{"vulnerability": "CVE-2026-5283", "sightings": [{"uuid": "b88e64e3-ba61-465f-a32c-584c6fafc6ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3migbbrqc5a25", "content": "", "creation_timestamp": "2026-04-01T08:24:20.875850Z"}, {"uuid": "e3cf2462-da54-433b-ab72-2ff64ae784f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "095706da-94ec-4d82-8eea-fa8726901a06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260402", "content": "", "creation_timestamp": "2026-04-01T18:00:00.000000Z"}, {"uuid": "5a822a22-965d-42f7-a03a-b15206cd128b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0392/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"}, {"uuid": "6647d468-3463-4e5d-a7e4-2591eda318a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "c642b6c5-c693-40d2-84a4-78e32a8f98f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "e97eacf3-cc3e-44cf-9d45-17e0d5de6301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5283", "type": "seen", "source": "Telegram/0Pt1cki95fA53ajnnsK8Av3dKVeZdTqxfrxRx4frF74hO10", "content": "", "creation_timestamp": "2026-04-01T15:25:49.000000Z"}, {"uuid": "c6325e39-f3ab-4803-860c-cf115fb9f782", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52837", "type": "seen", "source": "https://gist.github.com/alon710/2d94cc50795411681f41b69ad6e69380", "content": "# CVE-2026-52837: CVE-2026-52837: Unauthenticated PII Leakage in Easy!Appointments Booking Reschedule Endpoint\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52837\n\n## Summary\nAn unauthenticated Personally Identifiable Information (PII) disclosure vulnerability exists in Easy!Appointments versions up to and including 1.5.2. Requesting the booking reschedule endpoint with a valid appointment hash causes the system to embed the raw customer database record into the HTML response as inline JavaScript variables, exposing sensitive details. This includes email addresses, phone numbers, physical addresses, custom database metadata, and internal directory configurations such as LDAP DNs. The vulnerability has been resolved in version 1.6.0.\n\n## TL;DR\nUnauthenticated remote attackers can extract complete customer database records by accessing the booking reschedule endpoint with a valid 12-character appointment hash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-639\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00352 (Percentile: 27.89%)\n- **Impact**: Information Disclosure (PII Leakage)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments <= 1.5.2\n- **Easy!Appointments**: <= 1.5.2 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade to Easy!Appointments version 1.6.0 or later\n- Manually apply array-filtering hotfix to the Booking controller\n- Enforce strict Referrer-Policy to prevent hash leakage\n\n**Remediation Steps:**\n1. Assess current Easy!Appointments version and back up the database and web root.\n2. Apply the official upgrade package to transition to version 1.6.0 or newer.\n3. Verify the patch by loading a reschedule URL and inspecting the rendered HTML source for the absence of raw 'customer_data' fields.\n4. Configure the web server (Nginx/Apache) to append 'Referrer-Policy: no-referrer' to outgoing HTTP headers.\n\n## References\n\n- [GitHub Security Advisory GHSA-xgr6-pqjv-3pf8](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8)\n- [Fix Commit 40bb0b3](https://github.com/alextselegidis/easyappointments/commit/40bb0b31b531540bc9006efce4220eb0a437ed2b)\n- [Easy!Appointments 1.6.0 Release Notes](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n- [NVD CVE-2026-52837 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-52837)\n- [CVE.org CVE-2026-52837 Record](https://www.cve.org/CVERecord?id=CVE-2026-52837)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52837) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T04:31:31.123107Z"}, {"uuid": "ec4bb238-9823-4685-8d56-0bbbacef54bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "published-proof-of-concept", "source": "Telegram/g38DleJHgOgrObzOzogNy-FQ9NoQ3t7D9hzvmW22jIm78xQ", "content": "", "creation_timestamp": "2026-07-30T01:00:13.963222Z"}, {"uuid": "78487193-8817-45ed-bfe3-f4ad74156389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52839", "type": "seen", "source": "https://gist.github.com/alon710/5694b6f230218930632a6e462097e637", "content": "# CVE-2026-52839: CVE-2026-52839: Cross-Provider Appointment Injection and Authorization Bypass in Easy!Appointments\n\n> **CVSS Score:** 3.3\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52839\n\n## Summary\nAn authorization bypass and logical 'write-before-crash' vulnerability in Easy!Appointments versions prior to 1.6.0 allows authenticated users with the 'Provider' role to inject unauthorized bookings into foreign providers' schedules or reassign existing appointments via parameter manipulation on the 'store' and 'update' endpoints.\n\n## TL;DR\nAuthenticated providers can inject or reassign appointments into schedules of other providers due to missing session-boundary validation on mutation endpoints, compounded by a write-before-crash logic flaw.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.3 (Low)\n- **Exploit Status**: None (No active public exploits)\n- **CISA KEV Status**: Not Listed\n- **Affected Functions**: appointments/store, appointments/update\n\n## Affected Systems\n\n- Easy!Appointments\n- **Easy!Appointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade to Easy!Appointments version 1.6.0 or higher to apply official fixes.\n- Apply manual session validation controls to the store and update methods in application/controllers/Appointments.php.\n- Perform scheduled database integrity reviews to identify unauthorized appointment reassignments.\n\n**Remediation Steps:**\n1. Identify all deployment instances running Easy!Appointments versions older than 1.6.0.\n2. Back up the active database and configuration files.\n3. Download and install Easy!Appointments version 1.6.0 from the official release page.\n4. If manual patching is required, insert session role-slug verification checks into the store() and update() functions.\n5. Verify the patch by attempting to submit an appointment containing a foreign provider ID using a low-privilege provider account.\n\n## References\n\n- [GitHub Security Advisory GHSA-w8xc-8g92-v77h](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h)\n- [NVD CVE-2026-52839 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-52839)\n- [Easy!Appointments Version 1.6.0 Release Tag](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52839) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T05:31:24.691808Z"}, {"uuid": "7ea3524d-6ae1-487a-96fb-d2d7ef9a86cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52838", "type": "seen", "source": "https://gist.github.com/alon710/a3242bec311706e278c5de9e07dda21c", "content": "# CVE-2026-52838: CVE-2026-52838: Stored Cross-Site Scripting via Booking Disabled Message in Easy!Appointments\n\n> **CVSS Score:** 2.6\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52838\n\n## Summary\nThis report provides a comprehensive technical teardown of CVE-2026-52838 (GHSA-996f-334j-67g7), a stored Cross-Site Scripting (XSS) vulnerability in Easy!Appointments. The flaw occurs in how the application manages the 'booking disabled' custom message configuration, allowing high-privileged administrators to persist unsanitized payloads that execute on unauthenticated guest landing pages.\n\n## TL;DR\nA stored Cross-Site Scripting vulnerability in Easy!Appointments prior to version 1.6.0 allows authenticated administrators to store arbitrary JavaScript payloads in the booking settings. These payloads execute automatically in the browser context of unauthenticated visitors when the application is configured in booking disabled mode.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 2.6\n- **EPSS Score**: 0.00184\n- **Impact**: Stored Cross-Site Scripting\n- **Exploit Status**: None / No Public PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments\n- **easyappointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade Easy!Appointments to version 1.6.0 or higher.\n- Apply manual template-level output sanitization using the pure_html helper function.\n- Implement a robust Content Security Policy (CSP) to block the execution of inline JavaScript payloads.\n\n**Remediation Steps:**\n1. Determine the current version of the Easy!Appointments installation.\n2. Back up the database and existing application directory.\n3. Download the 1.6.0 release from the official repository.\n4. Deploy the updated codebase, ensuring files in the application/views and application/controllers directories are overwritten.\n5. Validate the fix by attempting to input HTML tags in the booking message configuration as an administrator and verifying they are sanitized on the guest page.\n\n## References\n\n- [GitHub Advisory GHSA-996f-334j-67g7](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7)\n- [Vulnerability Fix Commit](https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae)\n- [Easy!Appointments 1.6.0 Release Tag](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n- [NVD Vulnerability Detail for CVE-2026-52838](https://nvd.nist.gov/vuln/detail/CVE-2026-52838)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52838) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T02:32:04.935473Z"}, {"uuid": "3606e83c-2fc9-4c9c-bb0a-78c6fa3d61dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95672", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52832-PoC-exploit-nuclio-dashboard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mdvpat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 10:43:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, \u22641.15.27)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-01T19:00:04.003455Z"}, {"uuid": "8bc63b46-fd06-4d96-8b8a-6621178f5b7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95672", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52832-PoC-exploit-nuclio-dashboard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mdvpat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 10:43:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, \u22641.15.27)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-02T00:00:23.071007Z"}, {"uuid": "85904cf1-5ae1-4f9c-adf6-1b85884626c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpozshgwxf2b", "content": "\ud83d\udd34 CVE-2026-52830 - Critical (9.4)\n\nfast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bea...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-52830/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-02T22:00:50.488827Z"}, {"uuid": "7ff36c6f-a7d7-471b-8aea-acc6731258db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52834", "type": "published-proof-of-concept", "source": "https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-5pmv-rx8r-wmv5", "content": "", "creation_timestamp": "2026-07-02T22:35:09.317138Z"}, {"uuid": "2721e3f0-4ae7-42c5-a904-fca4a73c386a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprjyv7j6527", "content": "CVE-2026-52830 - fast-mcp-telegram\nAn attacker can access the default Telegram account without a valid token, potentially reading and sending messages, if a specific session file exists on the server. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#leshchenko1979 #pip #CVE #infosec", "creation_timestamp": "2026-07-03T21:56:04.565126Z"}, {"uuid": "a7ad6a8d-d29c-4688-94a4-2370dc735d6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52831", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq5zcwidwn2h", "content": "CVE-2026-52831 - nuclio\nNuclio's cron trigger feature allows attackers to inject malicious commands into shell scripts, potentially leading to persistent remote code execution. This affects Nuclio versions up\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nuclio #Golang #CVE #infosec", "creation_timestamp": "2026-07-08T21:02:04.618430Z"}, {"uuid": "6f938a63-aae0-4dcc-8bfe-e4edde2ee71d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52831", "type": "published-proof-of-concept", "source": "https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p", "content": "", "creation_timestamp": "2026-07-08T22:35:08.101642Z"}, {"uuid": "2ac9eb46-4afd-4431-a0bc-d1671506929a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52837", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqmnea7ypo2l", "content": "CVE-2026-52837 - Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page\nCVE ID : CVE-2026-52837\n \n Published : July 14, 2026, 3:17 p.m. | 13\u00a0minutes ago\n \n Description : Easy!Appointments is a self hosted appointment scheduler. In versions up ...", "creation_timestamp": "2026-07-14T16:37:59.488275Z"}, {"uuid": "0f18cfe2-1cfd-4670-8045-626a01037290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52832", "type": "published-proof-of-concept", "source": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg", "content": "", "creation_timestamp": "2026-07-16T20:35:02.492221Z"}, {"uuid": "481dd515-d238-4f55-9086-a12c3e4b8db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52833", "type": "published-proof-of-concept", "source": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww", "content": "", "creation_timestamp": "2026-07-16T20:35:04.662251Z"}, {"uuid": "65d0a600-91fb-48f2-9911-31d06c492601", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52837", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7k7xhr5q2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-52837 \u0432 Easy!Appointments: \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\n\n\n\nhttps://kripta.biz/posts/B991AE73-3AAC-422A-9659-97F848E0D09F", "creation_timestamp": "2026-07-22T05:02:29.897577Z"}, {"uuid": "c1d127d4-c4ec-4c54-8aff-6a0b6b9fc32b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "seen", "source": "https://t.me/GithubRedTeam/95672", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52832-PoC-exploit-nuclio-dashboard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mdvpat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 10:43:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, \u22641.15.27)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T12:01:54.614045Z"}, {"uuid": "07eede9d-ce54-4cde-9acd-b0c7b6cad23c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52837", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8", "content": "", "creation_timestamp": "2026-07-29T18:35:18.519003Z"}, {"uuid": "314d4193-ca01-42f3-bac6-406cd97c22c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "seen", "source": "Telegram/g38DleJHgOgrObzOzogNy-FQ9NoQ3t7D9hzvmW22jIm78xQ", "content": "", "creation_timestamp": "2026-07-29T13:00:06.163822Z"}, {"uuid": "89451881-a58c-45f5-8527-a319984798ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52839", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h", "content": "", "creation_timestamp": "2026-07-29T18:35:21.013812Z"}, {"uuid": "eddb8769-e067-4452-b06a-72a5a4604670", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52838", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7", "content": "", "creation_timestamp": "2026-07-29T18:35:13.657290Z"}, {"uuid": "64cd0f91-b1b2-46cc-884f-3863d654b1a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "seen", "source": "Telegram/TzHuoTQGGjrCLjvjb-w7G7VP2W7wuY36FTV_RC7C2rNjBX8", "content": "", "creation_timestamp": "2026-07-29T20:00:04.370411Z"}, {"uuid": "2e49d89c-f017-4ae3-a08b-48f2d8e8fa39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "published-proof-of-concept", "source": "Telegram/TzHuoTQGGjrCLjvjb-w7G7VP2W7wuY36FTV_RC7C2rNjBX8", "content": "", "creation_timestamp": "2026-07-30T00:00:09.800759Z"}, {"uuid": "c1ee879d-0d1e-4395-873c-0475fe297cf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52832", "type": "seen", "source": "https://t.me/GithubRedTeam/95672", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52832-PoC-exploit-nuclio-dashboard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mdvpat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 10:43:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, \u22641.15.27)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:02:05.915955Z"}]}