https://vulnerability.circl.lu/sightings/feed 2026-09-10T22:18:11.734246+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/80954a4d-e05e-4199-bae1-f26de39945fa/export 2026-09-10T22:18:11.758152+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "80954a4d-e05e-4199-bae1-f26de39945fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://gist.github.com/alon710/c5bce716a2c740f354075cb003953b3f", "content": "# CVE-2026-84452: CVE-2026-84452: Localhost Remote Code Execution via CORS Misconfiguration in Windows ML CLI\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84452\n\n## Summary\nA critical vulnerability (CVE-2026-84452) in the Windows ML CLI (winml-cli) HTTP server component allows unauthenticated remote code execution via permissive CORS and lack of request validation.\n\n## TL;DR\nUnauthenticated remote code execution in winml-cli before 0.4.0 via CORS wildcard and lack of loopback verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-942, CWE-306\n- **Attack Vector**: Network (via Browser Cross-Origin Request)\n- **CVSS v4.0 Score**: 8.6\n- **EPSS Score**: 0.00945 (58.83rd percentile)\n- **Impact**: Remote Code Execution\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Windows ML CLI (winml-cli)\n- **winml-cli**: < 0.4.0 (Fixed in: `0.4.0`)\n\n## Mitigation\n\n- Upgrade to winml-cli 0.4.0 or higher\n- Implement browser Private Network Access controls\n- Shut down local dev servers when not in use\n\n**Remediation Steps:**\n1. Run pip install --upgrade winml-cli>=0.4.0\n2. Configure workstation firewall to block incoming external connections to localhost ports\n3. Enable PNA on enterprise browsers\n\n## References\n\n- [GitHub Security Advisory GHSA-96p9-rh4f-92cf](https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf)\n- [Microsoft Fix Commit f4073e0](https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993)\n- [GitHub Pull Request #1321](https://github.com/microsoft/winml-cli/pull/1321)\n- [National Vulnerability Database Record](https://nvd.nist.gov/vuln/detail/CVE-2026-84452)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-84452)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84452) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T09:33:16.652278Z"} 2026-09-09T09:33:16.652278+00:00 https://vulnerability.circl.lu/sighting/11e1bbae-9739-423e-8cca-d398b408a62b/export 2026-09-10T22:18:11.761250+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "11e1bbae-9739-423e-8cca-d398b408a62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv23paew7d22", "content": "CVE-2026-84452 - winml-cli\nVersions of Windows ML CLI before 0.4.0 open a local web service that anyone can talk to, even from a malicious website the user visits. That service lets the site tell the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#winmlcli #microsoft #pip #CVE #infosec", "creation_timestamp": "2026-09-08T22:40:04.820207Z"} 2026-09-08T22:40:04.820207+00:00 https://vulnerability.circl.lu/sighting/24637668-bac9-420b-a7a0-920ffa2db713/export 2026-09-10T22:18:11.761591+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "24637668-bac9-420b-a7a0-920ffa2db713", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84452", "type": "published-proof-of-concept", "source": "https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf", "content": "", "creation_timestamp": "2026-09-08T22:35:03.599238Z"} 2026-09-08T22:35:03.599238+00:00 https://vulnerability.circl.lu/sighting/38b9378c-5199-422a-a8ed-c2aee22cd64f/export 2026-09-10T22:18:11.762622+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "38b9378c-5199-422a-a8ed-c2aee22cd64f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2bv4axqgwkdl5", "content": "CVE-2026-84452 - Windows ML CLI Remote Code Execution Vulnerability\nCVE ID : CVE-2026-84452\n \n Published : Sept. 2, 2026, 8:17 p.m. | 19\u00a0minutes ago\n \n Description : Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows...", "creation_timestamp": "2026-09-02T22:14:27.710592Z"} 2026-09-02T22:14:27.710592+00:00