https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 00:20:50 +0000 https://vulnerability.circl.lu/sighting/6736a676-e0f4-4829-a908-e60de4ce02f7/export {"uuid": "6736a676-e0f4-4829-a908-e60de4ce02f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxk2yekknc2n", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-103071 \u00b7 1 person\n2. CVE-2026-104398 \u00b7 1 person\n3. CVE-2026-108161 \u00b7 1 person", "creation_timestamp": "2026-10-10T18:00:16.572132Z"} {"uuid": "6736a676-e0f4-4829-a908-e60de4ce02f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxk2yekknc2n", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-103071 \u00b7 1 person\n2. CVE-2026-104398 \u00b7 1 person\n3. CVE-2026-108161 \u00b7 1 person", "creation_timestamp": "2026-10-10T18:00:16.572132Z"} https://vulnerability.circl.lu/sighting/6736a676-e0f4-4829-a908-e60de4ce02f7/export Sat, 10 Oct 2026 18:00:16 +0000 https://vulnerability.circl.lu/sighting/7e207e1b-cb2a-4565-b13f-4b46d532fe86/export {"uuid": "7e207e1b-cb2a-4565-b13f-4b46d532fe86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxk2ajtrho2b", "content": "\ud83d\udfe0 CVE-2026-108161 - High (7.5)\n\nFusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::downlo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108161/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T17:46:56.358131Z"} {"uuid": "7e207e1b-cb2a-4565-b13f-4b46d532fe86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxk2ajtrho2b", "content": "\ud83d\udfe0 CVE-2026-108161 - High (7.5)\n\nFusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::downlo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108161/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T17:46:56.358131Z"} https://vulnerability.circl.lu/sighting/7e207e1b-cb2a-4565-b13f-4b46d532fe86/export Sat, 10 Oct 2026 17:46:56 +0000 https://vulnerability.circl.lu/sighting/74a33280-1a8f-47b4-8cc6-2e7bd8eb4a60/export {"uuid": "74a33280-1a8f-47b4-8cc6-2e7bd8eb4a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117416966589404042", "content": "CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108161https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776https://github.com/fusionpbx/fusionpbxhttps://www.vulncheck.com/advisories/fusionpbx-through-5.6.5-os-command-injection-via-caller-id-in-recording-zip-download#fusionpbx#CVE_2026_108161#bot", "creation_timestamp": "2026-10-10T13:58:46.856938Z"} {"uuid": "74a33280-1a8f-47b4-8cc6-2e7bd8eb4a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117416966589404042", "content": "CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108161https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776https://github.com/fusionpbx/fusionpbxhttps://www.vulncheck.com/advisories/fusionpbx-through-5.6.5-os-command-injection-via-caller-id-in-recording-zip-download#fusionpbx#CVE_2026_108161#bot", "creation_timestamp": "2026-10-10T13:58:46.856938Z"} https://vulnerability.circl.lu/sighting/74a33280-1a8f-47b4-8cc6-2e7bd8eb4a60/export Sat, 10 Oct 2026 13:58:46 +0000