https://vulnerability.circl.lu/sightings/feed 2026-09-28T12:38:14.069089+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4ef26116-11f4-40bc-8a5a-b09bc058ccc9/export 2026-09-28T12:38:14.082156+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4ef26116-11f4-40bc-8a5a-b09bc058ccc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-VCVR-R3JV-PC5J", "type": "seen", "source": "Telegram/casOb_urBwXkBUZvllR9Y1soseAr2u2g5tENUUxRQxBEAPw", "content": "", "creation_timestamp": "2026-09-24T03:00:06.000000Z"} 2026-09-24T03:00:06+00:00 https://vulnerability.circl.lu/sighting/663e61d5-76b8-4240-84d4-6bbedc5d278e/export 2026-09-28T12:38:14.085148+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "663e61d5-76b8-4240-84d4-6bbedc5d278e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-VCVR-R3JV-PC5J", "type": "seen", "source": "https://t.me/GithubRedTeam/103144", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94545-nextjs-og-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 14:52:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-94545 / GHSA-vcvr-r3jv-pc5j \u2014 Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T15:06:05.000000Z"} 2026-09-23T15:06:05+00:00 https://vulnerability.circl.lu/sighting/57099798-8403-49ae-a8b4-2f0277bf87a2/export 2026-09-28T12:38:14.085297+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "57099798-8403-49ae-a8b4-2f0277bf87a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-VCVR-R3JV-PC5J", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103144", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94545-nextjs-og-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 14:52:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-94545 / GHSA-vcvr-r3jv-pc5j \u2014 Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T15:06:05.000000Z"} 2026-09-23T15:06:05+00:00 https://vulnerability.circl.lu/sighting/e686dcb4-e08b-4c01-bb88-7d4f48035c2b/export 2026-09-28T12:38:14.085410+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e686dcb4-e08b-4c01-bb88-7d4f48035c2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vcvr-r3jv-pc5j", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mw4rj42j6x2t", "content": "Next.js v16.3.6 fixes GHSA-vcvr-r3jv-pc5j, a remote-code-execution flaw in next/og ImageResponse. Applications using that path need the patched release. #dev", "creation_timestamp": "2026-09-22T17:40:52.645627Z"} 2026-09-22T17:40:52.645627+00:00