https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 21 Sep 2026 11:53:30 +0000 https://vulnerability.circl.lu/sighting/d440da5d-0a34-4a37-9295-07871718d701/export {"uuid": "d440da5d-0a34-4a37-9295-07871718d701", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "seen", "source": "https://gist.github.com/ichintu/c58741083d468fc238c83dced24e080a", "content": "Here is a concise threat intelligence summary:\n\n**Date:** September 20, 2026 \n**Overview:** Two critical vulnerabilities were disclosed, both with publicly available exploits requiring immediate remediation.\n\n\u2022 **CVE-2026-94089 | D-Link DIR-868L (Firmware 2.01b05) | Severity: 10.0 (CRITICAL)** \nA stack-based buffer overflow in the authentication CGI handler (`webfa_authentication.cgi`) caused by unsafe `strcpy` usage. Attackers can remotely exploit this via manipulated `id/password` parameters. Public exploits are available.\n\n\u2022 **CVE-2026-88854 | OrdaSoft Joomla Gallery (Joomla < 6.2.7) | Severity: 9.3 (CRITICAL)** \nAn unauthenticated SQL injection in the search functionality (`showSearchResult`/`Ajax` functions) due to insufficient input sanitization. Allows anonymous attackers to inject `UNION SELECT` statements and extract arbitrary database contents. Publicly exploitable.\n\n**Recommendation:** Apply vendor patches immediately, restrict exposure of affected endpoints, and monitor for exploitation activity given the critical severity and public exploit availability.", "creation_timestamp": "2026-09-21T00:50:31.888169Z"} {"uuid": "d440da5d-0a34-4a37-9295-07871718d701", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "seen", "source": "https://gist.github.com/ichintu/c58741083d468fc238c83dced24e080a", "content": "Here is a concise threat intelligence summary:\n\n**Date:** September 20, 2026 \n**Overview:** Two critical vulnerabilities were disclosed, both with publicly available exploits requiring immediate remediation.\n\n\u2022 **CVE-2026-94089 | D-Link DIR-868L (Firmware 2.01b05) | Severity: 10.0 (CRITICAL)** \nA stack-based buffer overflow in the authentication CGI handler (`webfa_authentication.cgi`) caused by unsafe `strcpy` usage. Attackers can remotely exploit this via manipulated `id/password` parameters. Public exploits are available.\n\n\u2022 **CVE-2026-88854 | OrdaSoft Joomla Gallery (Joomla < 6.2.7) | Severity: 9.3 (CRITICAL)** \nAn unauthenticated SQL injection in the search functionality (`showSearchResult`/`Ajax` functions) due to insufficient input sanitization. Allows anonymous attackers to inject `UNION SELECT` statements and extract arbitrary database contents. Publicly exploitable.\n\n**Recommendation:** Apply vendor patches immediately, restrict exposure of affected endpoints, and monitor for exploitation activity given the critical severity and public exploit availability.", "creation_timestamp": "2026-09-21T00:50:31.888169Z"} https://vulnerability.circl.lu/sighting/d440da5d-0a34-4a37-9295-07871718d701/export Mon, 21 Sep 2026 00:50:31 +0000 https://vulnerability.circl.lu/sighting/a0434627-4fab-483e-8e97-d449350926d4/export {"uuid": "a0434627-4fab-483e-8e97-d449350926d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102907", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88854\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-20 19:01:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88854 \u2014 OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-21T00:00:04.267210Z"} {"uuid": "a0434627-4fab-483e-8e97-d449350926d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102907", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88854\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-20 19:01:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88854 \u2014 OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-21T00:00:04.267210Z"} https://vulnerability.circl.lu/sighting/a0434627-4fab-483e-8e97-d449350926d4/export Mon, 21 Sep 2026 00:00:04 +0000 https://vulnerability.circl.lu/sighting/e17ad50b-9db5-4c87-ac34-db56ddab6e96/export {"uuid": "e17ad50b-9db5-4c87-ac34-db56ddab6e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102907", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88854\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-20 19:01:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88854 \u2014 OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-20T22:00:04.789443Z"} {"uuid": "e17ad50b-9db5-4c87-ac34-db56ddab6e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102907", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88854\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-20 19:01:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88854 \u2014 OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-20T22:00:04.789443Z"} https://vulnerability.circl.lu/sighting/e17ad50b-9db5-4c87-ac34-db56ddab6e96/export Sun, 20 Sep 2026 22:00:04 +0000 https://vulnerability.circl.lu/sighting/d6bb225c-0e0a-48fc-8bb0-faed00a33e0e/export {"uuid": "d6bb225c-0e0a-48fc-8bb0-faed00a33e0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvxtdehy4v2w", "content": "CVE-2026-88854 - ordasoft joomla gallery free extension for joomla\nThe free OrdaSoft Joomla Gallery extension for Joomla (versions before 6.2.7) lets any visitor use the public search box to run their own database queries.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-20T18:30:07.958156Z"} {"uuid": "d6bb225c-0e0a-48fc-8bb0-faed00a33e0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88854", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvxtdehy4v2w", "content": "CVE-2026-88854 - ordasoft joomla gallery free extension for joomla\nThe free OrdaSoft Joomla Gallery extension for Joomla (versions before 6.2.7) lets any visitor use the public search box to run their own database queries.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-20T18:30:07.958156Z"} https://vulnerability.circl.lu/sighting/d6bb225c-0e0a-48fc-8bb0-faed00a33e0e/export Sun, 20 Sep 2026 18:30:07 +0000