https://vulnerability.circl.lu/sightings/feed 2026-09-26T17:50:25.297229+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/991d9db0-8327-4b3e-9d8c-1edfe712fd2c/export 2026-09-26T17:50:25.327264+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "991d9db0-8327-4b3e-9d8c-1edfe712fd2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100390", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgmmsx5hs2y", "content": "CVE-2026-100390 - zoraxy\nVersions 3.2.3 through 3.3.4 of Zoraxy do not correctly handle IPv6 addresses when processing the X-Forwarded-For header. This lets unauthenticated users send fake source IP\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zoraxy #tobychui #CVE #infosec", "creation_timestamp": "2026-09-26T15:40:04.995942Z"} 2026-09-26T15:40:04.995942+00:00 https://vulnerability.circl.lu/sighting/996bc84d-0ec9-4cb8-9958-b2d663a9323e/export 2026-09-26T17:50:25.330829+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "996bc84d-0ec9-4cb8-9958-b2d663a9323e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100390", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwf55kpllb2q", "content": "CRITICAL: tobychui zoraxy 3.2.3 \u2013 3.3.4 has auth bypass (CVE-2026-100390) via IPv6 X-Forwarded-For spoofing. Restrict IPv6 or avoid IP-based controls until patched. https://radar.offseq.com/threat/cve-2026-100390-authentication-bypass-by-spoofing-in-tobychui-zoraxy-92a9e1620a0f6d01 #OffSeq #CVE20...", "creation_timestamp": "2026-09-26T01:30:28.461261Z"} 2026-09-26T01:30:28.461261+00:00 https://vulnerability.circl.lu/sighting/a1b5c14a-4411-4219-b457-dd1343678a93/export 2026-09-26T17:50:25.330924+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a1b5c14a-4411-4219-b457-dd1343678a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100390", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117334751644153923", "content": "CRITICAL vuln: CVE-2026-100390 in tobychui zoraxy (3.2.3 \u2013 3.3.4). IPv6 parsing flaw lets attackers bypass IP-based controls via spoofed X-Forwarded-For headers. Restrict IPv6 or XFF reliance until patch. https://radar.offseq.com/threat/cve-2026-100390-authentication-bypass-by-spoofing-in-tobychui-zoraxy-92a9e1620a0f6d01 #OffSeq #CVE2026100390 #infosec", "creation_timestamp": "2026-09-26T01:30:25.870139Z"} 2026-09-26T01:30:25.870139+00:00 https://vulnerability.circl.lu/sighting/a34ab75c-dc34-488c-a526-2012c636c72d/export 2026-09-26T17:50:25.330995+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a34ab75c-dc34-488c-a526-2012c636c72d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100390", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4isgsiugxlflj", "content": "CVE-2026-100390 - Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6\nCVE ID : CVE-2026-100390\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteA...", "creation_timestamp": "2026-09-25T22:19:06.507838Z"} 2026-09-25T22:19:06.507838+00:00 https://vulnerability.circl.lu/sighting/a6249c83-ae5d-4f34-bada-dffc6662e5cf/export 2026-09-26T17:50:25.331057+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a6249c83-ae5d-4f34-bada-dffc6662e5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100390", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwert3tkyi2f", "content": "\ud83d\udea8 CVE-2026-100390 \u2014 CVSS 9.1 CRITICAL\n\nZoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when sett...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100390\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T22:07:45.316493Z"} 2026-09-25T22:07:45.316493+00:00