https://vulnerability.circl.lu/sightings/feed 2026-09-18T13:39:42.370013+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/2e7aaff3-588a-4b85-81b7-3f3646caf5d8/export 2026-09-18T13:39:42.384028+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2e7aaff3-588a-4b85-81b7-3f3646caf5d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68820", "type": "seen", "source": "https://t.me/VulnerabilityNews/43941", "content": "Lazarus hackers exploited Windows zero-day to target defense firms\n\nNorth Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as part of the Operation Dream Job campaign. [...]\nhttps://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/", "creation_timestamp": "2026-09-18T12:00:07.325455Z"} 2026-09-18T12:00:07.325455+00:00 https://vulnerability.circl.lu/sighting/7f71597e-9411-4743-87d2-619722381c71/export 2026-09-18T13:39:42.386751+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7f71597e-9411-4743-87d2-619722381c71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68121", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117291036654007377", "content": "Ouep, vendredi vuln assist\u00e9 is back : le kernel Linux, toujours la cible pr\u00e9f\u00e9r\u00e9e du branding CVE \ud83d\udc27 \nDirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) et DiagSpill (CVE-2026-74469) permettent, dans les configurations adapt\u00e9es, \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'obtenir root. Bugs pr\u00e9sents dans le kernel depuis 10 \u00e0 21 ans.\nRisque pas uniforme : les trois premi\u00e8res n\u00e9cessitent des user namespaces non privil\u00e9gi\u00e9s + des fonctionnalit\u00e9s r\u00e9seau particuli\u00e8res (AH6/XFRM, TUN/TAP, PPPoE). DiagSpill est directement accessible sans capability, MAIS n\u00e9cessite SCTP + sctp_diag.\nPas de RCE distante g\u00e9n\u00e9rique, mais nuance \u00e0 conna\u00eetre pour les passerelles : DirtyAH6 peut causer un DoS distant sur un routeur IPv6 faisant de l'AH en mode transport (root distant obtenu en labo par l'auteur, via grooming c\u00f4t\u00e9 cible--> jug\u00e9 \"extr\u00eamement difficile\"). DiagSpill a aussi un vecteur DoS distant si ASCONF/ADD-IP + SCTP-AUTH (ou addip_noauth_enable=1) sont actifs-->d\u00e9sactiv\u00e9s par d\u00e9faut.\n\u27a1\ufe0f \u00c0 surveiller en priorit\u00e9 : syst\u00e8mes multi-utilisateurs, conteneurs, h\u00f4tes TUN/TAP, PPPoE, XFRM/AH6 ou SCTP.\n\ud83d\udd0e Analyse compl\u00e8te\ud83d\udc47 https://heyitsas.im/posts/lpe-quartet/\n:debian: \ud83d\udc47 DirtyAH6 corrig\u00e9 sur Bookworm-security, encore vuln\u00e9rable sur Trixie.\nTUNderflow corrig\u00e9e uniquement dans sid \nPPPoEject et DiagSpill corrig\u00e9s sur Bookworm-security et Trixie.\u2b07\ufe0f \n\n\nDirtyAH6 \u2014 CVE-2026-80844Debian Security Tracker\n\nTUNderflow \u2014 CVE-2026-81000Debian Security Tracker\n\nPPPoEject \u2014 CVE-2026-68121Debian Security Tracker\n\nDiagSpill \u2014 CVE-2026-74469Debian Security Tracker\nPoCs \ud83d\udc40 \ud83d\udc47DirtyAH6 \u2014 CVE-2026-80844 : https://github.com/manizada/DirtyAH6TUNderflow \u2014 CVE-2026-81000 : https://github.com/manizada/TUNderflowPPPoEject \u2014 CVE-2026-68121 : https://github.com/manizada/PPPoEjectDiagSpill \u2014 CVE-2026-74469 : https://github.com/manizada/DiagSpill\n#Linux #CyberSecurity #Vulnerability #CVE #Debian", "creation_timestamp": "2026-09-18T08:13:08.399309Z"} 2026-09-18T08:13:08.399309+00:00 https://vulnerability.circl.lu/sighting/047c50b2-d23a-413f-9417-66b4e024c496/export 2026-09-18T13:39:42.386914+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "047c50b2-d23a-413f-9417-66b4e024c496", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6875", "type": "seen", "source": "https://t.me/VulnerabilityNews/43588", "content": "Exploitation of ServiceNow Vulnerability Seen Days After Disclosure\n\nThe ServiceNow AI platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution.\nThe post Exploitation of ServiceNow Vulnerability Seen Days After Disclosure appeared first on SecurityWeek.\nhttps://www.securityweek.com/exploitation-of-servicenow-vulnerability-seen-days-after-disclosure/", "creation_timestamp": "2026-09-18T08:00:06.836675Z"} 2026-09-18T08:00:06.836675+00:00 https://vulnerability.circl.lu/sighting/5c2d47e9-0139-4742-9f85-0bab3a32908e/export 2026-09-18T13:39:42.387024+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5c2d47e9-0139-4742-9f85-0bab3a32908e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6875", "type": "seen", "source": "https://t.me/VulnerabilityNews/43560", "content": "Critical ServiceNow code execution flaw now exploited in attacks\n\nAttackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/", "creation_timestamp": "2026-09-18T08:00:06.580691Z"} 2026-09-18T08:00:06.580691+00:00 https://vulnerability.circl.lu/sighting/69edda77-9419-4452-8012-e81dfbaa3355/export 2026-09-18T13:39:42.387126+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "69edda77-9419-4452-8012-e81dfbaa3355", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68121", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117290704561368341", "content": "It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:\n- DirtyAH6 (CVE-2026-80844)- TUNderflow (CVE-2026-81000)- PPPoEject (CVE-2026-68121)- DiagSpill (CVE-2026-74469)\n\"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not.\"\nhttps://www.openwall.com/lists/oss-security/2026/09/18/3https://heyitsas.im/posts/lpe-quartet/\n#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469", "creation_timestamp": "2026-09-18T06:48:42.089300Z"} 2026-09-18T06:48:42.089300+00:00 https://vulnerability.circl.lu/sighting/4312fe6b-35ec-4c7a-86b1-721559a6b65c/export 2026-09-18T13:39:42.387232+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4312fe6b-35ec-4c7a-86b1-721559a6b65c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68536", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqj755n7y24", "content": "CVE-2026-68536 - apache myfaces\nCertain versions of Apache MyFaces can be told to access internal network locations or read files on the server, which could expose sensitive information. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachemyfaces #apachefoundation #CVE #infosec", "creation_timestamp": "2026-09-17T20:40:10.404962Z"} 2026-09-17T20:40:10.404962+00:00 https://vulnerability.circl.lu/sighting/08c441de-6c92-4ff4-abc5-3474c140b6ef/export 2026-09-18T13:39:42.387334+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "08c441de-6c92-4ff4-abc5-3474c140b6ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68904", "type": "seen", "source": "https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac", "content": "# CVE-2026-68904: CVE-2026-68904: Uncontrolled Resource Consumption (Socket Leak and Reconnection Storm) in node-opcua\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68904\n\n## Summary\nCVE-2026-68904 is a high-severity Denial of Service (DoS) vulnerability in the node-opcua library. It arises from a logical flaw in the keepalive session manager combined with incorrect socket termination at the TCP transport layer. When server-side anomalies occur, affected clients fall into an infinite, high-frequency reconnection loop. Due to the use of graceful teardown (socket.end) instead of immediate termination (socket.destroy) during negotiation failures, sockets remain open in the FIN-WAIT-2 state. This accumulates system file descriptors and memory, eventually crashing the client process.\n\n## TL;DR\nA socket leak and logic comparison bug in node-opcua client keepalives triggers an infinite, high-frequency reconnection storm. The improper socket teardown leaves connections in FIN-WAIT-2 indefinitely, exhausting system file descriptors and causing client-side crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400: Uncontrolled Resource Consumption\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.0 (High)\n- **EPSS Score**: Not Available\n- **Impact**: Availability (High) - Client Process Crash\n- **Exploit Status**: PoC / Functional Test Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js client applications utilizing the node-opcua package in vulnerable versions.\n- **node-opcua**: >= 2.0.0, < 2.170.0 (Fixed in: `2.170.0`)\n\n## Mitigation\n\n- Upgrade node-opcua to version 2.170.0 or later.\n- Reduce system-level TCP FIN-WAIT-2 timeout settings via sysctl.\n- Implement NTP synchronization to reduce clock skew and prevent ServiceFault generation.\n\n**Remediation Steps:**\n1. Open your project's package.json file.\n2. Locate the node-opcua dependency and update the version string to ^2.170.0.\n3. Run your package manager install command (e.g., npm install or yarn install) to update lockfiles.\n4. Apply the sysctl command 'sysctl -w net.ipv4.tcp_fin_timeout=15' on the production host to defend against raw socket exhaustion.\n\n## References\n\n- [GHSA-r2pf-9cw4-5j65: Uncontrolled Resource Consumption in node-opcua](https://github.com/node-opcua/node-opcua/security/advisories/GHSA-r2pf-9cw4-5j65)\n- [CVE-2026-68904 Record](https://www.cve.org/CVERecord?id=CVE-2026-68904)\n- [node-opcua Pull Request 1497](https://github.com/node-opcua/node-opcua/pull/1497)\n- [node-opcua Version v2.170.0 Release Notes](https://github.com/node-opcua/node-opcua/releases/tag/v2.170.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68904) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T17:31:30.485356Z"} 2026-09-16T17:31:30.485356+00:00 https://vulnerability.circl.lu/sighting/b193ffc3-a16f-448d-8ba9-7f4169779693/export 2026-09-18T13:39:42.387459+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b193ffc3-a16f-448d-8ba9-7f4169779693", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68775", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvn2f5acq72j", "content": "\ud83d\udccc CVE-2026-68775 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. https://www.cyberhub.blog/cves/CVE-2026-68775", "creation_timestamp": "2026-09-16T11:37:06.959060Z"} 2026-09-16T11:37:06.959060+00:00 https://vulnerability.circl.lu/sighting/174a558b-48f9-4d41-89be-ebaab036342d/export 2026-09-18T13:39:42.387562+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "174a558b-48f9-4d41-89be-ebaab036342d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68786", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvmrywp7xr2y", "content": "\ud83d\udccc CVE-2026-68786 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. https://www.cyberhub.blog/cves/CVE-2026-68786", "creation_timestamp": "2026-09-16T09:07:07.865340Z"} 2026-09-16T09:07:07.865340+00:00 https://vulnerability.circl.lu/sighting/a21c90d7-10a8-45f5-a2fa-2af033f126d2/export 2026-09-18T13:39:42.387658+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a21c90d7-10a8-45f5-a2fa-2af033f126d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68070", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlmsvp5sh2m", "content": "\ud83d\udfe0 CVE-2026-68070 - High (8.8)\n\nThe affected products are missing authentication for a critical function, which could allow an at...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-68070/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T22:01:38.128101Z"} 2026-09-15T22:01:38.128101+00:00