https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 09:01:47 +0000 https://vulnerability.circl.lu/sighting/b8f2b7b4-1ad6-43dd-b3f2-69ae66e032a9/export {"uuid": "b8f2b7b4-1ad6-43dd-b3f2-69ae66e032a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32432", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102522", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2025-32432-exploit-by-P34NUT\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a P34NUT2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 23:32:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA exploit to obtain RCE in CRAFTCMS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-17T01:00:02.996107Z"} {"uuid": "b8f2b7b4-1ad6-43dd-b3f2-69ae66e032a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32432", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102522", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2025-32432-exploit-by-P34NUT\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a P34NUT2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 23:32:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA exploit to obtain RCE in CRAFTCMS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-17T01:00:02.996107Z"} https://vulnerability.circl.lu/sighting/b8f2b7b4-1ad6-43dd-b3f2-69ae66e032a9/export Thu, 17 Sep 2026 01:00:02 +0000 https://vulnerability.circl.lu/sighting/01bf1bd0-730d-49ae-a3d1-58f7ae0a5ff4/export {"uuid": "01bf1bd0-730d-49ae-a3d1-58f7ae0a5ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mvniypzuabu2", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\n\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-16T15:58:51.398728Z"} {"uuid": "01bf1bd0-730d-49ae-a3d1-58f7ae0a5ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mvniypzuabu2", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\n\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-16T15:58:51.398728Z"} https://vulnerability.circl.lu/sighting/01bf1bd0-730d-49ae-a3d1-58f7ae0a5ff4/export Wed, 16 Sep 2026 15:58:51 +0000 https://vulnerability.circl.lu/sighting/5d953adb-194a-419d-b559-56f4a989c96d/export {"uuid": "5d953adb-194a-419d-b559-56f4a989c96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117281541720935473", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts, both new to this brief series. The addresses behind them are the interesting part. Every one of them also carries a generic web crawling tag, roughly nine in ten collected environment files and enumerated WordPress installations, and about four in five requested repository configuration in the same window. Two hosting providers supply roughly 95% of those addresses, which means the source count measures how that traffic leaves those networks. A sweep of that shape reaches any exposed Langflow instance a general crawler touches.\nThe rest of the week concentrated the same way. Five of the ten highest-volume sources ran SSH enumeration and credential attacks from consumer broadband and mobile carrier networks, and four of them carried 36% of all alternative-port SSH crawling we observed. Two shared client fingerprints group those four across four separate networks, marking a common tool class. One address supplied more than half of all Remote Desktop crawling observed and three fifths of the credential attempts inside it.\nGreyNoise customers get the full weekly brief. Our public At The Edge one-page: https://www.greynoise.io/resources/at-the-edge-clear-091426", "creation_timestamp": "2026-09-16T15:58:27.030751Z"} {"uuid": "5d953adb-194a-419d-b559-56f4a989c96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117281541720935473", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts, both new to this brief series. The addresses behind them are the interesting part. Every one of them also carries a generic web crawling tag, roughly nine in ten collected environment files and enumerated WordPress installations, and about four in five requested repository configuration in the same window. Two hosting providers supply roughly 95% of those addresses, which means the source count measures how that traffic leaves those networks. A sweep of that shape reaches any exposed Langflow instance a general crawler touches.\nThe rest of the week concentrated the same way. Five of the ten highest-volume sources ran SSH enumeration and credential attacks from consumer broadband and mobile carrier networks, and four of them carried 36% of all alternative-port SSH crawling we observed. Two shared client fingerprints group those four across four separate networks, marking a common tool class. One address supplied more than half of all Remote Desktop crawling observed and three fifths of the credential attempts inside it.\nGreyNoise customers get the full weekly brief. Our public At The Edge one-page: https://www.greynoise.io/resources/at-the-edge-clear-091426", "creation_timestamp": "2026-09-16T15:58:27.030751Z"} https://vulnerability.circl.lu/sighting/5d953adb-194a-419d-b559-56f4a989c96d/export Wed, 16 Sep 2026 15:58:27 +0000 https://vulnerability.circl.lu/sighting/e1e57850-178f-409a-ad1e-aa1c981dba72/export {"uuid": "e1e57850-178f-409a-ad1e-aa1c981dba72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:15:09.345662Z"} {"uuid": "e1e57850-178f-409a-ad1e-aa1c981dba72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:15:09.345662Z"} https://vulnerability.circl.lu/sighting/e1e57850-178f-409a-ad1e-aa1c981dba72/export Wed, 16 Sep 2026 10:15:09 +0000 https://vulnerability.circl.lu/sighting/b0dea4c0-ee33-4af6-9f24-8cba64766085/export {"uuid": "b0dea4c0-ee33-4af6-9f24-8cba64766085", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-14)", "content": "", "creation_timestamp": "2026-09-15T10:15:08.866178Z"} {"uuid": "b0dea4c0-ee33-4af6-9f24-8cba64766085", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-14)", "content": "", "creation_timestamp": "2026-09-15T10:15:08.866178Z"} https://vulnerability.circl.lu/sighting/b0dea4c0-ee33-4af6-9f24-8cba64766085/export Tue, 15 Sep 2026 10:15:08 +0000 https://vulnerability.circl.lu/sighting/62a6d412-a8cd-45db-ab51-e282c0e7674c/export {"uuid": "62a6d412-a8cd-45db-ab51-e282c0e7674c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32709", "type": "seen", "source": "https://bsky.app/profile/kelleywilliams3565.bsky.social/post/3mvk726ox4k2h", "content": "CVE-2025-32709 Exploited in Targeted Windows Attacks\n\nCVE-2025-32709 is actively exploited to escalate privileges through AFD.sys, enabling attackers to gain administrative control. Strengthen Windows security, prioritize patching.\n \nRead the full threat analysis: www.ampcuscyber.com/shadowopsint...", "creation_timestamp": "2026-09-15T08:22:31.259975Z"} {"uuid": "62a6d412-a8cd-45db-ab51-e282c0e7674c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32709", "type": "seen", "source": "https://bsky.app/profile/kelleywilliams3565.bsky.social/post/3mvk726ox4k2h", "content": "CVE-2025-32709 Exploited in Targeted Windows Attacks\n\nCVE-2025-32709 is actively exploited to escalate privileges through AFD.sys, enabling attackers to gain administrative control. Strengthen Windows security, prioritize patching.\n \nRead the full threat analysis: www.ampcuscyber.com/shadowopsint...", "creation_timestamp": "2026-09-15T08:22:31.259975Z"} https://vulnerability.circl.lu/sighting/62a6d412-a8cd-45db-ab51-e282c0e7674c/export Tue, 15 Sep 2026 08:22:31 +0000 https://vulnerability.circl.lu/sighting/fa4cf8ad-2f5f-4f1e-ae74-2354c165669c/export {"uuid": "fa4cf8ad-2f5f-4f1e-ae74-2354c165669c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32433", "type": "published-proof-of-concept", "source": "Telegram/jSo3BLt_ji8WL8Jz_poAsvn5R_eNVyzlPYUOFO3u5_ByovA", "content": "", "creation_timestamp": "2026-09-15T00:00:25.472274Z"} {"uuid": "fa4cf8ad-2f5f-4f1e-ae74-2354c165669c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32433", "type": "published-proof-of-concept", "source": "Telegram/jSo3BLt_ji8WL8Jz_poAsvn5R_eNVyzlPYUOFO3u5_ByovA", "content": "", "creation_timestamp": "2026-09-15T00:00:25.472274Z"} https://vulnerability.circl.lu/sighting/fa4cf8ad-2f5f-4f1e-ae74-2354c165669c/export Tue, 15 Sep 2026 00:00:25 +0000 https://vulnerability.circl.lu/sighting/d112cc56-ed28-47a1-971b-99f3ddf1336b/export {"uuid": "d112cc56-ed28-47a1-971b-99f3ddf1336b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32969", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a3510f69-2783-44d2-8df5-a00080634c79", "content": "", "creation_timestamp": "2026-09-14T11:00:33.858818Z"} {"uuid": "d112cc56-ed28-47a1-971b-99f3ddf1336b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32969", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a3510f69-2783-44d2-8df5-a00080634c79", "content": "", "creation_timestamp": "2026-09-14T11:00:33.858818Z"} https://vulnerability.circl.lu/sighting/d112cc56-ed28-47a1-971b-99f3ddf1336b/export Mon, 14 Sep 2026 11:00:33 +0000 https://vulnerability.circl.lu/sighting/e7aa46a3-42bd-4200-9db8-1edb789d6c90/export {"uuid": "e7aa46a3-42bd-4200-9db8-1edb789d6c90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-13)", "content": "", "creation_timestamp": "2026-09-14T10:15:10.276398Z"} {"uuid": "e7aa46a3-42bd-4200-9db8-1edb789d6c90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3248", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-13)", "content": "", "creation_timestamp": "2026-09-14T10:15:10.276398Z"} https://vulnerability.circl.lu/sighting/e7aa46a3-42bd-4200-9db8-1edb789d6c90/export Mon, 14 Sep 2026 10:15:10 +0000 https://vulnerability.circl.lu/sighting/d633472a-bde5-42cc-a22b-f11ee8b4195b/export {"uuid": "d633472a-bde5-42cc-a22b-f11ee8b4195b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32433", "type": "seen", "source": "Telegram/jSo3BLt_ji8WL8Jz_poAsvn5R_eNVyzlPYUOFO3u5_ByovA", "content": "", "creation_timestamp": "2026-09-14T08:00:05.859219Z"} {"uuid": "d633472a-bde5-42cc-a22b-f11ee8b4195b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32433", "type": "seen", "source": "Telegram/jSo3BLt_ji8WL8Jz_poAsvn5R_eNVyzlPYUOFO3u5_ByovA", "content": "", "creation_timestamp": "2026-09-14T08:00:05.859219Z"} https://vulnerability.circl.lu/sighting/d633472a-bde5-42cc-a22b-f11ee8b4195b/export Mon, 14 Sep 2026 08:00:05 +0000