https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 13:12:29 +0000 https://vulnerability.circl.lu/sighting/b43c0038-3285-45e0-bc75-10d1a8f8b09d/export {"uuid": "b43c0038-3285-45e0-bc75-10d1a8f8b09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81642", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvmvfkea2b2n", "content": "\ud83d\udea8 CVE-2026-81642 \u2014 CVSS 9.1 CRITICAL\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that en...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-81642\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-16T10:07:51.676414Z"} {"uuid": "b43c0038-3285-45e0-bc75-10d1a8f8b09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81642", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvmvfkea2b2n", "content": "\ud83d\udea8 CVE-2026-81642 \u2014 CVSS 9.1 CRITICAL\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that en...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-81642\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-16T10:07:51.676414Z"} https://vulnerability.circl.lu/sighting/b43c0038-3285-45e0-bc75-10d1a8f8b09d/export Wed, 16 Sep 2026 10:07:51 +0000 https://vulnerability.circl.lu/sighting/caadd52c-58aa-4401-945b-5b88cf50fb10/export {"uuid": "caadd52c-58aa-4401-945b-5b88cf50fb10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81642", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmttwtrb52t", "content": "CVE-2026-81642 - unbound\nUnbound versions up to 1.26.0 can mishandle specially crafted DNSSEC keys, causing the program to stop working or potentially run attacker code. An attacker who controls a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unbound #nlnetlabs #CVE #infosec", "creation_timestamp": "2026-09-16T09:40:07.176752Z"} {"uuid": "caadd52c-58aa-4401-945b-5b88cf50fb10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81642", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmttwtrb52t", "content": "CVE-2026-81642 - unbound\nUnbound versions up to 1.26.0 can mishandle specially crafted DNSSEC keys, causing the program to stop working or potentially run attacker code. An attacker who controls a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unbound #nlnetlabs #CVE #infosec", "creation_timestamp": "2026-09-16T09:40:07.176752Z"} https://vulnerability.circl.lu/sighting/caadd52c-58aa-4401-945b-5b88cf50fb10/export Wed, 16 Sep 2026 09:40:07 +0000 https://vulnerability.circl.lu/sighting/23f04d8e-a2fd-4081-8291-5ff62c68bcbf/export {"uuid": "23f04d8e-a2fd-4081-8291-5ff62c68bcbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-81642", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvmrn45c3b2a", "content": "CRITICAL heap-based buffer overflow in NLnet Labs Unbound (\u22641.26.0) risks RCE via DNSSEC validator. Update to 1.26.1+ immediately. More info: https://radar.offseq.com/threat/cve-2026-81642-cwe-122-heap-based-buffer-overflow-in-nlnet-labs-unbound-2ab04cc5a0313c65 #OffSeq #Unbound #Security", "creation_timestamp": "2026-09-16T09:00:32.265036Z"} {"uuid": "23f04d8e-a2fd-4081-8291-5ff62c68bcbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-81642", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvmrn45c3b2a", "content": "CRITICAL heap-based buffer overflow in NLnet Labs Unbound (\u22641.26.0) risks RCE via DNSSEC validator. Update to 1.26.1+ immediately. More info: https://radar.offseq.com/threat/cve-2026-81642-cwe-122-heap-based-buffer-overflow-in-nlnet-labs-unbound-2ab04cc5a0313c65 #OffSeq #Unbound #Security", "creation_timestamp": "2026-09-16T09:00:32.265036Z"} https://vulnerability.circl.lu/sighting/23f04d8e-a2fd-4081-8291-5ff62c68bcbf/export Wed, 16 Sep 2026 09:00:32 +0000 https://vulnerability.circl.lu/sighting/b9d41052-54ba-4a7b-9f1c-d9ef45a7cb46/export {"uuid": "b9d41052-54ba-4a7b-9f1c-d9ef45a7cb46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-81642", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117279898097004138", "content": "CVE-2026-81642: CRITICAL heap buffer overflow in NLnet Labs Unbound \u22641.26.0. Exploitable via DNSKEY with owner compression pointer \u2014 possible DoS & RCE. Patch ASAP. https://radar.offseq.com/threat/cve-2026-81642-cwe-122-heap-based-buffer-overflow-in-nlnet-labs-unbound-2ab04cc5a0313c65 #OffSeq #DNS #Unbound #Vuln #RCE", "creation_timestamp": "2026-09-16T09:00:27.088673Z"} {"uuid": "b9d41052-54ba-4a7b-9f1c-d9ef45a7cb46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-81642", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117279898097004138", "content": "CVE-2026-81642: CRITICAL heap buffer overflow in NLnet Labs Unbound \u22641.26.0. Exploitable via DNSKEY with owner compression pointer \u2014 possible DoS & RCE. Patch ASAP. https://radar.offseq.com/threat/cve-2026-81642-cwe-122-heap-based-buffer-overflow-in-nlnet-labs-unbound-2ab04cc5a0313c65 #OffSeq #DNS #Unbound #Vuln #RCE", "creation_timestamp": "2026-09-16T09:00:27.088673Z"} https://vulnerability.circl.lu/sighting/b9d41052-54ba-4a7b-9f1c-d9ef45a7cb46/export Wed, 16 Sep 2026 09:00:27 +0000 https://vulnerability.circl.lu/sighting/ba5afb7c-0e01-4458-af46-8e6336a9c43b/export {"uuid": "ba5afb7c-0e01-4458-af46-8e6336a9c43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n live-target evidence per report.\n\n\n{\n \"date\": \"2026-09-15\",\n \"count\": 3,\n \"redacted\": true,\n \"items\": [\n {\n \"cve\": \"CVE-2026-81648\",\n \"cvss\": 10.0,\n \"published\": \"2026-09-13T21:17:01.930\",\n \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90519\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:27.697\",\n \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90520\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:28.760\",\n \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n }\n ]\n}", "creation_timestamp": "2026-09-15T16:01:41.261926Z"} {"uuid": "ba5afb7c-0e01-4458-af46-8e6336a9c43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n live-target evidence per report.\n\n\n{\n \"date\": \"2026-09-15\",\n \"count\": 3,\n \"redacted\": true,\n \"items\": [\n {\n \"cve\": \"CVE-2026-81648\",\n \"cvss\": 10.0,\n \"published\": \"2026-09-13T21:17:01.930\",\n \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90519\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:27.697\",\n \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n },\n {\n \"cve\": \"CVE-2026-90520\",\n \"cvss\": 6.3,\n \"published\": \"2026-09-13T13:16:28.760\",\n \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n \"has_report\": true\n }\n ]\n}", "creation_timestamp": "2026-09-15T16:01:41.261926Z"} https://vulnerability.circl.lu/sighting/ba5afb7c-0e01-4458-af46-8e6336a9c43b/export Tue, 15 Sep 2026 16:01:41 +0000 https://vulnerability.circl.lu/sighting/d6851b24-6fe0-4e16-900c-c71c6bdd0fb7/export {"uuid": "d6851b24-6fe0-4e16-900c-c71c6bdd0fb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhdhhkufz2k", "content": "\ud83d\udd34 CVE-2026-81648 - Critical (10)\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization ch...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81648/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T05:03:31.392546Z"} {"uuid": "d6851b24-6fe0-4e16-900c-c71c6bdd0fb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhdhhkufz2k", "content": "\ud83d\udd34 CVE-2026-81648 - Critical (10)\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization ch...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81648/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T05:03:31.392546Z"} https://vulnerability.circl.lu/sighting/d6851b24-6fe0-4e16-900c-c71c6bdd0fb7/export Mon, 14 Sep 2026 05:03:31 +0000 https://vulnerability.circl.lu/sighting/f5c479f1-9cda-4a5f-ba40-69f296cf0857/export {"uuid": "f5c479f1-9cda-4a5f-ba40-69f296cf0857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvgm6wkgm52n", "content": "\ud83d\udea8 CVE-2026-81648 \u2014 CVSS 10 CRITICAL\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-81648\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T22:07:08.507580Z"} {"uuid": "f5c479f1-9cda-4a5f-ba40-69f296cf0857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvgm6wkgm52n", "content": "\ud83d\udea8 CVE-2026-81648 \u2014 CVSS 10 CRITICAL\n\nThe CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-81648\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T22:07:08.507580Z"} https://vulnerability.circl.lu/sighting/f5c479f1-9cda-4a5f-ba40-69f296cf0857/export Sun, 13 Sep 2026 22:07:08 +0000 https://vulnerability.circl.lu/sighting/a1b5bf8f-af4a-4c9d-8786-08012c26dc05/export {"uuid": "a1b5bf8f-af4a-4c9d-8786-08012c26dc05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvgih3sbms2b", "content": "CVE-2026-81648 - cryptopayment gateway\nVersions 1.2.1 through 1.2.2 of the CryptoPayment Gateway WordPress plugin do not verify who is making certain AJAX requests. This allows anyone on the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptopaymentgateway #unknown #CVE #infosec", "creation_timestamp": "2026-09-13T21:00:06.517026Z"} {"uuid": "a1b5bf8f-af4a-4c9d-8786-08012c26dc05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvgih3sbms2b", "content": "CVE-2026-81648 - cryptopayment gateway\nVersions 1.2.1 through 1.2.2 of the CryptoPayment Gateway WordPress plugin do not verify who is making certain AJAX requests. This allows anyone on the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptopaymentgateway #unknown #CVE #infosec", "creation_timestamp": "2026-09-13T21:00:06.517026Z"} https://vulnerability.circl.lu/sighting/a1b5bf8f-af4a-4c9d-8786-08012c26dc05/export Sun, 13 Sep 2026 21:00:06 +0000