https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 18:01:30 +0000 https://vulnerability.circl.lu/sighting/1713effe-2751-4177-812c-d77dce37a57e/export {"uuid": "1713effe-2751-4177-812c-d77dce37a57e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://gist.github.com/ichintu/6579574f2d6f7759d85ca961b532236a", "content": "This cybersecurity briefing highlights three primary trends:\n\n\u2022 **AI & Agent Security:** New platforms (ELITZE, Exaforce) focus on governing AI agent identities, permissions, and runtime access. Researchers also demonstrate OpenAI Codex sandbox escapes and note AI-accelerated exploitation (e.g., Marimo RCE compromising an SSH bastion in seconds).\n\u2022 **Active Threats & Vulnerabilities:** Attackers are mass-scanning exposed Vite development servers to harvest cloud credentials (exploiting CVE-2026-39364). Critical unauthenticated flaws were disclosed for TrxTimeATTENDANCE (RCE, CVE-2026-89308) and OpenAM (SOAP auth bypass, CVE-2026-45052). Additionally, the BambooToken malware continues targeting Windows/Linux systems via MQTT.\n\u2022 **Community & Tools:** Practitioners are sharing practical resources, including a verification tool for leaked cloud secrets and a low-cost guide to entering the EMFI hacking competition.\n\n**Overall:** The threat landscape is increasingly defined by AI workload governance challenges, automated credential harvesting from misconfigured dev servers, and rapidly exploited critical vulnerabilities.", "creation_timestamp": "2026-09-15T16:01:41.028250Z"} {"uuid": "1713effe-2751-4177-812c-d77dce37a57e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://gist.github.com/ichintu/6579574f2d6f7759d85ca961b532236a", "content": "This cybersecurity briefing highlights three primary trends:\n\n\u2022 **AI & Agent Security:** New platforms (ELITZE, Exaforce) focus on governing AI agent identities, permissions, and runtime access. Researchers also demonstrate OpenAI Codex sandbox escapes and note AI-accelerated exploitation (e.g., Marimo RCE compromising an SSH bastion in seconds).\n\u2022 **Active Threats & Vulnerabilities:** Attackers are mass-scanning exposed Vite development servers to harvest cloud credentials (exploiting CVE-2026-39364). Critical unauthenticated flaws were disclosed for TrxTimeATTENDANCE (RCE, CVE-2026-89308) and OpenAM (SOAP auth bypass, CVE-2026-45052). Additionally, the BambooToken malware continues targeting Windows/Linux systems via MQTT.\n\u2022 **Community & Tools:** Practitioners are sharing practical resources, including a verification tool for leaked cloud secrets and a low-cost guide to entering the EMFI hacking competition.\n\n**Overall:** The threat landscape is increasingly defined by AI workload governance challenges, automated credential harvesting from misconfigured dev servers, and rapidly exploited critical vulnerabilities.", "creation_timestamp": "2026-09-15T16:01:41.028250Z"} https://vulnerability.circl.lu/sighting/1713effe-2751-4177-812c-d77dce37a57e/export Tue, 15 Sep 2026 16:01:41 +0000 https://vulnerability.circl.lu/sighting/e20a2829-849f-41fe-b7fd-f4406ee52408/export {"uuid": "e20a2829-849f-41fe-b7fd-f4406ee52408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvklmb5fi32g", "content": "\ud83d\udea8 CVE-2026-45052 \u2014 CVSS 9.3 CRITICAL\n\nOpen Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-45052\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:07:20.011181Z"} {"uuid": "e20a2829-849f-41fe-b7fd-f4406ee52408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvklmb5fi32g", "content": "\ud83d\udea8 CVE-2026-45052 \u2014 CVSS 9.3 CRITICAL\n\nOpen Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-45052\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:07:20.011181Z"} https://vulnerability.circl.lu/sighting/e20a2829-849f-41fe-b7fd-f4406ee52408/export Tue, 15 Sep 2026 12:07:20 +0000 https://vulnerability.circl.lu/sighting/c248db7a-c3c4-416d-9537-7b519a05895a/export {"uuid": "c248db7a-c3c4-416d-9537-7b519a05895a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2lbrim24", "content": "CVE-2026-45052 - org.openidentityplatform.openam:openam-federation-library\nOpenAM Community Edition versions 16.0.6 and below have a vulnerability that allows an unauthenticated attacker to modify\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openidentityplatform #Java #CVE #infosec", "creation_timestamp": "2026-09-15T10:10:04.601899Z"} {"uuid": "c248db7a-c3c4-416d-9537-7b519a05895a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45052", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2lbrim24", "content": "CVE-2026-45052 - org.openidentityplatform.openam:openam-federation-library\nOpenAM Community Edition versions 16.0.6 and below have a vulnerability that allows an unauthenticated attacker to modify\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openidentityplatform #Java #CVE #infosec", "creation_timestamp": "2026-09-15T10:10:04.601899Z"} https://vulnerability.circl.lu/sighting/c248db7a-c3c4-416d-9537-7b519a05895a/export Tue, 15 Sep 2026 10:10:04 +0000