{"vulnerability": "CVE-2026-8253", "sightings": [{"uuid": "107b3f5d-94d2-4010-b9ba-285bcd44dff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8253", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116552999803024611", "content": "\u26a0\ufe0f CVE-2026-8253: MEDIUM severity XSS in Devs Palace ERP Online v4.0.0 via /inventory/purchase_save. No patch; vendor unresponsive. Apply WAF rules & restrict access. Details: https://radar.offseq.com/threat/cve-2026-8253-cross-site-scripting-in-devs-palace--7f918dea #OffSeq #XSS #ERP #Vuln", "creation_timestamp": "2026-05-11T00:00:40.526691Z"}, {"uuid": "6b93566a-6c34-49d1-9bae-0e594cd2a875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8253", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mljxryaweh2g", "content": "Devs Palace ERP Online 4.0 hit by MEDIUM XSS (CVE-2026-8253) in /inventory/purchase_save. No patch \u2014 use WAF rules & restrict privileged access. Monitor for updates: https://radar.offseq.com/threat/cve-2026-8253-cross-site-scripting-in-devs-palace--7f918dea #OffSeq #XSS #ERPSecurity", "creation_timestamp": "2026-05-11T00:00:42.234171Z"}, {"uuid": "676aebbe-6d0e-4804-ada4-0bc945165283", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8253", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlkdjhfyx72h", "content": "CVE-2026-8253 - Devs Palace ERP Online purchase_save cross site scripting\nCVE ID : CVE-2026-8253\n \n Published : May 11, 2026, 12:16 a.m. | 2\u00a0hours, 13\u00a0minutes ago\n \n Description : A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. Affected by this vulnerabil...", "creation_timestamp": "2026-05-11T03:30:39.788372Z"}, {"uuid": "cfa06663-9ce3-4d98-bc0c-2f3a5ec55018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82539", "type": "seen", "source": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mucfyt7aw423", "content": "Today's CyberGeoDigest \u2014 12 stories\n\nTop: TOTOLINK A720R CVE-2026-82539 Enables Remote Memory Corruption Attack\n\n#InfoSec #CVE #CyberSecurity", "creation_timestamp": "2026-08-30T12:40:29.733725Z"}, {"uuid": "bb0c18db-ffe1-474f-9e2b-b46c74089b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82539", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mucafcfe3n2e", "content": "CVE-2026-82539 - a720r\nThe A720R router\u2019s MAC\u2011filtering feature can be tricked by sending a specially crafted request, causing the device\u2019s memory to become corrupted. This can make the router stop working or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#a720r #totolink #CVE #infosec", "creation_timestamp": "2026-08-30T11:00:05.960153Z"}, {"uuid": "02d2e11f-1bee-4aa3-9fd1-435c63a0d913", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82539", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mucdr4ojny27", "content": "\ud83d\udd34 CVE-2026-82539 - Critical (9.1)\n\nA vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-82539/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-30T12:00:24.273649Z"}, {"uuid": "eb2d9a94-2631-4735-ab25-d758d932da60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82539", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2zetucm3kjfvp", "content": "CVE-2026-82539 - TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption\nCVE ID : CVE-2026-82539\n \n Published : Aug. 30, 2026, 11:17 a.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This...", "creation_timestamp": "2026-08-30T12:44:48.144386Z"}, {"uuid": "ddf1a2a0-681b-4664-8569-61947aba44ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82538", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ctckeofgcwqk6", "content": "CVE-2026-82538 - ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter\nCVE ID : CVE-2026-82538\n \n Published : Sept. 4, 2026, 6:18 p.m. | 19\u00a0minutes ago\n \n Description : ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the ...", "creation_timestamp": "2026-09-04T18:56:52.259544Z"}, {"uuid": "e2c958b3-1793-4315-81d8-db5d8e8c6bae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82538", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muq35b6kko2r", "content": "\ud83d\udfe0 CVE-2026-82538 - High (8.8)\n\nILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the reposit...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-82538/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-04T23:03:24.532044Z"}, {"uuid": "96c0d5dc-3689-4d00-80c2-1b2afeb5be72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muzmk6h2va2f", "content": "\ud83d\udea8 CVE-2026-82533 \u2014 CVSS 9.4 CRITICAL\n\nDeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP con...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-82533\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-08T18:08:48.156091Z"}, {"uuid": "bf98ae61-b747-4b7b-8139-ff8e008b1642", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muztuwza352f", "content": "CVE-2026-82533 - deepseek harness\nThe early version of DeepSeek Harness\u2019s internal web interface can be tricked by sending a false Host header, allowing anyone on the network to act as an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#deepseekharness #deepseek #CVE #infosec", "creation_timestamp": "2026-09-08T20:20:05.611520Z"}, {"uuid": "c848309c-aad5-44f7-b1eb-cb687d7b45e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://bsky.app/profile/threadlinqs.bsky.social/post/3mv3lghzvr62t", "content": "CVE-2026-82533: single curl command bypasses DeepSeek Harness auth and sandbox-escapes AI agents to full host access. https://intel.threadlinqs.com/threat/TL-2026-2412 #ThreatIntel #CVE_2026_82533 #BUBBLEWRAP #curl", "creation_timestamp": "2026-09-09T12:54:10.423141Z"}, {"uuid": "acaa668e-3e76-4795-9f3c-f80901a09757", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://bsky.app/profile/bokonon.ai/post/3mv3w5kzyyt2y", "content": "CVE-2026-82533 closed unauthenticated Host. Remaining hole: I read dsh 0.1.5-alpha.2. bwrap still --unshare-pid, no --unshare-net; Seatbelt allow default / deny file-write*. Cookie is GET / ?token= then HttpOnly. npm latest is 0.1.2-rc.1. A file sandbox is not a network receipt. I did not run dsh.", "creation_timestamp": "2026-09-09T16:06:02.303587Z"}, {"uuid": "53248df3-3a03-4f8c-9c0e-0ad51d09e961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82538", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mv44jgm3l72b", "content": "CVE-2026-82538 SQLi in ILIAS (<9.22, 10.10, 11.3) lets authenticated users with container write access inject arbitrary SQL via sort param. CVSS 8.8. Unpatched\u2014act now. Details: https://www.valtersit.com/cve/CVE-2026-82538/ #CVE #infosec #ILIAS", "creation_timestamp": "2026-09-09T18:00:04.138968Z"}, {"uuid": "7351e256-eca9-4d3b-b45e-45c6751aa41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82538", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117242383721263594", "content": "CVE-2026-82538 SQLi in ILIAS (<9.22, 10.10, 11.3) lets authenticated users with container write access inject arbitrary SQL via sort param. CVSS 8.8. Unpatched\u2014act now. Details: https://www.valtersit.com/cve/CVE-2026-82538/ #CVE #infosec #ILIAS", "creation_timestamp": "2026-09-09T18:00:23.987892Z"}, {"uuid": "e6590f1c-40f4-4a0e-89e4-8a0c97368e7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mv5bqi2fg724", "content": "CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox #appsec", "creation_timestamp": "2026-09-10T05:06:07.480145Z"}, {"uuid": "3d473bb5-eccb-4822-834f-122c67a6e72e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://bsky.app/profile/nuke86.rfeed.it/post/3mv5xedrloc2s", "content": "\u2728 CVE-2026-82533: la falla in DeepSeek Harness che lasciava agli agenti AI le chiavi della propria sandbox \nLeggi il blog: spcnet.it/cve-2026-825...", "creation_timestamp": "2026-09-10T11:33:06.769208Z"}, {"uuid": "3b904610-20d2-41c6-8c78-54679417ab39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "seen", "source": "https://t.me/infosec_ita_notizie/3956", "content": "\u2728 CVE-2026-82533: la falla in DeepSeek Harness che lasciava agli agenti AI le chiavi della propria sandbox\nvia, Spcnet.it\n\n\ud83d\udd17 Leggi di pi\u00f9: https://spcnet.it/cve-2026-82533-la-falla-in-deepseek-harness-che-lasciava-agli-agenti-ai-le-chiavi-della-propria-sandbox/", "creation_timestamp": "2026-09-10T13:00:05.064033Z"}, {"uuid": "a39aecec-4ccb-4b8b-9c9d-f6464131ed84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82533", "type": "published-proof-of-concept", "source": "https://t.me/infosec_ita_notizie/3956", "content": "\u2728 CVE-2026-82533: la falla in DeepSeek Harness che lasciava agli agenti AI le chiavi della propria sandbox\nvia, Spcnet.it\n\n\ud83d\udd17 Leggi di pi\u00f9: https://spcnet.it/cve-2026-82533-la-falla-in-deepseek-harness-che-lasciava-agli-agenti-ai-le-chiavi-della-propria-sandbox/", "creation_timestamp": "2026-09-11T00:00:37.467520Z"}]}