https://vulnerability.circl.lu/sightings/feed 2026-08-08T17:50:41.013459+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/78053867-0639-4371-8489-04afd97ab8a9/export 2026-08-08T17:50:41.035310+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "78053867-0639-4371-8489-04afd97ab8a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mslfzj57222e", "content": "\ud83d\udea8 XSS2shell (CVE-2026-64638) has been identified as a notable vulnerability.\n\n\u2139\ufe0f Additional details on ZEN SecDB secdb.nttzen.cloud/updates/267d...", "creation_timestamp": "2026-08-08T15:44:27.551460Z"} 2026-08-08T15:44:27.551460+00:00 https://vulnerability.circl.lu/sighting/5f80a35e-5fab-4068-9747-776b80b73ee2/export 2026-08-08T17:50:41.040451+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5f80a35e-5fab-4068-9747-776b80b73ee2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97180", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a poc-CVE-2026-64638-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mohwahyudi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 13:13:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T15:00:03.369536Z"} 2026-08-08T15:00:03.369536+00:00 https://vulnerability.circl.lu/sighting/8e09ef1f-a149-4779-b3ec-a48b7963f8bf/export 2026-08-08T17:50:41.040630+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8e09ef1f-a149-4779-b3ec-a48b7963f8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97166", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 11:56:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee1\ufe0f CVE-2026-64638 - WordPress Security Assessment Suite (CVSS 8.9) | WordPress 4.7.0-7.0.2 pentest toolkit. Includes vulnerability assessment & advanced analysis modules. \ud83d\udc0d Safe Check & Exploit, 2 mode. Advanced Blue&Red Team Best 2026-64638 Toolkit, Authorized use only. Stay Legal <3zd\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T14:02:14.332752Z"} 2026-08-08T14:02:14.332752+00:00 https://vulnerability.circl.lu/sighting/7bea11d0-3475-4afc-843e-f5bd781da9c8/export 2026-08-08T17:50:41.040762+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7bea11d0-3475-4afc-843e-f5bd781da9c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64638", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117060189477473635", "content": "You mean there's another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.\nIf you aren't already on 7.0.3, please patch ASAP. Also, consider limiting login page access.\nhttps://discourse.ifin.network/t/cve-2026-64638-xss2shell-does-what-it-says-patch-wordpress-now/729\n#CVE #IFIN #ThreatIntel #ThreatIntelligence", "creation_timestamp": "2026-08-08T13:46:01.443271Z"} 2026-08-08T13:46:01.443271+00:00 https://vulnerability.circl.lu/sighting/14d1522c-472a-43fc-b938-4e2720fbfecb/export 2026-08-08T17:50:41.040873+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "14d1522c-472a-43fc-b938-4e2720fbfecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3msl7f526ln24", "content": "You mean there's another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.\n\nIf you aren't already on 7.0.3, please patch ASAP. Also, consider limiting login page access.\n\ndiscourse.ifin.netwo...\n\n#CVE #IFIN #ThreatIntel #ThreatIntelligence", "creation_timestamp": "2026-08-08T13:45:41.296011Z"} 2026-08-08T13:45:41.296011+00:00 https://vulnerability.circl.lu/sighting/ce9c3f6d-2853-498c-ab8d-8e2a7173f624/export 2026-08-08T17:50:41.040980+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ce9c3f6d-2853-498c-ab8d-8e2a7173f624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3msl5l4dfdm42", "content": "WordPress RCE. Every version ever released (except the latest, 7.0.3). 500+ million sites. 43% of the Internet-facing sites. Hacker's paradise.\n\n\"XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)\":\n\nhttps://pwn.ai/blog/xss2shell", "creation_timestamp": "2026-08-08T13:13:15.987838Z"} 2026-08-08T13:13:15.987838+00:00 https://vulnerability.circl.lu/sighting/fb120757-bfb3-4b05-b8b3-078a56b780a9/export 2026-08-08T17:50:41.041081+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fb120757-bfb3-4b05-b8b3-078a56b780a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97148", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Linuxhackingid-official\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 08:12:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64638 \u2014 WordPress Pre-Auth Reflected XSS \u2192 RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC (XSS chain & direct).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T10:00:04.252207Z"} 2026-08-08T10:00:04.252207+00:00 https://vulnerability.circl.lu/sighting/c7c7034b-03cd-42f5-98d2-932ef6642b94/export 2026-08-08T17:50:41.041183+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c7c7034b-03cd-42f5-98d2-932ef6642b94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97146", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 08:57:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror \u2014 WordSec, MIT; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T10:00:04.213920Z"} 2026-08-08T10:00:04.213920+00:00 https://vulnerability.circl.lu/sighting/faed7e47-5934-4e4b-8782-450427047845/export 2026-08-08T17:50:41.041294+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "faed7e47-5934-4e4b-8782-450427047845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97145", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4minx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 08:58:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64638 (XSS2shell) POC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T10:00:04.154324Z"} 2026-08-08T10:00:04.154324+00:00 https://vulnerability.circl.lu/sighting/cdad8c99-663b-46cf-b80f-98a54f37639f/export 2026-08-08T17:50:41.041421+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "cdad8c99-663b-46cf-b80f-98a54f37639f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97142", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE #Reflected\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yogaGymn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 07:19:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T09:00:03.931718Z"} 2026-08-08T09:00:03.931718+00:00