12:13:44.031719+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dd741990-2d29-44ab-bc2f-dee9e2381389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/VulnerabilityNews/43573", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "creation_timestamp": "2026-09-18T08:00:06.755650Z"} 2026-09-18T08:00:06.755650+00:00 https://vulnerability.circl.lu/sighting/dd7d0637-79b1-4d22-aa31-e9a0caddde70/export 2026-09-18T12:13:44.031827+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dd7d0637-79b1-4d22-aa31-e9a0caddde70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43589", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog \n\nCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability\nCVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability \u00a0\nCVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability \u00a0\nCVE-2026-60137 WordPress Core SQL Injection Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T08:00:06.027643Z"} 2026-09-18T08:00:06.027643+00:00 https://vulnerability.circl.lu/sighting/f4927dd4-b08d-4c5c-b6dc-541c33546c48/export 2026-09-18T12:13:44.031930+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f4927dd4-b08d-4c5c-b6dc-541c33546c48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "Telegram/FpYk8ynVsvkUdXcoDEYgoRRt_8k7ZJGfsVgmeYKdLdl0tBg", "content": "", "creation_timestamp": "2026-09-18T04:00:15.766994Z"} 2026-09-18T04:00:15.766994+00:00 https://vulnerability.circl.lu/sighting/02c5c97c-24a2-4b25-ad93-170fd7b3a4e7/export 2026-09-18T12:13:44.032010+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "02c5c97c-24a2-4b25-ad93-170fd7b3a4e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvpw72c6432n", "content": "\ud83d\udce2 Red Heron exploite CVE-2026-60004 dans Gitea pour d\u00e9ployer un rootkit Linux in\u00e9dit\n\nL'Acronis Threat Research Unit (TRU) a publi\u00e9 le 13 septembre 2026 une analyse d\u00e9taill\u00e9e d'une campagne multinationale men\u00e9e par un acteur\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#RedHeron #RootkitLinux #Cyberveille", "creation_timestamp": "2026-09-17T15:00:07.499039Z"} 2026-09-17T15:00:07.499039+00:00 https://vulnerability.circl.lu/sighting/2ded3e6b-6919-47d3-9543-5cb086441373/export 2026-09-18T12:13:44.032094+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2ded3e6b-6919-47d3-9543-5cb086441373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mvomyrzrpk2p", "content": "Forty-eight hours, Morty. Acronis says Red Heron flipped a public Gitea RCE\u2014CVE-2026-60004\u2014into an automated heist across ~1,386 boxes. Defense, elections, energy nested. Self-hosted git as a spy gift shop. Your patch calendar just auctioned the keys. day260.008", "creation_timestamp": "2026-09-17T02:42:54.849177Z"} 2026-09-17T02:42:54.849177+00:00 https://vulnerability.circl.lu/sighting/9cb9167d-957e-44ba-8c67-aea58e557668/export 2026-09-18T12:13:44.032173+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9cb9167d-957e-44ba-8c67-aea58e557668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6", "content": "# CVE-2026-60137: CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60137\n\n## Summary\nCVE-2026-60137 is a critical SQL injection vulnerability in the Core component of WordPress. The flaw occurs within the WP_Query class during the processing of the author__not_in parameter, where user-supplied array inputs are constructed into a SQL string without strict integer type-casting. When chained with CVE-2026-63030, an unauthenticated remote attacker can exploit this SQL injection to read database values, extract administrator credential hashes, or modify administrative options to execute arbitrary PHP code on the server.\n\n## TL;DR\nWordPress Core contains an SQL injection vulnerability in the WP_Query class when parsing author__not_in parameters. When chained with CVE-2026-63030, unauthenticated attackers can execute arbitrary SQL and escalate privileges to Remote Code Execution.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS Base Score**: 5.9 (Standalone) / 9.8 (Chained)\n- **Exploit Status**: active\n- **CISA KEV Status**: Listed\n- **EPSS Score**: 0.78305\n\n## Affected Systems\n\n- WordPress Core 6.8.0 through 6.8.5\n- WordPress Core 6.9.0 through 6.9.4\n- WordPress Core 7.0.0 through 7.0.1\n- **WordPress Core**: >= 6.8.0, < 6.8.6 (Fixed in: `6.8.6`)\n- **WordPress Core**: >= 6.9.0, < 6.9.5 (Fixed in: `6.9.5`)\n- **WordPress Core**: >= 7.0.0, < 7.0.2 (Fixed in: `7.0.2`)\n\n## Mitigation\n\n- Upgrade WordPress Core immediately to a patched version\n- Disable or block unauthorized access to the REST API batch routes\n- Implement restrictive WAF rules to detect nested array manipulations in REST requests\n\n**Remediation Steps:**\n1. Access the administrative control panel of the WordPress installation.\n2. Navigate to the Updates section and select Update Now to apply the latest security version.\n3. For headless or automated deployments, update the composer.json or version lockfiles to reference 6.8.6, 6.9.5, or 7.0.2.\n4. Configure the Web Application Firewall to block POST requests directed at /wp-json/batch/v1 and /?rest_route=/batch/v1.\n\n## References\n\n- [WordPress Core Advisory (GHSA-fpp7-x2x2-2mjf)](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)\n- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)\n- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)\n- [Searchlight Cyber Research on wp2shell](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)\n- [Aikido Security Blog Analysis](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60137) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T13:01:54.533652Z"} 2026-09-16T13:01:54.533652+00:00 https://vulnerability.circl.lu/sighting/3d241152-a21e-4c66-9bc2-9d095ed42a62/export 2026-09-18T12:13:44.032273+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3d241152-a21e-4c66-9bc2-9d095ed42a62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60004", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mvmvkvvblk2g", "content": "Original text: \"Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit\" \u2014 Subhajeet Singha, Acronis Threat Research Unit (13 September 2026). Figures, sector/command/IOC tables and publish\nhttps://core-jmp.org/2026/09/red-heron-gitea-cve-2026-60004-jitterly-sixzut/", "creation_timestamp": "2026-09-16T10:10:52.623959Z"} 2026-09-16T10:10:52.623959+00:00 https://vulnerability.circl.lu/sighting/f0b2b107-6c8a-4c68-9d69-3aadf93f072b/export 2026-09-18T12:13:44.032354+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f0b2b107-6c8a-4c68-9d69-3aadf93f072b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvkfmmz7qk22", "content": "Critical Gitea RCE bug CVE-2026-60004 in versions 1.17-1.27.0 now in live attacks\u2014upgrade ASAP. #Security #CVE2026-60004 #Gitea #RCE #Infosec #CyberAttack https://thedailytechfeed.com/critical-gitea-rce-vulnerability-under-active-attack-what-you-need-to-know/", "creation_timestamp": "2026-09-15T10:20:09.837029Z"} 2026-09-15T10:20:09.837029+00:00 https://vulnerability.circl.lu/sighting/8cf43bb1-5539-4ef3-b6f6-4db3100dfef0/export 2026-09-18T12:13:44.032431+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8cf43bb1-5539-4ef3-b6f6-4db3100dfef0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/virusbtn.bsky.social/post/3mvka7r3pxc2q", "content": "Acronis TRU uncovered a multinational campaign in which Red Heron, a Chinese-speaking threat actor, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. www.acronis.com/en/tru/posts...", "creation_timestamp": "2026-09-15T08:43:33.406998Z"} 2026-09-15T08:43:33.406998+00:00