https://vulnerability.circl.lu/sightings/feed 2026-09-18T17:02:13.033759+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/8e6e0104-f0ac-4904-8ff5-a29f2cd4a3c7/export 2026-09-18T17:02:13.048944+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8e6e0104-f0ac-4904-8ff5-a29f2cd4a3c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72529", "type": "seen", "source": "https://t.me/VulnerabilityNews/44086", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog \n\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. \u00a0\nCVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability \u00a0\nCVE-2026-72530 TrueConf Server Code Injection Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:07.150063Z"} 2026-09-18T12:00:07.150063+00:00 https://vulnerability.circl.lu/sighting/0cdc647e-5a54-44cb-b2cf-37305cbc4f90/export 2026-09-18T17:02:13.051813+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0cdc647e-5a54-44cb-b2cf-37305cbc4f90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72530", "type": "seen", "source": "https://t.me/VulnerabilityNews/44086", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog \n\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. \u00a0\nCVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability \u00a0\nCVE-2026-72530 TrueConf Server Code Injection Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:07.092450Z"} 2026-09-18T12:00:07.092450+00:00 https://vulnerability.circl.lu/sighting/c7ab6a3b-eda4-4895-98c4-b7bfccf7ce81/export 2026-09-18T17:02:13.052080+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c7ab6a3b-eda4-4895-98c4-b7bfccf7ce81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72695", "type": "seen", "source": "https://gist.github.com/alon710/424c5810a1f7a2ef19ef90cac7c85184", "content": "# CVE-2026-72695: CVE-2026-72695: Authenticated Path Traversal and Arbitrary File Deletion in Grav CMS MediaUploadTrait\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72695\n\n## Summary\nA path traversal vulnerability exists in Grav CMS versions prior to 2.0.16. The flaw occurs within the file validation mechanisms of the MediaUploadTrait, enabling authenticated users with media management privileges to bypass sandbox limitations. This allows the deletion of arbitrary files on the filesystem, which can result in denial of service or remote code execution.\n\n## TL;DR\nAn authenticated path traversal vulnerability in Grav CMS before 2.0.16 allows media administrators to delete arbitrary files on the system by bypassing incomplete directory validation checks in the MediaUploadTrait.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22: Improper Limitation of a Pathname to a Restricted Directory\n- **Attack Vector**: Network (Unauthenticated: No, Requires authenticated media management privileges)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **EPSS Score**: 0.00567 (Percentile: 45.53%)\n- **Impact**: Arbitrary File Deletion / Denial of Service / Remote Code Execution\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Grav CMS installations prior to version 2.0.16\n- Plugins incorporating system/src/Grav/Common/Media/Traits/MediaUploadTrait.php\n- **Grav CMS**: < 2.0.16 (Fixed in: `2.0.16`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.16 or newer.\n- Enforce strict filesystem permissions restricting write access to configuration folders.\n- Implement WAF rules targeting directory traversal sequences in media endpoints.\n- Restrict administrative media management permissions using role-based access control.\n\n**Remediation Steps:**\n1. Identify vulnerable Grav installations running versions prior to 2.0.16.\n2. Download the updated Grav CMS core package or execute the command-line update tool 'bin/gpm self-upgrade'.\n3. Verify the integration of commit f6883ed50764cb7dea41f9260e096374b4e17aeb in the codebase.\n4. Check third-party plugins utilizing MediaUploadInterface to ensure they inherit the updated traits.\n\n## References\n\n- [GitHub Security Advisory GHSA-jq29-c7v8-rg55](https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/grav-before-path-traversal-via-mediauploadtrait-deletefile)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-72695)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72695) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T03:31:25.434230Z"} 2026-09-18T03:31:25.434230+00:00 https://vulnerability.circl.lu/sighting/4b8560e0-bb0e-49a8-84d4-efb139df10cb/export 2026-09-18T17:02:13.052227+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "4b8560e0-bb0e-49a8-84d4-efb139df10cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72702", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-9ccq-2jfg-qw33", "content": "", "creation_timestamp": "2026-09-17T22:35:36.452592Z"} 2026-09-17T22:35:36.452592+00:00 https://vulnerability.circl.lu/sighting/36a9a7e5-9f68-4d44-8f2f-6e250f953233/export 2026-09-18T17:02:13.053222+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "36a9a7e5-9f68-4d44-8f2f-6e250f953233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72701", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-38p6-h87p-r4cg", "content": "", "creation_timestamp": "2026-09-17T22:35:34.594314Z"} 2026-09-17T22:35:34.594314+00:00 https://vulnerability.circl.lu/sighting/cb582db0-b962-46b0-a1ca-6622d3d2416a/export 2026-09-18T17:02:13.053348+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "cb582db0-b962-46b0-a1ca-6622d3d2416a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72698", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-p597-crqc-m349", "content": "", "creation_timestamp": "2026-09-17T22:35:32.675857Z"} 2026-09-17T22:35:32.675857+00:00 https://vulnerability.circl.lu/sighting/6db9f3c4-09cd-4f7b-9cc0-e974fe8abb59/export 2026-09-18T17:02:13.053451+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "6db9f3c4-09cd-4f7b-9cc0-e974fe8abb59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72697", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-47ch-6w46-6xm7", "content": "", "creation_timestamp": "2026-09-17T22:35:28.685284Z"} 2026-09-17T22:35:28.685284+00:00 https://vulnerability.circl.lu/sighting/79907141-9077-444c-8168-7a3000f628ae/export 2026-09-18T17:02:13.053556+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "79907141-9077-444c-8168-7a3000f628ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72695", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-jq29-c7v8-rg55", "content": "", "creation_timestamp": "2026-09-17T22:35:08.127254Z"} 2026-09-17T22:35:08.127254+00:00 https://vulnerability.circl.lu/sighting/3c86c521-f5bd-420a-8d8c-55dc363add2c/export 2026-09-18T17:02:13.053650+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "3c86c521-f5bd-420a-8d8c-55dc363add2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72819", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-r94f-hx44-8jqf", "content": "", "creation_timestamp": "2026-09-17T22:35:02.460538Z"} 2026-09-17T22:35:02.460538+00:00 https://vulnerability.circl.lu/sighting/be942c7b-b298-4cb6-a8c1-22a5b747ba82/export 2026-09-18T17:02:13.053748+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "be942c7b-b298-4cb6-a8c1-22a5b747ba82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72819", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqno2xs5f2f", "content": "CVE-2026-72819 - grav\nAn attacker with Grav CMS access can upload a malicious ZIP file containing code, which can be executed on the server. This is a serious risk because it allows an attacker to gain\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #PHP #CVE #infosec", "creation_timestamp": "2026-09-17T22:00:10.021591Z"} 2026-09-17T22:00:10.021591+00:00