https://vulnerability.circl.lu/sightings/feed 2026-09-04T13:42:01.530968+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/994fd655-299d-4f10-9f97-79a103998205/export 2026-09-04T13:42:01.563611+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "994fd655-299d-4f10-9f97-79a103998205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29058", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-31T00:00:24.592754Z"} 2026-08-31T00:00:24.592754+00:00 https://vulnerability.circl.lu/sighting/98cd523c-1487-41ef-9dff-fac31ff565d6/export 2026-09-04T13:42:01.565273+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "98cd523c-1487-41ef-9dff-fac31ff565d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29058", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-30T00:00:45.374410Z"} 2026-08-30T00:00:45.374410+00:00 https://vulnerability.circl.lu/sighting/02ee9fcf-9bae-4789-9749-12c9368865d6/export 2026-09-04T13:42:01.565381+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "02ee9fcf-9bae-4789-9749-12c9368865d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "https://t.me/CyberDispatch/2353", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.", "creation_timestamp": "2026-08-30T00:00:37.384402Z"} 2026-08-30T00:00:37.384402+00:00 https://vulnerability.circl.lu/sighting/18f74ba5-3b6e-4418-8fb2-08282d18083d/export 2026-09-04T13:42:01.565457+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "18f74ba5-3b6e-4418-8fb2-08282d18083d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29058", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-29T20:00:20.393828Z"} 2026-08-29T20:00:20.393828+00:00 https://vulnerability.circl.lu/sighting/e7004fb4-0195-480c-bba1-7098c782921d/export 2026-09-04T13:42:01.565529+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e7004fb4-0195-480c-bba1-7098c782921d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://t.me/CyberDispatch/2353", "content": "Windmill servers are under active attack.\n\nExperts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.", "creation_timestamp": "2026-08-29T20:00:06.926022Z"} 2026-08-29T20:00:06.926022+00:00 https://vulnerability.circl.lu/sighting/9cedad78-ad8c-473d-b9fe-95df8fe637e1/export 2026-09-04T13:42:01.565606+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9cedad78-ad8c-473d-b9fe-95df8fe637e1", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cdf3b3dc-7ab6-42bb-8e0a-830a3ba84102", "content": "", "creation_timestamp": "2026-08-29T01:00:31.405366Z"} 2026-08-29T01:00:31.405366+00:00 https://vulnerability.circl.lu/sighting/e19cc929-202d-432d-93fc-c8b3e68f8dba/export 2026-09-04T13:42:01.565676+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e19cc929-202d-432d-93fc-c8b3e68f8dba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-27)", "content": "", "creation_timestamp": "2026-08-28T10:00:05.881473Z"} 2026-08-28T10:00:05.881473+00:00 https://vulnerability.circl.lu/sighting/f4d6e975-4717-4bbf-a423-647e0f44f05e/export 2026-09-04T13:42:01.565744+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f4d6e975-4717-4bbf-a423-647e0f44f05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-07 05:21:48 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:09.462793Z"} 2026-08-10T10:02:09.462793+00:00 https://vulnerability.circl.lu/sighting/c7299fb3-0b54-4a4a-b83f-1238eb6c4810/export 2026-09-04T13:42:01.565826+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c7299fb3-0b54-4a4a-b83f-1238eb6c4810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mrizj7i2ye2c", "content": "Active exploit! CVE-2026-29059 (CVSS 7.5) affects Windmill's get_log_file endpoint via unauthenticated path traversal. Urgent patch needed to prevent compromise. #CyberSecurity", "creation_timestamp": "2026-07-25T23:30:04.467075Z"} 2026-07-25T23:30:04.467075+00:00 https://vulnerability.circl.lu/sighting/2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa/export 2026-09-04T13:42:01.565892+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2e6d0f8f-78a4-4284-9b23-89fba1e4fdaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29059", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrhrrsvpcz2k", "content": "\ud83d\udd34 EXPLOITED\n\nWindmill, the open-source automation platform, has an unauthenticated flaw (CVE-2026-29059) that lets a stranger read files off the server. It is being exploited now.\n\nRun Windmill? Update to 1.603.3 and rotate exposed secrets.", "creation_timestamp": "2026-07-25T11:39:03.559948Z"} 2026-07-25T11:39:03.559948+00:00