https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 22 Sep 2026 20:18:45 +0000 https://vulnerability.circl.lu/sighting/a00bcbc2-43ed-4495-97bd-281673a40728/export {"uuid": "a00bcbc2-43ed-4495-97bd-281673a40728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://gist.github.com/ichintu/85fb1e02960a0516578c312a9bf4f913", "content": "This September 21, 2026 threat intelligence digest highlights four critical vulnerabilities requiring immediate patching: **Joplin Server** (CVE-2026-46649) and **Warpgate** (CVE-2026-58491) contain unmitigated SSO flaws enabling credential brute-forcing and reflected XSS/open redirects, respectively; **Roundcube Webmail** (CVE-2026-48842) is actively exploited in the wild; and **Zyxel GS1900 switches** (CVE-2026-7273) feature a stack-based buffer overflow now listed in CISA\u2019s KEV database. Additionally, community reports suggest a potential compromise of the OWASP API Security page, while a weekly cyber warfare brief tracks state-aligned operations and references CVE-2026-76460/76461. Administrators are urged to prioritize updates to Joplin \u22653.7.2, Warpgate \u22650.25.5, Roundcube \u22651.6.16/1.7.1, and affected Zyxel firmware, while verifying third-party resource integrity.", "creation_timestamp": "2026-09-22T00:03:05.336072Z"} {"uuid": "a00bcbc2-43ed-4495-97bd-281673a40728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://gist.github.com/ichintu/85fb1e02960a0516578c312a9bf4f913", "content": "This September 21, 2026 threat intelligence digest highlights four critical vulnerabilities requiring immediate patching: **Joplin Server** (CVE-2026-46649) and **Warpgate** (CVE-2026-58491) contain unmitigated SSO flaws enabling credential brute-forcing and reflected XSS/open redirects, respectively; **Roundcube Webmail** (CVE-2026-48842) is actively exploited in the wild; and **Zyxel GS1900 switches** (CVE-2026-7273) feature a stack-based buffer overflow now listed in CISA\u2019s KEV database. Additionally, community reports suggest a potential compromise of the OWASP API Security page, while a weekly cyber warfare brief tracks state-aligned operations and references CVE-2026-76460/76461. Administrators are urged to prioritize updates to Joplin \u22653.7.2, Warpgate \u22650.25.5, Roundcube \u22651.6.16/1.7.1, and affected Zyxel firmware, while verifying third-party resource integrity.", "creation_timestamp": "2026-09-22T00:03:05.336072Z"} https://vulnerability.circl.lu/sighting/a00bcbc2-43ed-4495-97bd-281673a40728/export Tue, 22 Sep 2026 00:03:05 +0000 https://vulnerability.circl.lu/sighting/c2c904d5-62db-417e-89fa-d48ebb53f1c9/export {"uuid": "c2c904d5-62db-417e-89fa-d48ebb53f1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw2qnhqvnj2y", "content": "CVE-2026-46649 - joplin\nJoplin Server versions before 3.7.2 let anyone repeatedly try a nine\u2011digit single sign\u2011on code without any limit. If the correct code is guessed, the attacker receives a full session\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#joplin #laurent22 #CVE #infosec", "creation_timestamp": "2026-09-21T22:20:05.715340Z"} {"uuid": "c2c904d5-62db-417e-89fa-d48ebb53f1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw2qnhqvnj2y", "content": "CVE-2026-46649 - joplin\nJoplin Server versions before 3.7.2 let anyone repeatedly try a nine\u2011digit single sign\u2011on code without any limit. If the correct code is guessed, the attacker receives a full session\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#joplin #laurent22 #CVE #infosec", "creation_timestamp": "2026-09-21T22:20:05.715340Z"} https://vulnerability.circl.lu/sighting/c2c904d5-62db-417e-89fa-d48ebb53f1c9/export Mon, 21 Sep 2026 22:20:05 +0000 https://vulnerability.circl.lu/sighting/058f0be5-7059-4cd3-9b1f-66484d5d9f0a/export {"uuid": "058f0be5-7059-4cd3-9b1f-66484d5d9f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw2pwrg2qz2g", "content": "\ud83d\udea8 CVE-2026-46649 \u2014 CVSS 9.1 CRITICAL\n\nJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-46649\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-21T22:07:23.459736Z"} {"uuid": "058f0be5-7059-4cd3-9b1f-66484d5d9f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw2pwrg2qz2g", "content": "\ud83d\udea8 CVE-2026-46649 \u2014 CVSS 9.1 CRITICAL\n\nJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-46649\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-21T22:07:23.459736Z"} https://vulnerability.circl.lu/sighting/058f0be5-7059-4cd3-9b1f-66484d5d9f0a/export Mon, 21 Sep 2026 22:07:23 +0000 https://vulnerability.circl.lu/sighting/6b9009cc-4a83-43b2-842c-1f3ad7901d17/export {"uuid": "6b9009cc-4a83-43b2-842c-1f3ad7901d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6edxc5mjk3766", "content": "CVE-2026-46649 - Joplin: SSO Auth Code Login Missing Rate Limiting \u2014 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint\nCVE ID : CVE-2026-46649\n \n Published : Sept. 21, 2026, 8:58 p.m. | 14\u00a0minutes ago\n \n Description : Joplin is an open source note-taking and to-do ...", "creation_timestamp": "2026-09-21T21:57:43.781026Z"} {"uuid": "6b9009cc-4a83-43b2-842c-1f3ad7901d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6edxc5mjk3766", "content": "CVE-2026-46649 - Joplin: SSO Auth Code Login Missing Rate Limiting \u2014 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint\nCVE ID : CVE-2026-46649\n \n Published : Sept. 21, 2026, 8:58 p.m. | 14\u00a0minutes ago\n \n Description : Joplin is an open source note-taking and to-do ...", "creation_timestamp": "2026-09-21T21:57:43.781026Z"} https://vulnerability.circl.lu/sighting/6b9009cc-4a83-43b2-842c-1f3ad7901d17/export Mon, 21 Sep 2026 21:57:43 +0000