https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 07 Jul 2026 20:08:04 +0000 https://vulnerability.circl.lu/sighting/c2729baf-f62b-4f67-a0dd-d988d6ea66d1/export {"uuid": "c2729baf-f62b-4f67-a0dd-d988d6ea66d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mq35lpurkk2a", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score\u2026\n#hackernews #news", "creation_timestamp": "2026-07-07T17:40:35.826520Z"} {"uuid": "c2729baf-f62b-4f67-a0dd-d988d6ea66d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mq35lpurkk2a", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score\u2026\n#hackernews #news", "creation_timestamp": "2026-07-07T17:40:35.826520Z"} https://vulnerability.circl.lu/sighting/c2729baf-f62b-4f67-a0dd-d988d6ea66d1/export Tue, 07 Jul 2026 17:40:35 +0000 https://vulnerability.circl.lu/sighting/d6b43c8e-e4e1-4963-9c3c-4c189ad75d00/export {"uuid": "d6b43c8e-e4e1-4963-9c3c-4c189ad75d00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116879910895582885", "content": "\ud83d\udea8 Critical Gitea flaw CVE-2026-20896 is being probed in the wild\nResearchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.\nThe issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.\nThe vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container\u2019s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.\nGitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.\nSysdig says the first in-the-wild probing was seen 13 days after disclosure.\nObserved IP: 159[.]26[.]98[.]241", "creation_timestamp": "2026-07-07T17:38:26.634669Z"} {"uuid": "d6b43c8e-e4e1-4963-9c3c-4c189ad75d00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116879910895582885", "content": "\ud83d\udea8 Critical Gitea flaw CVE-2026-20896 is being probed in the wild\nResearchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.\nThe issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.\nThe vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container\u2019s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.\nGitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.\nSysdig says the first in-the-wild probing was seen 13 days after disclosure.\nObserved IP: 159[.]26[.]98[.]241", "creation_timestamp": "2026-07-07T17:38:26.634669Z"} https://vulnerability.circl.lu/sighting/d6b43c8e-e4e1-4963-9c3c-4c189ad75d00/export Tue, 07 Jul 2026 17:38:26 +0000 https://vulnerability.circl.lu/sighting/9e3c79cd-e3d2-4ffc-92eb-c3801c5cf498/export {"uuid": "9e3c79cd-e3d2-4ffc-92eb-c3801c5cf498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mq34u5qnff2h", "content": "Gitea\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u5b9f\u969b\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u308b\u2015\u2015\u7814\u7a76\u8005\u3089\u304c\u8b66\u544a\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u3089\u306f\u3001Gitea\u306e\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u8a8d\u8a3c\u6a5f\u69cb\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u30fc\u540d\u3092\u4e00\u3064\u6307\u5b9a\u3059\u308b\u3060\u3051\u3067\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u304b\u3089\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u4fb5\u5165\u3057\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u306fGitea\u306e\u516c\u5f0fDocker\u30a4\u30e1\u30fc\u30b8\u306b\u56fa\u6709\u306e\u3082\u306e\u3067\u3001CVE-2026-20896\uff08CVSS\u30b9\u30b3\u30a29.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c", "creation_timestamp": "2026-07-07T17:27:24.624022Z"} {"uuid": "9e3c79cd-e3d2-4ffc-92eb-c3801c5cf498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mq34u5qnff2h", "content": "Gitea\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u5b9f\u969b\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u308b\u2015\u2015\u7814\u7a76\u8005\u3089\u304c\u8b66\u544a\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u3089\u306f\u3001Gitea\u306e\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u8a8d\u8a3c\u6a5f\u69cb\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u30fc\u540d\u3092\u4e00\u3064\u6307\u5b9a\u3059\u308b\u3060\u3051\u3067\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u304b\u3089\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u4fb5\u5165\u3057\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u306fGitea\u306e\u516c\u5f0fDocker\u30a4\u30e1\u30fc\u30b8\u306b\u56fa\u6709\u306e\u3082\u306e\u3067\u3001CVE-2026-20896\uff08CVSS\u30b9\u30b3\u30a29.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c", "creation_timestamp": "2026-07-07T17:27:24.624022Z"} https://vulnerability.circl.lu/sighting/9e3c79cd-e3d2-4ffc-92eb-c3801c5cf498/export Tue, 07 Jul 2026 17:27:24 +0000 https://vulnerability.circl.lu/sighting/3193eb4a-e861-4e49-8dba-6e8ad0542c47/export {"uuid": "3193eb4a-e861-4e49-8dba-6e8ad0542c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mq2qiha23s25", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure reconbee.com/threat-actor...\n\n#cyberthreats #Giteadockerflaw #probe #cybersecurity #cyberattack", "creation_timestamp": "2026-07-07T13:46:10.900691Z"} {"uuid": "3193eb4a-e861-4e49-8dba-6e8ad0542c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mq2qiha23s25", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure reconbee.com/threat-actor...\n\n#cyberthreats #Giteadockerflaw #probe #cybersecurity #cyberattack", "creation_timestamp": "2026-07-07T13:46:10.900691Z"} https://vulnerability.circl.lu/sighting/3193eb4a-e861-4e49-8dba-6e8ad0542c47/export Tue, 07 Jul 2026 13:46:10 +0000 https://vulnerability.circl.lu/sighting/dbafe40f-a96f-4d80-81df-4189c9b6c725/export {"uuid": "dbafe40f-a96f-4d80-81df-4189c9b6c725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mpzpr7kl4q2m", "content": "Gitea Docker flaw CVE-2026-20896: attackers probe the patched issue quickly. Defenders should upgrade Gitea images to the fixed version and verify X-WEBAUTH handling. #Cybersecurity #Vulnerability #ThreatIntel\n\nSource: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-07T04:00:27.815740Z"} {"uuid": "dbafe40f-a96f-4d80-81df-4189c9b6c725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mpzpr7kl4q2m", "content": "Gitea Docker flaw CVE-2026-20896: attackers probe the patched issue quickly. Defenders should upgrade Gitea images to the fixed version and verify X-WEBAUTH handling. #Cybersecurity #Vulnerability #ThreatIntel\n\nSource: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-07T04:00:27.815740Z"} https://vulnerability.circl.lu/sighting/dbafe40f-a96f-4d80-81df-4189c9b6c725/export Tue, 07 Jul 2026 04:00:27 +0000 https://vulnerability.circl.lu/sighting/1bc2b1c3-4021-48c1-81f4-1f5925d95b45/export {"uuid": "1bc2b1c3-4021-48c1-81f4-1f5925d95b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mpzou6injh2q", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-07-07T03:44:13.678490Z"} {"uuid": "1bc2b1c3-4021-48c1-81f4-1f5925d95b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mpzou6injh2q", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-07-07T03:44:13.678490Z"} https://vulnerability.circl.lu/sighting/1bc2b1c3-4021-48c1-81f4-1f5925d95b45/export Tue, 07 Jul 2026 03:44:13 +0000 https://vulnerability.circl.lu/sighting/edc88acb-c4b1-4793-8ca2-9c6b63781557/export {"uuid": "edc88acb-c4b1-4793-8ca2-9c6b63781557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "content": "Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the \"X-WEBAUTH-USER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated", "creation_timestamp": "2026-07-07T01:00:43.011535Z"} {"uuid": "edc88acb-c4b1-4793-8ca2-9c6b63781557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "content": "Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the \"X-WEBAUTH-USER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated", "creation_timestamp": "2026-07-07T01:00:43.011535Z"} https://vulnerability.circl.lu/sighting/edc88acb-c4b1-4793-8ca2-9c6b63781557/export Tue, 07 Jul 2026 01:00:43 +0000 https://vulnerability.circl.lu/sighting/479f1e17-4c9f-4a4b-bf6c-1ebddbb13dee/export {"uuid": "479f1e17-4c9f-4a4b-bf6c-1ebddbb13dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mpz4ri2krg2b", "content": "\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304cGitea\u306eDocker\u8106\u5f31\u6027CVE-2026-20896\u3092\u8abf\u67fb\uff08\u516c\u958b\u304b\u308913\u65e5\u5f8c\uff09 \n\nThreat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure #HackerNews (Jul 6)\n\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T22:20:36.242482Z"} {"uuid": "479f1e17-4c9f-4a4b-bf6c-1ebddbb13dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mpz4ri2krg2b", "content": "\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304cGitea\u306eDocker\u8106\u5f31\u6027CVE-2026-20896\u3092\u8abf\u67fb\uff08\u516c\u958b\u304b\u308913\u65e5\u5f8c\uff09 \n\nThreat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure #HackerNews (Jul 6)\n\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T22:20:36.242482Z"} https://vulnerability.circl.lu/sighting/479f1e17-4c9f-4a4b-bf6c-1ebddbb13dee/export Mon, 06 Jul 2026 22:20:36 +0000 https://vulnerability.circl.lu/sighting/53b1c07f-c037-4bc5-9e60-10dbd0b30767/export {"uuid": "53b1c07f-c037-4bc5-9e60-10dbd0b30767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mpz3q4byjv2l", "content": "\ud83d\udcf0 Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker i...\n\nhttps://tinyurl.com/2demjwlz #TechNews #CrustyTLDR", "creation_timestamp": "2026-07-06T22:01:55.624608Z"} {"uuid": "53b1c07f-c037-4bc5-9e60-10dbd0b30767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mpz3q4byjv2l", "content": "\ud83d\udcf0 Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker i...\n\nhttps://tinyurl.com/2demjwlz #TechNews #CrustyTLDR", "creation_timestamp": "2026-07-06T22:01:55.624608Z"} https://vulnerability.circl.lu/sighting/53b1c07f-c037-4bc5-9e60-10dbd0b30767/export Mon, 06 Jul 2026 22:01:55 +0000 https://vulnerability.circl.lu/sighting/5c53ee2a-dc3c-45fb-a90c-37c2fe9d82dd/export {"uuid": "5c53ee2a-dc3c-45fb-a90c-37c2fe9d82dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/sleepydogtsjp.bsky.social/post/3mpz2kitryc2r", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T21:40:55.805381Z"} {"uuid": "5c53ee2a-dc3c-45fb-a90c-37c2fe9d82dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/sleepydogtsjp.bsky.social/post/3mpz2kitryc2r", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T21:40:55.805381Z"} https://vulnerability.circl.lu/sighting/5c53ee2a-dc3c-45fb-a90c-37c2fe9d82dd/export Mon, 06 Jul 2026 21:40:55 +0000