https://vulnerability.circl.lu/sightings/feed 2026-09-27T14:03:46.831650+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/8b07fa55-b763-4048-b1f7-9828407ae297/export 2026-09-27T14:03:46.864119+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8b07fa55-b763-4048-b1f7-9828407ae297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24118", "type": "seen", "source": "https://t.me/shimiscyberworld/1179", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-24118 \u2014 CVSS 9.8\nVM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes Node.js Applications\n\nCVE-2026-24118 \u2014 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which\n\n\ud83d\udd34 Critical \u00b7 2 ATT&CK techniques mapped\n\n#cve #critical #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-24118 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:17.979587Z"} 2026-09-12T10:00:17.979587+00:00 https://vulnerability.circl.lu/sighting/ce2cbb78-0a46-41b1-a76a-0d879e7a6db5/export 2026-09-27T14:03:46.868400+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ce2cbb78-0a46-41b1-a76a-0d879e7a6db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24118", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:17.250379Z"} 2026-09-12T10:00:17.250379+00:00 https://vulnerability.circl.lu/sighting/08a32462-5d91-446b-82f1-c483536b0e0d/export 2026-09-27T14:03:46.868569+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "08a32462-5d91-446b-82f1-c483536b0e0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24118", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq74xqlwnh2v", "content": "CVE-2026-24118 - @rootio/vm2\nA security patch has been released for Root's VM2 package. This patch fixes a security issue that could have allowed unauthorized access to Root's systems. To stay secure, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-09T07:40:04.382995Z"} 2026-07-09T07:40:04.382995+00:00 https://vulnerability.circl.lu/sighting/3a1e408c-c9ae-42a8-a622-61cd1e91f6f7/export 2026-09-27T14:03:46.868681+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3a1e408c-c9ae-42a8-a622-61cd1e91f6f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24118", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mleotgqmgm2f", "content": "\ud83d\udccc CVE-2026-24118 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to wri... https://www.cyberhub.blog/cves/CVE-2026-24118", "creation_timestamp": "2026-05-08T21:37:07.763160Z"} 2026-05-08T21:37:07.763160+00:00 https://vulnerability.circl.lu/sighting/a41d179a-4e8d-4fef-be40-2c92ba04f5cf/export 2026-09-27T14:03:46.868782+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a41d179a-4e8d-4fef-be40-2c92ba04f5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24118", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2ckcncdj2k", "content": "\ud83d\udd34 CVE-2026-24118 - Critical (9.8)\n\nvm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-24118/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T18:30:39.581003Z"} 2026-05-04T18:30:39.581003+00:00 https://vulnerability.circl.lu/sighting/713f6a89-704e-46b1-8e4a-25475bb66060/export 2026-09-27T14:03:46.868879+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "713f6a89-704e-46b1-8e4a-25475bb66060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24118", "type": "seen", "source": "https://gist.github.com/alon710/e818aa393dda5bd140273420e0cde714", "content": "", "creation_timestamp": "2026-05-04T16:40:28.000000Z"} 2026-05-04T16:40:28+00:00 https://vulnerability.circl.lu/sighting/3ed9cc9d-61bb-4be3-8d84-d8c49a11391b/export 2026-09-27T14:03:46.868971+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "3ed9cc9d-61bb-4be3-8d84-d8c49a11391b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24117", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"} 2026-03-18T00:00:00+00:00 https://vulnerability.circl.lu/sighting/965a231e-98b2-4e26-9f62-69a668e74dce/export 2026-09-27T14:03:46.870145+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "965a231e-98b2-4e26-9f62-69a668e74dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24110", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg3tren3dj2o", "content": "", "creation_timestamp": "2026-03-02T18:05:31.053668Z"} 2026-03-02T18:05:31.053668+00:00 https://vulnerability.circl.lu/sighting/0d404615-fa5f-4b3a-9ae7-d57fe0bd56e9/export 2026-09-27T14:03:46.870257+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0d404615-fa5f-4b3a-9ae7-d57fe0bd56e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24113", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg3ngqnnyq2d", "content": "", "creation_timestamp": "2026-03-02T16:12:11.944638Z"} 2026-03-02T16:12:11.944638+00:00 https://vulnerability.circl.lu/sighting/eb9a74ee-10dc-4488-9909-e44b1ae97927/export 2026-09-27T14:03:46.870361+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "eb9a74ee-10dc-4488-9909-e44b1ae97927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24115", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg3n7zpghz2d", "content": "", "creation_timestamp": "2026-03-02T16:08:26.596976Z"} 2026-03-02T16:08:26.596976+00:00