https://vulnerability.circl.lu/sightings/feed 2026-09-10T20:00:40.017983+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/21fc4284-ad54-487b-bca2-659be011d926/export 2026-09-10T20:00:40.041566+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "21fc4284-ad54-487b-bca2-659be011d926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48979", "content": "CVE-2026-67401: SQL Injection Vulnerability in cPanel, 9.9 Rating \ud83d\udd25\n\nA vulnerability in cPanel's EmailTrack component allows an authenticated attacker with mail-related privileges to create arbitrary files on the server via SQL injection. This may lead to code execution as the root user, giving the attacker full control of the server.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/dIEpd\n\ud83d\udc49 Dork: http.title:cpanel OR http.headers.set_cookie:\"cprelogin\" OR http.headers.set_cookie:\"cpsession\"\n\nVendor's advisory:\nhttps://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026", "creation_timestamp": "2026-09-10T18:00:05.880025Z"} 2026-09-10T18:00:05.880025+00:00 https://vulnerability.circl.lu/sighting/570b8a53-a33e-4c37-9cd8-7ff1610761f9/export 2026-09-10T20:00:40.046402+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "570b8a53-a33e-4c37-9cd8-7ff1610761f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/GithubRedTeam/101929", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67401-cPanel-EmailTrack-SQLi\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jithinkrishnanrs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-10 11:27:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-67401 cPanel & WHM EmailTrack SQL Injection \u2014 IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T15:00:05.889575Z"} 2026-09-10T15:00:05.889575+00:00 https://vulnerability.circl.lu/sighting/e4d50e02-5756-4057-be51-2bc62a0449e1/export 2026-09-10T20:00:40.046733+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e4d50e02-5756-4057-be51-2bc62a0449e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "Telegram/ywbCj1qC377X1uevfG1yFHPTnDAYE7AO0rak_508q64VcZA", "content": "", "creation_timestamp": "2026-09-10T05:00:04.984369Z"} 2026-09-10T05:00:04.984369+00:00 https://vulnerability.circl.lu/sighting/c543a8b6-bca3-4530-99ca-351377919765/export 2026-09-10T20:00:40.046931+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c543a8b6-bca3-4530-99ca-351377919765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mv4th4pwl22o", "content": "cPanel & WHM\u306eEmailTrack\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u300cCVE-2026-67401\u300d\u3001root\u6a29\u9650\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u304a\u305d\u308c \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-10T00:50:25.095415Z"} 2026-09-10T00:50:25.095415+00:00 https://vulnerability.circl.lu/sighting/27b89961-cd9f-4a99-ad75-a52a0381c76e/export 2026-09-10T20:00:40.047122+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "27b89961-cd9f-4a99-ad75-a52a0381c76e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "Telegram/j0PsdiAJ2pcbJR995Thb3rfk0dWAfkhfh9U9VXIxLqzuXI0", "content": "", "creation_timestamp": "2026-09-10T00:00:41.137122Z"} 2026-09-10T00:00:41.137122+00:00 https://vulnerability.circl.lu/sighting/f0a66811-0e58-47fd-9812-c38a604f97bd/export 2026-09-10T20:00:40.047302+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f0a66811-0e58-47fd-9812-c38a604f97bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/thehackernews/10009", "content": "\u203c\ufe0fWarning: New CVE-2026-67401 vulnerability in cPanel lets mail-privileged hosting accounts execute code as root.\n\ncPanel says every supported cPanel & WHM version is affected and has released fixed builds.\n\nRead details here: https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html", "creation_timestamp": "2026-09-10T00:00:41.054563Z"} 2026-09-10T00:00:41.054563+00:00 https://vulnerability.circl.lu/sighting/de1fb972-c55f-4d55-9542-fe81a15a2b72/export 2026-09-10T20:00:40.047494+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "de1fb972-c55f-4d55-9542-fe81a15a2b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101805", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67401\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a axedos\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-09 10:46:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npoc in python for CVE-2026-67401\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T00:00:39.017366Z"} 2026-09-10T00:00:39.017366+00:00 https://vulnerability.circl.lu/sighting/ed25ef89-53f1-4cd6-b721-8b34d857fb04/export 2026-09-10T20:00:40.047782+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ed25ef89-53f1-4cd6-b721-8b34d857fb04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/pphm_HackerNews/3072", "content": "\ud83d\udd34 New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root\n\ncPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.\n\ncPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.\n\nThe flaw is tracked as CVE-2026-67401. cPanel's advisory calls it an SQL injection issue in EmailTrack, but does not say which cPanel feature or privilege an account needs. cPanel's developer documentation lists an EmailTrack module that tracks email statistics, and the advisory does not say whether that is the affected code.", "creation_timestamp": "2026-09-10T00:00:12.645123Z"} 2026-09-10T00:00:12.645123+00:00 https://vulnerability.circl.lu/sighting/a6557688-6486-4504-a934-7f75ab459a00/export 2026-09-10T20:00:40.047969+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a6557688-6486-4504-a934-7f75ab459a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "Telegram/2B9_v_2pPAWOaIEdbs03TiOUAV4_o2Ur3L3sHegl_ON7Vwc", "content": "", "creation_timestamp": "2026-09-10T00:00:08.830120Z"} 2026-09-10T00:00:08.830120+00:00 https://vulnerability.circl.lu/sighting/ab94f545-ab85-4398-b406-a8a51341c71b/export 2026-09-10T20:00:40.048183+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ab94f545-ab85-4398-b406-a8a51341c71b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "Telegram/2B9_v_2pPAWOaIEdbs03TiOUAV4_o2Ur3L3sHegl_ON7Vwc", "content": "", "creation_timestamp": "2026-09-09T23:00:04.933157Z"} 2026-09-09T23:00:04.933157+00:00