https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 05 Jun 2026 13:16:27 +0000 https://vulnerability.circl.lu/sighting/24f20938-e098-4653-9c2b-aa68a76aa9ee/export {"uuid": "24f20938-e098-4653-9c2b-aa68a76aa9ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39808", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwum6ns2g", "content": "", "creation_timestamp": "2026-04-23T21:03:18.202498Z"} {"uuid": "24f20938-e098-4653-9c2b-aa68a76aa9ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39808", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwum6ns2g", "content": "", "creation_timestamp": "2026-04-23T21:03:18.202498Z"} https://vulnerability.circl.lu/sighting/24f20938-e098-4653-9c2b-aa68a76aa9ee/export Thu, 23 Apr 2026 21:03:18 +0000 https://vulnerability.circl.lu/sighting/d4ff56ee-111a-4779-93fb-074a5a309bf0/export {"uuid": "d4ff56ee-111a-4779-93fb-074a5a309bf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-39808", "type": "seen", "source": "https://www.cert.se/2026/04/cert-se-veckobrev-v17.html", "content": "", "creation_timestamp": "2026-04-24T06:30:00.000000Z"} {"uuid": "d4ff56ee-111a-4779-93fb-074a5a309bf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-39808", "type": "seen", "source": "https://www.cert.se/2026/04/cert-se-veckobrev-v17.html", "content": "", "creation_timestamp": "2026-04-24T06:30:00.000000Z"} https://vulnerability.circl.lu/sighting/d4ff56ee-111a-4779-93fb-074a5a309bf0/export Fri, 24 Apr 2026 06:30:00 +0000 https://vulnerability.circl.lu/sighting/c63ec3e8-88a2-48a8-be30-755655cc458c/export {"uuid": "c63ec3e8-88a2-48a8-be30-755655cc458c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39807", "type": "seen", "source": "https://gist.github.com/alon710/4ff6ed1a1dcb2ad425666d3faacd2bcb", "content": "# CVE-2026-39807: CVE-2026-39807: Transport-State Spoofing via Untrusted URI Scheme in Bandit HTTP Server\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39807\n\n## Summary\nThe Bandit HTTP server prior to version 1.11.0 contains a transport-state spoofing vulnerability. The application incorrectly prioritizes the client-supplied URI scheme over the verified transport-layer encryption status. This allows unauthenticated attackers to spoof the connection state as secure (HTTPS) over a plaintext connection, bypassing security middleware and exposing secure cookies.\n\n## TL;DR\nA logic flaw in the Bandit HTTP server allows attackers to forge the connection scheme. Sending an absolute-form HTTP request over a plaintext connection causes the server to treat the request as HTTPS, bypassing SSL redirects and leaking secure cookies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-807\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3\n- **EPSS Score**: 0.00018\n- **Impact**: Security feature bypass and confidentiality loss\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Bandit HTTP Server for Elixir\n- Elixir applications utilizing Plug.Conn via Bandit\n- Deployments exposing plaintext (non-TLS) HTTP ports\n- **bandit**: >= 1.0.0, < 1.11.0 (Fixed in: `1.11.0`)\n\n## Mitigation\n\n- Upgrade the bandit package to a patched version\n- Disable plaintext network listeners and enforce TLS termination at the application\n- Deploy a reverse proxy to sanitize absolute-form HTTP request targets\n\n**Remediation Steps:**\n1. Update the project's mix.exs file to require bandit version 1.11.0 or later.\n2. Execute `mix deps.get` and `mix compile` to pull and build the updated dependency.\n3. Audit production deployments to verify whether plaintext ports are unintentionally exposed.\n4. Test downstream application behavior to ensure secure cookies and Plug.SSL correctly evaluate the patched state.\n\n## References\n\n- [GitHub Security Advisory GHSA-375f-4r2h-f99j](https://github.com/mtrudel/bandit/security/advisories/GHSA-375f-4r2h-f99j)\n- [EEF CNA Advisory for CVE-2026-39807](https://cna.erlef.org/cves/CVE-2026-39807.html)\n- [Bandit Fix Commit 45feea20](https://github.com/mtrudel/bandit/commit/45feea20dea8af7ffd7245271107b695c040e667)\n- [OSV Record EEF-CVE-2026-39807](https://osv.dev/vulnerability/EEF-CVE-2026-39807)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39807) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T04:40:29.000000Z"} {"uuid": "c63ec3e8-88a2-48a8-be30-755655cc458c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39807", "type": "seen", "source": "https://gist.github.com/alon710/4ff6ed1a1dcb2ad425666d3faacd2bcb", "content": "# CVE-2026-39807: CVE-2026-39807: Transport-State Spoofing via Untrusted URI Scheme in Bandit HTTP Server\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39807\n\n## Summary\nThe Bandit HTTP server prior to version 1.11.0 contains a transport-state spoofing vulnerability. The application incorrectly prioritizes the client-supplied URI scheme over the verified transport-layer encryption status. This allows unauthenticated attackers to spoof the connection state as secure (HTTPS) over a plaintext connection, bypassing security middleware and exposing secure cookies.\n\n## TL;DR\nA logic flaw in the Bandit HTTP server allows attackers to forge the connection scheme. Sending an absolute-form HTTP request over a plaintext connection causes the server to treat the request as HTTPS, bypassing SSL redirects and leaking secure cookies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-807\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3\n- **EPSS Score**: 0.00018\n- **Impact**: Security feature bypass and confidentiality loss\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Bandit HTTP Server for Elixir\n- Elixir applications utilizing Plug.Conn via Bandit\n- Deployments exposing plaintext (non-TLS) HTTP ports\n- **bandit**: >= 1.0.0, < 1.11.0 (Fixed in: `1.11.0`)\n\n## Mitigation\n\n- Upgrade the bandit package to a patched version\n- Disable plaintext network listeners and enforce TLS termination at the application\n- Deploy a reverse proxy to sanitize absolute-form HTTP request targets\n\n**Remediation Steps:**\n1. Update the project's mix.exs file to require bandit version 1.11.0 or later.\n2. Execute `mix deps.get` and `mix compile` to pull and build the updated dependency.\n3. Audit production deployments to verify whether plaintext ports are unintentionally exposed.\n4. Test downstream application behavior to ensure secure cookies and Plug.SSL correctly evaluate the patched state.\n\n## References\n\n- [GitHub Security Advisory GHSA-375f-4r2h-f99j](https://github.com/mtrudel/bandit/security/advisories/GHSA-375f-4r2h-f99j)\n- [EEF CNA Advisory for CVE-2026-39807](https://cna.erlef.org/cves/CVE-2026-39807.html)\n- [Bandit Fix Commit 45feea20](https://github.com/mtrudel/bandit/commit/45feea20dea8af7ffd7245271107b695c040e667)\n- [OSV Record EEF-CVE-2026-39807](https://osv.dev/vulnerability/EEF-CVE-2026-39807)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39807) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T04:40:29.000000Z"} https://vulnerability.circl.lu/sighting/c63ec3e8-88a2-48a8-be30-755655cc458c/export Thu, 07 May 2026 04:40:29 +0000 https://vulnerability.circl.lu/sighting/8f6202e6-a943-4445-ba85-5b23dcab86d2/export {"uuid": "8f6202e6-a943-4445-ba85-5b23dcab86d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39805", "type": "seen", "source": "https://gist.github.com/alon710/536c02534caf441e3d6307e9b3c04050", "content": "# CVE-2026-39805: CVE-2026-39805: CL.CL HTTP Request Smuggling in Bandit Web Server\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39805\n\n## Summary\nThe Bandit HTTP server for Elixir versions prior to 1.11.0 fails to correctly process requests containing multiple Content-Length headers. This inconsistent interpretation creates a CL.CL HTTP request smuggling vulnerability when Bandit is deployed behind a reverse proxy that parses the headers differently. Attackers exploit this desynchronization to smuggle secondary HTTP requests past edge security controls.\n\n## TL;DR\nBandit < 1.11.0 accepts duplicate Content-Length headers and processes only the first one, violating RFC 9112. When deployed behind certain reverse proxies, this allows attackers to smuggle hidden HTTP requests to bypass frontend access controls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.3\n- **EPSS Score**: 0.00017 (4.03%)\n- **Impact**: Security Control Bypass\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Bandit (Elixir HTTP Server) < 1.11.0\n- **bandit**: < 1.11.0 (Fixed in: `1.11.0`)\n\n## Mitigation\n\n- Upgrade Bandit web server to version 1.11.0\n- Configure frontend proxies to reject requests with multiple Content-Length headers\n- Deploy WAF rules to detect and block malformed HTTP requests\n\n**Remediation Steps:**\n1. Modify mix.exs to require bandit version >= 1.11.0\n2. Run mix deps.get to update the application dependencies\n3. Recompile the application and deploy to the target environment\n4. Validate frontend proxy configurations to ensure strict RFC 9112 compliance\n\n## References\n\n- [GHSA-c67r-gc9j-2qf7 Security Advisory](https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7)\n- [Erlang Ecosystem Foundation CNA Notice](https://cna.erlef.org/cves/CVE-2026-39805.html)\n- [Bandit Fix Commit f2ca636eb6df385219957e8934e9fc6efa1630d1](https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1)\n- [OSV Entry for EEF-CVE-2026-39805](https://osv.dev/vulnerability/EEF-CVE-2026-39805)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39805) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T05:10:29.000000Z"} {"uuid": "8f6202e6-a943-4445-ba85-5b23dcab86d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39805", "type": "seen", "source": "https://gist.github.com/alon710/536c02534caf441e3d6307e9b3c04050", "content": "# CVE-2026-39805: CVE-2026-39805: CL.CL HTTP Request Smuggling in Bandit Web Server\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39805\n\n## Summary\nThe Bandit HTTP server for Elixir versions prior to 1.11.0 fails to correctly process requests containing multiple Content-Length headers. This inconsistent interpretation creates a CL.CL HTTP request smuggling vulnerability when Bandit is deployed behind a reverse proxy that parses the headers differently. Attackers exploit this desynchronization to smuggle secondary HTTP requests past edge security controls.\n\n## TL;DR\nBandit < 1.11.0 accepts duplicate Content-Length headers and processes only the first one, violating RFC 9112. When deployed behind certain reverse proxies, this allows attackers to smuggle hidden HTTP requests to bypass frontend access controls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.3\n- **EPSS Score**: 0.00017 (4.03%)\n- **Impact**: Security Control Bypass\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Bandit (Elixir HTTP Server) < 1.11.0\n- **bandit**: < 1.11.0 (Fixed in: `1.11.0`)\n\n## Mitigation\n\n- Upgrade Bandit web server to version 1.11.0\n- Configure frontend proxies to reject requests with multiple Content-Length headers\n- Deploy WAF rules to detect and block malformed HTTP requests\n\n**Remediation Steps:**\n1. Modify mix.exs to require bandit version >= 1.11.0\n2. Run mix deps.get to update the application dependencies\n3. Recompile the application and deploy to the target environment\n4. Validate frontend proxy configurations to ensure strict RFC 9112 compliance\n\n## References\n\n- [GHSA-c67r-gc9j-2qf7 Security Advisory](https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7)\n- [Erlang Ecosystem Foundation CNA Notice](https://cna.erlef.org/cves/CVE-2026-39805.html)\n- [Bandit Fix Commit f2ca636eb6df385219957e8934e9fc6efa1630d1](https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1)\n- [OSV Entry for EEF-CVE-2026-39805](https://osv.dev/vulnerability/EEF-CVE-2026-39805)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39805) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T05:10:29.000000Z"} https://vulnerability.circl.lu/sighting/8f6202e6-a943-4445-ba85-5b23dcab86d2/export Thu, 07 May 2026 05:10:29 +0000 https://vulnerability.circl.lu/sighting/1ae2f47b-8e0a-4e0e-b580-0bf5bf89e18a/export {"uuid": "1ae2f47b-8e0a-4e0e-b580-0bf5bf89e18a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39804", "type": "seen", "source": "https://gist.github.com/alon710/560a262a37ded8b644e3892d54c879bb", "content": "# CVE-2026-39804: CVE-2026-39804: Remote Code Execution and DoS via Bandit WebSocket Permessage-Deflate Resource Exhaustion\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39804\n\n## Summary\nCVE-2026-39804 is a critical resource exhaustion vulnerability (CWE-770) affecting the Bandit Elixir HTTP server. By exploiting unbounded DEFLATE decompression in WebSocket frames, an unauthenticated attacker can crash the Erlang VM (BEAM) via a highly compressed decompression bomb.\n\n## TL;DR\nUnauthenticated remote attackers can trigger a Denial of Service (OOM crash) in the Bandit web server by sending a highly compressed WebSocket frame, exhausting BEAM memory if `permessage-deflate` is enabled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (Remote)\n- **CVSS v4.0 Score**: 8.2 (High)\n- **EPSS Score**: 0.0004 (11.83%)\n- **Exploit Status**: Proof-of-Concept Available\n- **Impact**: Denial of Service (Node Crash)\n\n## Affected Systems\n\n- Bandit HTTP Server (mtrudel/bandit)\n- **bandit**: >= 0.5.9, < 1.11.0 (Fixed in: `1.11.0`)\n\n## Mitigation\n\n- Upgrade Bandit server to version 1.11.0 or newer.\n- Disable `permessage-deflate` compression globally by setting `compress: false` in the WebSocket adapter configuration.\n\n**Remediation Steps:**\n1. Update the `mix.exs` dependencies to require `{:bandit, \">= 1.11.0\"}`.\n2. Run `mix deps.get` and `mix deps.compile` to fetch and build the patched version.\n3. If patching is impossible, review calls to `WebSockAdapter.upgrade/4` and remove any `compress: true` options.\n4. Deploy the updated application and restart the BEAM node.\n5. Verify the remediation by monitoring application memory metrics when under WebSocket load.\n\n## References\n\n- [GHSA-frh3-6pv6-rc8j Advisory](https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j)\n- [CNA Advisory Entry](https://cna.erlef.org/cves/CVE-2026-39804.html)\n- [OSV Entry](https://osv.dev/vulnerability/EEF-CVE-2026-39804)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39804) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T06:10:29.000000Z"} {"uuid": "1ae2f47b-8e0a-4e0e-b580-0bf5bf89e18a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39804", "type": "seen", "source": "https://gist.github.com/alon710/560a262a37ded8b644e3892d54c879bb", "content": "# CVE-2026-39804: CVE-2026-39804: Remote Code Execution and DoS via Bandit WebSocket Permessage-Deflate Resource Exhaustion\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39804\n\n## Summary\nCVE-2026-39804 is a critical resource exhaustion vulnerability (CWE-770) affecting the Bandit Elixir HTTP server. By exploiting unbounded DEFLATE decompression in WebSocket frames, an unauthenticated attacker can crash the Erlang VM (BEAM) via a highly compressed decompression bomb.\n\n## TL;DR\nUnauthenticated remote attackers can trigger a Denial of Service (OOM crash) in the Bandit web server by sending a highly compressed WebSocket frame, exhausting BEAM memory if `permessage-deflate` is enabled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (Remote)\n- **CVSS v4.0 Score**: 8.2 (High)\n- **EPSS Score**: 0.0004 (11.83%)\n- **Exploit Status**: Proof-of-Concept Available\n- **Impact**: Denial of Service (Node Crash)\n\n## Affected Systems\n\n- Bandit HTTP Server (mtrudel/bandit)\n- **bandit**: >= 0.5.9, < 1.11.0 (Fixed in: `1.11.0`)\n\n## Mitigation\n\n- Upgrade Bandit server to version 1.11.0 or newer.\n- Disable `permessage-deflate` compression globally by setting `compress: false` in the WebSocket adapter configuration.\n\n**Remediation Steps:**\n1. Update the `mix.exs` dependencies to require `{:bandit, \">= 1.11.0\"}`.\n2. Run `mix deps.get` and `mix deps.compile` to fetch and build the patched version.\n3. If patching is impossible, review calls to `WebSockAdapter.upgrade/4` and remove any `compress: true` options.\n4. Deploy the updated application and restart the BEAM node.\n5. Verify the remediation by monitoring application memory metrics when under WebSocket load.\n\n## References\n\n- [GHSA-frh3-6pv6-rc8j Advisory](https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j)\n- [CNA Advisory Entry](https://cna.erlef.org/cves/CVE-2026-39804.html)\n- [OSV Entry](https://osv.dev/vulnerability/EEF-CVE-2026-39804)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39804) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T06:10:29.000000Z"} https://vulnerability.circl.lu/sighting/1ae2f47b-8e0a-4e0e-b580-0bf5bf89e18a/export Thu, 07 May 2026 06:10:29 +0000 https://vulnerability.circl.lu/sighting/ea491304-5954-4290-bb35-b61e4b01176f/export {"uuid": "ea491304-5954-4290-bb35-b61e4b01176f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-39803", "type": "published-proof-of-concept", "source": "https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2", "content": "", "creation_timestamp": "2026-05-13T13:31:14.000000Z"} {"uuid": "ea491304-5954-4290-bb35-b61e4b01176f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-39803", "type": "published-proof-of-concept", "source": "https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2", "content": "", "creation_timestamp": "2026-05-13T13:31:14.000000Z"} https://vulnerability.circl.lu/sighting/ea491304-5954-4290-bb35-b61e4b01176f/export Wed, 13 May 2026 13:31:14 +0000 https://vulnerability.circl.lu/sighting/4b05bbce-ea0f-442d-9052-c18faabf5e82/export {"uuid": "4b05bbce-ea0f-442d-9052-c18faabf5e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-39806", "type": "published-proof-of-concept", "source": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf", "content": "", "creation_timestamp": "2026-05-13T13:31:17.000000Z"} {"uuid": "4b05bbce-ea0f-442d-9052-c18faabf5e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-39806", "type": "published-proof-of-concept", "source": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf", "content": "", "creation_timestamp": "2026-05-13T13:31:17.000000Z"} https://vulnerability.circl.lu/sighting/4b05bbce-ea0f-442d-9052-c18faabf5e82/export Wed, 13 May 2026 13:31:17 +0000 https://vulnerability.circl.lu/sighting/d88cf613-b428-4044-8225-f8ce2d73c212/export {"uuid": "d88cf613-b428-4044-8225-f8ce2d73c212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39803", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlqo6ksu2u2p", "content": "CVE-2026-39803 - HTTP/1 chunked body reader ignores length cap in bandit\nCVE ID : CVE-2026-39803\n \n Published : May 13, 2026, 1:36 p.m. | 54\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated...", "creation_timestamp": "2026-05-13T15:57:23.753919Z"} {"uuid": "d88cf613-b428-4044-8225-f8ce2d73c212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39803", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlqo6ksu2u2p", "content": "CVE-2026-39803 - HTTP/1 chunked body reader ignores length cap in bandit\nCVE ID : CVE-2026-39803\n \n Published : May 13, 2026, 1:36 p.m. | 54\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated...", "creation_timestamp": "2026-05-13T15:57:23.753919Z"} https://vulnerability.circl.lu/sighting/d88cf613-b428-4044-8225-f8ce2d73c212/export Wed, 13 May 2026 15:57:23 +0000 https://vulnerability.circl.lu/sighting/0421bcfb-f01e-463b-835e-40e22bf7c1ff/export {"uuid": "0421bcfb-f01e-463b-835e-40e22bf7c1ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39806", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlqoqirlok2e", "content": "CVE-2026-39806 - HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit\nCVE ID : CVE-2026-39806\n \n Published : May 13, 2026, 1:36 p.m. | 54\u00a0minutes ago\n \n Description : Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel band...", "creation_timestamp": "2026-05-13T16:07:25.673948Z"} {"uuid": "0421bcfb-f01e-463b-835e-40e22bf7c1ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39806", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlqoqirlok2e", "content": "CVE-2026-39806 - HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit\nCVE ID : CVE-2026-39806\n \n Published : May 13, 2026, 1:36 p.m. | 54\u00a0minutes ago\n \n Description : Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel band...", "creation_timestamp": "2026-05-13T16:07:25.673948Z"} https://vulnerability.circl.lu/sighting/0421bcfb-f01e-463b-835e-40e22bf7c1ff/export Wed, 13 May 2026 16:07:25 +0000 https://vulnerability.circl.lu/sighting/007c5532-332f-4c7c-90b1-48d2699a6f38/export {"uuid": "007c5532-332f-4c7c-90b1-48d2699a6f38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39808", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnhll34qxw2i", "content": "\ud83d\udccc CVE-2026-39808 - A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.... https://www.cyberhub.blog/cves/CVE-2026-39808", "creation_timestamp": "2026-06-04T12:07:08.301488Z"} {"uuid": "007c5532-332f-4c7c-90b1-48d2699a6f38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39808", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnhll34qxw2i", "content": "\ud83d\udccc CVE-2026-39808 - A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.... https://www.cyberhub.blog/cves/CVE-2026-39808", "creation_timestamp": "2026-06-04T12:07:08.301488Z"} https://vulnerability.circl.lu/sighting/007c5532-332f-4c7c-90b1-48d2699a6f38/export Thu, 04 Jun 2026 12:07:08 +0000