{"vulnerability": "cve-2026-2185", "sightings": [{"uuid": "c2a2a8c7-fe2a-4599-8f41-3ef2a2dddc1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/hdknr/67f7657965c1f660dfbad9b0e88d0414", "content": "", "creation_timestamp": "2026-03-02T23:46:00.000000Z"}, {"uuid": "8fea09d5-1b09-478a-9ca9-96a447ad2230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mfqwy4hc662y", "content": "", "creation_timestamp": "2026-02-26T10:03:45.698868Z"}, {"uuid": "2a5ba688-530a-40d7-bc1a-d7318b4a7575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21859", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mg4jbbpp5s2d", "content": "", "creation_timestamp": "2026-03-03T00:30:13.832046Z"}, {"uuid": "0c8b1d14-0821-4e64-9faf-133e982ced4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mg4lcqnffc2e", "content": "", "creation_timestamp": "2026-03-03T01:06:53.418702Z"}, {"uuid": "a99f00b2-8080-4641-a745-30946d0480ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mfpjcq7fu42w", "content": "", "creation_timestamp": "2026-02-25T20:26:26.593646Z"}, {"uuid": "74966245-9af2-48f6-8ae5-3660f09e124f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-04)", "content": "", "creation_timestamp": "2026-03-04T00:00:00.000000Z"}, {"uuid": "3ef3db2a-b48a-4cfc-b62b-4f311e74137b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-12)", "content": "", "creation_timestamp": "2026-02-12T00:00:00.000000Z"}, {"uuid": "fe41eb91-e289-4487-ae73-32953c98da35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-07)", "content": "", "creation_timestamp": "2026-02-07T00:00:00.000000Z"}, {"uuid": "65e9c7a9-a310-41a7-89da-4c538424e92a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3me5pqhmzp22y", "content": "", "creation_timestamp": "2026-02-06T01:08:24.985132Z"}, {"uuid": "2dae0926-143d-4fa9-8d32-4559fd6c4f55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-01)", "content": "", "creation_timestamp": "2026-03-01T00:00:00.000000Z"}, {"uuid": "8c830cc3-afc7-4801-8839-b3476947ba9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21852", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mg4woh4coz2m", "content": "", "creation_timestamp": "2026-03-03T04:30:13.820432Z"}, {"uuid": "1605f67e-2c7b-4428-ad0d-2999f44c4e5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-22)", "content": "", "creation_timestamp": "2026-02-22T00:00:00.000000Z"}, {"uuid": "f8746062-d5ec-4dff-a49e-b2cafd88050e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-23)", "content": "", "creation_timestamp": "2026-02-23T00:00:00.000000Z"}, {"uuid": "9a8e0456-edf7-4279-ae47-060550529eb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-10)", "content": "", "creation_timestamp": "2026-02-10T00:00:00.000000Z"}, {"uuid": "f2add485-92ac-4e81-817e-bccdca69e691", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/michaeloboyle/b31f3bfed270ff0bd13d5b368a054e98", "content": "", "creation_timestamp": "2026-02-28T14:25:14.000000Z"}, {"uuid": "b1d25c3a-9a55-430d-926d-67f1c3bd08fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfutw4jswi2k", "content": "", "creation_timestamp": "2026-02-27T23:19:32.336458Z"}, {"uuid": "83d21ce1-805b-44d7-b1c2-db6a705b89a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mfx2mgkaco2u", "content": "", "creation_timestamp": "2026-02-28T20:24:42.936518Z"}, {"uuid": "e7823354-6fa3-4653-95ae-f6b564f0c242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ni8mare_cve_2026_21858.rb", "content": "", "creation_timestamp": "2026-02-16T15:16:31.000000Z"}, {"uuid": "3d351836-cdf6-4342-aff6-99ebccc4a944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2185", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3meetbluowq2h", "content": "", "creation_timestamp": "2026-02-08T21:00:16.533015Z"}, {"uuid": "9229b9a2-fa35-4045-bfa0-fd96b1410aba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2185", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116037020144793622", "content": "", "creation_timestamp": "2026-02-08T21:00:28.201433Z"}, {"uuid": "739b942e-c3e8-4bd0-880c-77bfa8c37727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/116151281271017185", "content": "", "creation_timestamp": "2026-03-01T01:18:20.782626Z"}, {"uuid": "58971099-8fd5-4157-9a08-45aef8830a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3mg3bfhzjl22b", "content": "", "creation_timestamp": "2026-03-02T12:36:47.162396Z"}, {"uuid": "68615448-e9a3-459b-a41b-f628b6ee8779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-17)", "content": "", "creation_timestamp": "2026-02-17T00:00:00.000000Z"}, {"uuid": "e98ff4e5-18c4-4a50-9706-91fe92b32b56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-03)", "content": "", "creation_timestamp": "2026-03-03T00:00:00.000000Z"}, {"uuid": "b0a113c0-1f2b-4a93-9ab6-fb713e75c79c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "Cve-2026-2185", "type": "seen", "source": "https://bsky.app/profile/hbrks.mastodon.social.ap.brid.gy/post/3mef6z5i7ptc2", "content": "", "creation_timestamp": "2026-02-09T00:30:29.532746Z"}, {"uuid": "815029d7-ffbd-4da2-9055-e56ff9cf358b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "Cve-2026-2185", "type": "seen", "source": "https://bsky.app/profile/hbrks.mastodon.social.ap.brid.gy/post/3mef72k5zv232", "content": "", "creation_timestamp": "2026-02-09T00:31:10.434775Z"}, {"uuid": "ea638a95-0de9-41e8-95f1-2afe36a074ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "Cve-2026-2185", "type": "seen", "source": "https://bsky.app/profile/hbrks.mastodon.social.ap.brid.gy/post/3mef744ccoie2", "content": "", "creation_timestamp": "2026-02-09T00:31:59.486643Z"}, {"uuid": "a1b01ba6-2dde-4302-a4a4-9c742829dbb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-05)", "content": "", "creation_timestamp": "2026-02-05T00:00:00.000000Z"}, {"uuid": "fa993513-6121-423e-902b-ad8193bc8a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/hdknr/c1db35eaecd83c70628736440deba71a", "content": "", "creation_timestamp": "2026-02-26T04:50:04.000000Z"}, {"uuid": "b13b64ab-5946-498a-ba52-2e63c1dccb23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mgbwo3qxkt2o", "content": "", "creation_timestamp": "2026-03-05T04:13:20.776703Z"}, {"uuid": "2beeaaf5-ba18-401c-a53c-3e22647e74f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3merfr6wqfw2j", "content": "", "creation_timestamp": "2026-02-13T21:03:11.853342Z"}, {"uuid": "e8085eb2-c89e-428b-92e7-ff420442d90c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mfrwvyrukg2i", "content": "", "creation_timestamp": "2026-02-26T19:35:11.247294Z"}, {"uuid": "3146bdef-c482-4147-b7cb-5750e0b73f6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-16)", "content": "", "creation_timestamp": "2026-02-16T00:00:00.000000Z"}, {"uuid": "800b0b50-98bf-40f5-a052-89b9d9b837d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/hdknr/788d211750014f243a3b9f0c56e7192c", "content": "", "creation_timestamp": "2026-03-05T06:05:02.000000Z"}, {"uuid": "e7887129-5815-441e-9abb-a26e2c0745ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mgdapzdozb2n", "content": "", "creation_timestamp": "2026-03-05T16:46:02.980035Z"}, {"uuid": "532f58f2-2288-4891-bab7-208d2e424678", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mdulv65nw425", "content": "", "creation_timestamp": "2026-02-02T10:05:26.904237Z"}, {"uuid": "117c6c53-f233-44d4-b606-80e0a4858691", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-06)", "content": "", "creation_timestamp": "2026-02-06T00:00:00.000000Z"}, {"uuid": "98dafe4f-317b-468a-850d-a983dc203795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-02)", "content": "", "creation_timestamp": "2026-03-02T00:00:00.000000Z"}, {"uuid": "14d59b5d-3a15-4f5d-8c96-c5cb86e43104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-24)", "content": "", "creation_timestamp": "2026-02-24T00:00:00.000000Z"}, {"uuid": "504caf8a-1b8c-45e0-b6bf-be7b39acfcfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/cyber-news-fi.bsky.social/post/3mfovfveqi32m", "content": "", "creation_timestamp": "2026-02-25T14:30:16.810658Z"}, {"uuid": "6a201ee5-c638-4d98-b7f5-581420b48170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21853", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3xtoe7yt2s", "content": "", "creation_timestamp": "2026-03-02T19:18:23.814490Z"}, {"uuid": "99dd3c44-ed0c-4488-a82a-26ee39735190", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21853", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3xtzdyf52c", "content": "", "creation_timestamp": "2026-03-02T19:18:35.032118Z"}, {"uuid": "8c0915a5-ca0c-4dcb-b0ff-42b4b33b39f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mfs27crvye2p", "content": "", "creation_timestamp": "2026-02-26T20:34:04.557194Z"}, {"uuid": "fab26ac3-f8f9-41f1-ac47-33366a98a9ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21853", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3xukeqzq2s", "content": "", "creation_timestamp": "2026-03-02T19:18:52.922297Z"}, {"uuid": "d7158bf3-5db8-4e6f-a624-ccfaadf1705e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-03)", "content": "", "creation_timestamp": "2026-02-03T00:00:00.000000Z"}, {"uuid": "6007f798-c295-4a8c-87bf-4031849e595c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21853", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg42zam5uv2n", "content": "", "creation_timestamp": "2026-03-02T20:15:11.455351Z"}, {"uuid": "58afd18f-e533-40bd-a6da-ec65975de6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-06)", "content": "", "creation_timestamp": "2026-03-06T00:00:00.000000Z"}, {"uuid": "d306af0e-7914-449b-ac1c-c7b76f8e5fba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mgar4szmxe22", "content": "", "creation_timestamp": "2026-03-04T17:01:32.826797Z"}, {"uuid": "e6d4cf6c-b107-48a2-aab3-a6a19d06a0f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-08)", "content": "", "creation_timestamp": "2026-03-08T00:00:00.000000Z"}, {"uuid": "2b996a79-db02-4d23-a445-865df4926a25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-07)", "content": "", "creation_timestamp": "2026-03-07T00:00:00.000000Z"}, {"uuid": "fc6265c8-7e0e-4041-be40-3ff6c6706c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/116165340674775673", "content": "", "creation_timestamp": "2026-03-03T12:53:52.044664Z"}, {"uuid": "10843f31-8c88-4aff-8df9-e46faa3cbd6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mel2gz2opb2u", "content": "", "creation_timestamp": "2026-02-11T08:24:32.587195Z"}, {"uuid": "53bc307c-9ca2-4aee-bea3-aed6ea2a27d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-28)", "content": "", "creation_timestamp": "2026-02-28T00:00:00.000000Z"}, {"uuid": "f831deaf-dfb9-42e6-ad38-12df1c9873dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cybersentinel404.bsky.social/post/3mbtrdz5mxv24", "content": "", "creation_timestamp": "2026-01-07T15:20:10.817775Z"}, {"uuid": "214da9c3-4a40-4db4-ad5b-5bd0017c597e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mbtridz74h2w", "content": "", "creation_timestamp": "2026-01-07T15:22:37.121347Z"}, {"uuid": "ec4c83e0-4107-4f05-bafc-88b6dbf2d880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mbtrymnwcn2u", "content": "", "creation_timestamp": "2026-01-07T15:31:43.175566Z"}, {"uuid": "e783b2ef-49a4-4ba0-96fa-f9152e155de1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mbtti33d6t2i", "content": "", "creation_timestamp": "2026-01-07T15:58:14.831959Z"}, {"uuid": "56bffa86-29db-4ef9-9d4f-94f985c794b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/115854646088897217", "content": "", "creation_timestamp": "2026-01-07T16:00:07.466951Z"}, {"uuid": "2148a8a0-51e5-4709-a908-cb97953fd595", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/koreone.bsky.social/post/3mbtutsfskl2j", "content": "", "creation_timestamp": "2026-01-07T16:22:41.992350Z"}, {"uuid": "b7bfd8e9-fa93-4778-8198-431e2f882365", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mbtux47tpl2m", "content": "", "creation_timestamp": "2026-01-07T16:24:32.612965Z"}, {"uuid": "8bf26773-1203-4ba0-9c47-6fa25bf4b8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html", "content": "", "creation_timestamp": "2026-01-07T12:48:00.000000Z"}, {"uuid": "67103c4e-d29e-4814-97ec-7d1e9dd34ca1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21854", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mbuaeeaqcd2p", "content": "", "creation_timestamp": "2026-01-07T19:48:49.071366Z"}, {"uuid": "0481156f-7b62-46d3-897b-c2592f5c8081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21855", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mbuaelica52p", "content": "", "creation_timestamp": "2026-01-07T19:48:57.016689Z"}, {"uuid": "5ce85593-73ca-49a0-8b10-5e5e9b1725c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/securityish.bsky.social/post/3mbudlzxkh32v", "content": "", "creation_timestamp": "2026-01-07T20:46:48.082456Z"}, {"uuid": "82781dc1-aa06-4fc1-a5a2-019a84ea89fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21854", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbueueazqc2g", "content": "", "creation_timestamp": "2026-01-07T21:09:20.482426Z"}, {"uuid": "2e6f0fe1-70ac-4f65-99b2-29ddb9c5b071", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21855", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbufwv67el2o", "content": "", "creation_timestamp": "2026-01-07T21:28:39.035906Z"}, {"uuid": "0bf74fd3-ed64-4fc6-b40d-88c6e77ca4d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/r3pek.mastodon.r3pek.org.ap.brid.gy/post/3mbugeai2ozp2", "content": "", "creation_timestamp": "2026-01-07T21:42:41.502387Z"}, {"uuid": "e9c303a7-08b2-4131-a4c6-4f47b6b30d0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/mynameisv.bsky.social/post/3mbuikifutk2a", "content": "", "creation_timestamp": "2026-01-07T22:15:26.077277Z"}, {"uuid": "85cbdc6b-1200-4fd2-a305-e40b05f24fd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mbuiukwtds2x", "content": "", "creation_timestamp": "2026-01-07T22:21:10.693163Z"}, {"uuid": "7fa33350-2427-49d8-9647-b575e2b8d3a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mbuloucdbd2r", "content": "", "creation_timestamp": "2026-01-07T23:11:32.743253Z"}, {"uuid": "6a09d458-2709-493e-8169-4ad38650c46a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mbumm6utvx2z", "content": "", "creation_timestamp": "2026-01-07T23:27:56.658215Z"}, {"uuid": "2d78657a-5e1a-4f0f-affd-66a9f36a9797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21857", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbutc3qesj2u", "content": "", "creation_timestamp": "2026-01-08T01:27:33.516499Z"}, {"uuid": "dd0cb42d-03b4-4a10-b517-06f05ec0788f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbuyy22mle2x", "content": "", "creation_timestamp": "2026-01-08T03:09:18.625544Z"}, {"uuid": "a4f09e26-dd83-418c-93f3-b9afbd9104b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbuzjxd2f22m", "content": "", "creation_timestamp": "2026-01-08T03:19:19.742918Z"}, {"uuid": "70703bc9-b651-4869-92d0-a7039c848f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/TheDoctor512.mastodon.social.ap.brid.gy/post/3mbv3du6o3bm2", "content": "", "creation_timestamp": "2026-01-08T03:56:08.634687Z"}, {"uuid": "0368dfa2-6c88-4331-a5a7-c8512cc9d11b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mbvb5sivrc2b", "content": "", "creation_timestamp": "2026-01-08T05:35:44.124724Z"}, {"uuid": "6a766e73-8e05-4c4c-bb90-51752643cc27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3mbvdnnwxbf2c", "content": "", "creation_timestamp": "2026-01-08T06:20:21.900549Z"}, {"uuid": "732fcef4-678a-4cd8-bf3b-0c3b486a9883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mbvdqjcjsg2w", "content": "", "creation_timestamp": "2026-01-08T06:21:57.738729Z"}, {"uuid": "57c1f7f5-71b9-4bf4-9cc5-fc6b3e4c2561", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mbveosssjd23", "content": "", "creation_timestamp": "2026-01-08T06:38:54.383750Z"}, {"uuid": "9d6b39a3-adec-4ec2-aac5-3fc5443008bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cyberdudebivash.bsky.social/post/3mbvg5mc2ek22", "content": "", "creation_timestamp": "2026-01-08T07:05:09.283878Z"}, {"uuid": "92249f19-8710-4b32-8bf4-5698be6bdee5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-21858", "type": "confirmed", "source": "https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "content": "", "creation_timestamp": "2026-01-08T07:07:38.650752Z"}, {"uuid": "5e6ea2d5-bdd1-4ff8-86a5-940ebc5d0e95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mbvjujx4ui2t", "content": "", "creation_timestamp": "2026-01-08T08:11:35.798089Z"}, {"uuid": "d5d250a2-17f0-4e79-a0a1-d01055f65379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://gist.github.com/Darkcrai86/456985374b30cd88cbb6ddf27d629e97", "content": "", "creation_timestamp": "2026-01-08T08:18:20.000000Z"}, {"uuid": "7e42d97b-a1b1-4ad8-ab7d-fbd6f0438c30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mbvndehqas2d", "content": "", "creation_timestamp": "2026-01-08T09:13:45.197176Z"}, {"uuid": "0e2d7a7a-0cbe-496a-b0f5-6a33f22990ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mbvndg5zkk2d", "content": "", "creation_timestamp": "2026-01-08T09:13:45.805042Z"}, {"uuid": "d452d927-4b05-4426-8100-09ebb97800f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mbvndkh6a22d", "content": "", "creation_timestamp": "2026-01-08T09:13:46.411620Z"}, {"uuid": "7fb64cb1-19a5-4f94-876b-728187715c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mbvpczvlxlu2", "content": "", "creation_timestamp": "2026-01-08T09:56:32.320453Z"}, {"uuid": "f3539391-839b-4f7b-8f96-602bd8ef1bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/onyphe.io/post/3mbvqc665zc2w", "content": "", "creation_timestamp": "2026-01-08T10:06:37.695282Z"}, {"uuid": "b9e93462-94e9-4b8a-81f9-a06cb86d98bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mbvqnhmo3y2o", "content": "", "creation_timestamp": "2026-01-08T10:12:53.739522Z"}, {"uuid": "5691c899-b4e7-499d-80ef-e28b0c028ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mbvr2fy7nu2o", "content": "", "creation_timestamp": "2026-01-08T10:20:08.697556Z"}, {"uuid": "6d1e2e1e-5eef-4170-b62d-be6a0e62cfc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mbvrvbexge24", "content": "", "creation_timestamp": "2026-01-08T10:35:09.367271Z"}, {"uuid": "333aa478-cce3-40df-8519-51baa7b0f4aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mbvtdozmzu2i", "content": "", "creation_timestamp": "2026-01-08T11:01:07.160724Z"}, {"uuid": "182beea8-bb69-49c4-a92d-42cd0a9b8e9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mbvugs2h2m2z", "content": "", "creation_timestamp": "2026-01-08T11:20:45.096386Z"}, {"uuid": "fbcca80f-dfd9-4561-9735-e515d051130d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cybercalm.org/post/3mbvv3dfpas26", "content": "", "creation_timestamp": "2026-01-08T11:32:18.223362Z"}, {"uuid": "86ea3499-9e29-41b5-86ca-43980d80d821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/appsecfeed.bsky.social/post/3mbvygr73b72o", "content": "", "creation_timestamp": "2026-01-08T12:32:19.056694Z"}, {"uuid": "951510f8-3918-4a6c-938e-ae5325f551d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/jbhall56/statuses/115859764422411154", "content": "", "creation_timestamp": "2026-01-08T13:41:46.659616Z"}, {"uuid": "f4524b70-ab42-4060-b78d-ab072e86365d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mbw4depnsk2i", "content": "", "creation_timestamp": "2026-01-08T13:42:01.368633Z"}, {"uuid": "5fe169fb-15d4-4846-afaf-112610e6860a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mbw463sz7ae2", "content": "", "creation_timestamp": "2026-01-08T13:46:48.583019Z"}, {"uuid": "2bdc2c2c-5899-4f40-8fc5-d44f9eb00cec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mbw5inaq422e", "content": "", "creation_timestamp": "2026-01-08T14:02:53.118324Z"}, {"uuid": "d1950cd0-96bd-4747-bd21-500e9da09db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mbwb45n4dn2b", "content": "", "creation_timestamp": "2026-01-08T15:07:26.732698Z"}, {"uuid": "0545691f-e053-4499-8968-88e221220510", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mbwg66qk532z", "content": "", "creation_timestamp": "2026-01-08T16:38:04.314035Z"}, {"uuid": "830fef9a-2e38-4735-b791-d4ead733f8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mbwtyctf322o", "content": "", "creation_timestamp": "2026-01-08T20:45:19.146510Z"}, {"uuid": "003cb189-dead-4cfe-b626-7350147790fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/rapid7.com/post/3mbwwknwwlk2i", "content": "", "creation_timestamp": "2026-01-08T21:31:25.642382Z"}, {"uuid": "78676a49-3f9e-4ebe-b494-bb49cfdbb9e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mbxgzbhkc32h", "content": "", "creation_timestamp": "2026-01-09T02:25:52.270106Z"}, {"uuid": "24a1c3d9-1eec-4ed7-a349-d1db1976882a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://social.tchncs.de/users/gborn/statuses/115863831460064295", "content": "", "creation_timestamp": "2026-01-09T06:56:05.279473Z"}, {"uuid": "2d5e1ff3-fb93-4139-b18a-6a6a139ca0bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mbxyezk7ce2a", "content": "", "creation_timestamp": "2026-01-09T07:36:40.460081Z"}, {"uuid": "0002bab2-3e4c-4a18-88b8-0b6e8cbfe642", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mby2sqzze327", "content": "", "creation_timestamp": "2026-01-09T08:20:09.922799Z"}, {"uuid": "24d04639-1593-48df-8fdc-53921a09b09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/mynameisv.bsky.social/post/3mby7nf5vds2p", "content": "", "creation_timestamp": "2026-01-09T09:46:38.766735Z"}, {"uuid": "57789ce3-0af2-4b41-b0b7-ef54ba39019b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/appsecfeed.bsky.social/post/3mbyis6ahxx2u", "content": "", "creation_timestamp": "2026-01-09T12:30:21.026256Z"}, {"uuid": "e4d1df4c-741c-4ff0-8869-b189e57bccba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://mastodon.social/users/hrbrmstr/statuses/115865150714770648", "content": "", "creation_timestamp": "2026-01-09T12:31:35.718254Z"}, {"uuid": "f1f4c570-051f-4b84-bbad-6bccb00c0f11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://chaos.social/users/christopherkunz/statuses/115865205777306161", "content": "", "creation_timestamp": "2026-01-09T12:45:35.434872Z"}, {"uuid": "1ab70fae-2991-4dd6-9553-18e7a81e5f47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/zeldman.bsky.social/post/3mbyrddtnpb2x", "content": "", "creation_timestamp": "2026-01-09T15:03:07.958408Z"}, {"uuid": "beedbc9d-39d4-4133-af9e-7532df4db36f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://www.acn.gov.it/portale/w/ni8mare-poc-pubblico-per-lo-sfruttamento-di-una-vulnerabilita-in-n8n", "content": "", "creation_timestamp": "2026-01-09T13:19:51.000000Z"}, {"uuid": "2f1c0098-260c-4632-b73f-077a7ab6965d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-10)", "content": "", "creation_timestamp": "2026-03-10T00:00:00.000000Z"}, {"uuid": "df2458e3-71bc-4a60-9d01-8f8604313b5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/115867011546376295", "content": "", "creation_timestamp": "2026-01-09T20:24:48.848638Z"}, {"uuid": "ea284265-0610-4d77-8a2c-4c8e6a815793", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://github.com/Chocapikk/CVE-2026-21858", "content": "", "creation_timestamp": "2026-01-09T22:36:00.202306Z"}, {"uuid": "e376db82-564f-4320-94c8-1ec6d634e5c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mbzxdeqjwl2x", "content": "", "creation_timestamp": "2026-01-10T02:23:10.165557Z"}, {"uuid": "b5e0b5a8-edc2-4f4b-b32e-a0cc7c792c09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mc2gvapeta2m", "content": "", "creation_timestamp": "2026-01-10T07:01:36.376867Z"}, {"uuid": "03b5a309-0153-4689-a4b9-ac7cc69d9758", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/115872638092112061", "content": "", "creation_timestamp": "2026-01-10T20:15:45.892376Z"}, {"uuid": "77d26e54-95b4-482a-ac71-4662b15ade79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mc3tfgjqk22o", "content": "", "creation_timestamp": "2026-01-10T20:18:10.233468Z"}, {"uuid": "06c1a248-7331-4618-bd35-7cc31efd134e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mc3tflvjmc2o", "content": "", "creation_timestamp": "2026-01-10T20:18:11.227054Z"}, {"uuid": "69cd0df6-ea52-41db-9b07-2dec09e6ae11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mc3tflvklk2o", "content": "", "creation_timestamp": "2026-01-10T20:18:12.177254Z"}, {"uuid": "e86f1463-1d86-4fab-a43d-961fd737d68d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mc3ts43g2z2a", "content": "", "creation_timestamp": "2026-01-10T20:25:09.284611Z"}, {"uuid": "49990485-c9b7-46d0-b238-b514fbcf8bc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/rcinghio.bsky.social/post/3mc3votwdtk2f", "content": "", "creation_timestamp": "2026-01-10T20:59:08.544519Z"}, {"uuid": "8f6b3ef7-c0ef-4a70-93b0-87ab9a105a80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mc4i2q7v3x24", "content": "", "creation_timestamp": "2026-01-11T02:27:53.845759Z"}, {"uuid": "86a4de2e-3cf7-4e61-85a5-a0aca5facc00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cyberdudebivash.bsky.social/post/3mc4xivj2hs22", "content": "", "creation_timestamp": "2026-01-11T07:04:21.559128Z"}, {"uuid": "07357fc4-995f-4024-a8a8-c9bedad32ec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-19)", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "6425a779-6aa8-49ad-9813-3c8132eecc06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mc6tmnrtwv2a", "content": "", "creation_timestamp": "2026-01-12T01:00:05.709631Z"}, {"uuid": "b99f611a-8ba8-4bc2-9f18-6254e7297ddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mc6yjots7527", "content": "", "creation_timestamp": "2026-01-12T02:27:54.671530Z"}, {"uuid": "173c5710-235b-422f-934d-942b6cb18216", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-21858.yaml", "content": "", "creation_timestamp": "2026-01-08T06:15:56.000000Z"}, {"uuid": "4ebd2db0-8a2b-47e1-944c-af0d48e97f65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/115883254278995297", "content": "", "creation_timestamp": "2026-01-12T17:15:34.730018Z"}, {"uuid": "61d87cef-db22-430d-9758-3cdd4a09d61c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mcakabzxp22n", "content": "", "creation_timestamp": "2026-01-12T17:17:32.361446Z"}, {"uuid": "84018ad6-454e-410c-953d-59d1ece40ea6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mcakagvxv22n", "content": "", "creation_timestamp": "2026-01-12T17:17:33.111987Z"}, {"uuid": "b19c19aa-2f35-426f-a276-79b3c6a53131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/leekthehack.bsky.social/post/3mcaq56yros2c", "content": "", "creation_timestamp": "2026-01-12T19:03:13.930535Z"}, {"uuid": "98742faa-0656-4862-a2c2-ded809977a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-001-vulnerabilities-affecting-n8n-cve-2026-21858-cve-2026-21877-cve-2025-68613", "content": "", "creation_timestamp": "2026-01-12T17:45:54.000000Z"}, {"uuid": "a0db78ac-ee06-4561-897d-c4ccaea86312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mcawtlgw6u22", "content": "", "creation_timestamp": "2026-01-12T21:02:59.892140Z"}, {"uuid": "1a763358-1ece-4231-875f-c6516d5f18df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/threatint.eu/post/3mcbbg2xk2c22", "content": "", "creation_timestamp": "2026-01-13T00:12:18.008483Z"}, {"uuid": "07fadee2-694a-449c-ba30-06a2908c1750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://ioc.exchange/users/sbeyer/statuses/115884895454225400", "content": "", "creation_timestamp": "2026-01-13T00:12:56.485561Z"}, {"uuid": "5a402332-80ba-494f-bac9-c10a764879f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mcbirzxw2e2p", "content": "", "creation_timestamp": "2026-01-13T02:24:14.051384Z"}, {"uuid": "5ee81c4f-f2d7-4178-a5a8-4ebf25cd6fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mcblcee7ot2z", "content": "", "creation_timestamp": "2026-01-13T03:09:10.025037Z"}, {"uuid": "5c31af48-b1ba-4d6c-ac4d-c86da312e355", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mcbvdvqukq2o", "content": "", "creation_timestamp": "2026-01-13T06:08:58.731525Z"}, {"uuid": "4bdba49f-0980-47a3-b615-1cdb07549ff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-12)", "content": "", "creation_timestamp": "2026-03-12T00:00:00.000000Z"}, {"uuid": "646b94ab-5913-476a-80a4-745718540766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mcd3nnkhse2t", "content": "", "creation_timestamp": "2026-01-13T17:34:27.987736Z"}, {"uuid": "392ca3b2-76ad-4772-b45a-7f331d84fc48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mcd4lizbbw2i", "content": "", "creation_timestamp": "2026-01-13T17:51:10.026449Z"}, {"uuid": "ebe16331-bb95-4037-8230-cb7df4508391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-23)", "content": "", "creation_timestamp": "2026-03-23T00:00:00.000000Z"}, {"uuid": "44d3d023-4ce4-41a7-b34e-bec541f7f544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcdgesfvrk2t", "content": "", "creation_timestamp": "2026-01-13T20:46:26.842695Z"}, {"uuid": "91c57100-adf1-4ca7-bc44-2f53e07eb3ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcdgipxhcc2t", "content": "", "creation_timestamp": "2026-01-13T20:48:41.212860Z"}, {"uuid": "d45be45c-371e-4b82-b99a-3a6c5235e53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcdgxcpnck2t", "content": "", "creation_timestamp": "2026-01-13T20:56:54.506433Z"}, {"uuid": "fac2a326-2a7f-4298-a4f0-40165c6319b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-14)", "content": "", "creation_timestamp": "2026-03-14T00:00:00.000000Z"}, {"uuid": "cbc21034-ef9b-4dff-a265-f2c8ef5af3e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mcdzhbruzh23", "content": "", "creation_timestamp": "2026-01-14T02:27:46.100956Z"}, {"uuid": "eff61dbb-62fe-4e81-812a-3e227568cc9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-13)", "content": "", "creation_timestamp": "2026-03-13T00:00:00.000000Z"}, {"uuid": "4806ca35-6cf6-4123-8c49-6f565fdb5cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-16)", "content": "", "creation_timestamp": "2026-03-16T00:00:00.000000Z"}, {"uuid": "e784fc10-c3c3-4c0c-b9cd-36cd6702bc49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mcfxrkk75f22", "content": "", "creation_timestamp": "2026-01-14T21:03:07.459945Z"}, {"uuid": "94f719a6-7f8b-4d98-b1c4-7a59180f0b96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/beitmenotyou.online/post/3mcfxxak7us2m", "content": "", "creation_timestamp": "2026-01-14T21:06:19.400590Z"}, {"uuid": "e058e066-fc53-45fb-a1db-53b17441a3fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mcgjrxmgpm2w", "content": "", "creation_timestamp": "2026-01-15T02:25:23.996054Z"}, {"uuid": "21d90b6d-2dab-4b49-bf34-13ec8acda562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-11)", "content": "", "creation_timestamp": "2026-03-11T00:00:00.000000Z"}, {"uuid": "afa670ce-410f-45b8-9ba7-ae5f953c6440", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/schneier.com/post/3mchk7klaxf2o", "content": "", "creation_timestamp": "2026-01-15T12:05:39.729179Z"}, {"uuid": "dc13575f-5999-411b-8849-5dcb5297bad5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/gorekhaa.bsky.social/post/3mchpvdn63y2b", "content": "", "creation_timestamp": "2026-01-15T13:47:19.613312Z"}, {"uuid": "cc9a86b6-61ae-4193-9f9d-49389f19caef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://vulnerability.circl.lu/comment/d766d344-c029-419a-b990-fb512e9cb929", "content": "", "creation_timestamp": "2026-01-12T07:42:19.906290Z"}, {"uuid": "2b8eae7c-5119-4223-a7eb-4c7a799dd151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mchw6xsrmd26", "content": "", "creation_timestamp": "2026-01-15T15:40:06.127701Z"}, {"uuid": "b5e037b0-667c-49e3-b64f-b5dbe44c8a3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mchwoazox72y", "content": "", "creation_timestamp": "2026-01-15T15:48:38.499362Z"}, {"uuid": "ead80e7e-32a7-43a4-9378-c2367e9d7890", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/allsafeus.bsky.social/post/3mci3ifyrtp2n", "content": "", "creation_timestamp": "2026-01-15T17:14:51.055988Z"}, {"uuid": "da76f65e-7adc-43c5-8a2c-c5c7516238e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mciha2wez22r", "content": "", "creation_timestamp": "2026-01-15T20:45:05.282241Z"}, {"uuid": "e554e1b7-b033-4ab9-9532-4155e73e9cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mcipvkxsg22y", "content": "", "creation_timestamp": "2026-01-15T23:20:07.290970Z"}, {"uuid": "b8b55dc0-c9a6-42d6-8c53-5d4a9d84c420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mcj2c5jber23", "content": "", "creation_timestamp": "2026-01-16T02:26:07.494323Z"}, {"uuid": "e5ace061-6a3b-4d78-a23c-66072d6c1a3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mcjof4psmc2o", "content": "", "creation_timestamp": "2026-01-16T08:25:40.986631Z"}, {"uuid": "86261e71-acc5-4244-b65c-3ef98e712cda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/appsecfeed.bsky.social/post/3mck4dqjg2l2j", "content": "", "creation_timestamp": "2026-01-16T12:35:27.311402Z"}, {"uuid": "2d2506c1-0115-4e5a-a42e-62fa7ac04a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mclkjdwieu2a", "content": "", "creation_timestamp": "2026-01-17T02:21:47.604474Z"}, {"uuid": "de8b7337-5ccd-469b-81b5-c7dd2752d6d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mco2o32ff22k", "content": "", "creation_timestamp": "2026-01-18T02:16:09.622652Z"}, {"uuid": "9de4289a-ea21-4707-b619-c2e6df7e7d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mco3asrphc2k", "content": "", "creation_timestamp": "2026-01-18T02:26:36.258314Z"}, {"uuid": "796ce4a5-f41c-4323-bee2-21a0a53f9944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mcqlrxhzfa2a", "content": "", "creation_timestamp": "2026-01-19T02:27:48.955123Z"}, {"uuid": "b0cf0157-643c-47f2-952c-20fd5001ff5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mct45zzhev23", "content": "", "creation_timestamp": "2026-01-20T02:26:13.577665Z"}, {"uuid": "0f4426e5-0c54-473b-b2d0-e267430f861e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/116285537944880211", "content": "", "creation_timestamp": "2026-03-24T18:21:38.742812Z"}, {"uuid": "87262155-6a0e-432e-9269-431278643e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mcty4sxkx22j", "content": "", "creation_timestamp": "2026-01-20T10:46:44.235892Z"}, {"uuid": "a1b02295-cb72-4366-9357-5dd53c0cf061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-15)", "content": "", "creation_timestamp": "2026-03-15T00:00:00.000000Z"}, {"uuid": "9992f0fc-aa5f-4f4c-a568-6064e45170ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-21859.yaml", "content": "", "creation_timestamp": "2026-01-21T11:41:46.000000Z"}, {"uuid": "3b2467e4-9b72-4803-994a-c75cd4133e19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3md23iwwqok2i", "content": "", "creation_timestamp": "2026-01-22T21:03:07.421091Z"}, {"uuid": "8828715a-9830-402e-b9ff-3e84fc691dd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/alon710/53ef3cf299982796039e042072a8e56e", "content": "", "creation_timestamp": "2026-01-24T21:23:23.000000Z"}, {"uuid": "909de058-08f3-49a8-b5ea-5321fefcbd41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-21)", "content": "", "creation_timestamp": "2026-03-21T00:00:00.000000Z"}, {"uuid": "c98945bc-0066-4840-985e-6ffe35b98125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://gist.github.com/alon710/be4d1283d126d357f07086861c16a4af", "content": "", "creation_timestamp": "2026-01-24T21:26:51.000000Z"}, {"uuid": "51a90b12-e5ab-45ef-816d-d46e83be5144", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21857", "type": "seen", "source": "https://gist.github.com/alon710/75d522285aa4f8205a292f3cbfca4009", "content": "", "creation_timestamp": "2026-01-24T21:31:06.000000Z"}, {"uuid": "ebdd7bfe-2584-4686-9ca4-b4b1a7ecd418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21857", "type": "seen", "source": "https://gist.github.com/alon710/4c81f028594a171b5c4a96a4003f42ef", "content": "", "creation_timestamp": "2026-01-24T21:31:07.000000Z"}, {"uuid": "3d9e72a2-5a28-4d03-99da-6c80d147635e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "seen", "source": "https://gist.github.com/alon710/2b769ce4e8fadf7fe92277792f4eb87c", "content": "", "creation_timestamp": "2026-01-24T21:30:24.000000Z"}, {"uuid": "ceba2395-216d-458e-9bdb-dbf198278560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21851", "type": "seen", "source": "https://gist.github.com/alon710/701adf8962df6a6f251174e6087c868d", "content": "", "creation_timestamp": "2026-01-24T21:30:21.000000Z"}, {"uuid": "95305d76-abcd-4e71-84a4-3350e1dd2e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21859", "type": "seen", "source": "https://gist.github.com/alon710/fd276d4bca0a40e4d92c87b2d322b30f", "content": "", "creation_timestamp": "2026-01-24T22:42:27.000000Z"}, {"uuid": "689a751d-c0fb-4f17-9cc8-848cf0f60924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21851", "type": "seen", "source": "https://gist.github.com/alon710/56583ebe2044916aa1ba9e5064987b6f", "content": "", "creation_timestamp": "2026-01-24T22:42:25.000000Z"}, {"uuid": "da225e93-b89d-4978-844a-7116051a4ef1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21858", "type": "seen", "source": "https://gist.github.com/alon710/d3d72612ebf7ed7732f8f8e5e9f150de", "content": "", "creation_timestamp": "2026-01-24T22:42:14.000000Z"}, {"uuid": "777734be-6113-4fb5-998f-7fc540619a03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21857", "type": "seen", "source": "https://gist.github.com/alon710/853907bb6bab8c87366046f124466c6c", "content": "", "creation_timestamp": "2026-01-24T22:42:59.000000Z"}, {"uuid": "8e02aefa-3280-4d9f-b3d8-8b30ba931071", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mdddnx77n72q", "content": "", "creation_timestamp": "2026-01-26T13:22:59.501178Z"}, {"uuid": "2f84ab52-92df-4d73-86cd-d8d455a59f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mdgkctufxn2a", "content": "", "creation_timestamp": "2026-01-27T20:00:02.071454Z"}, {"uuid": "76ce0446-d8c1-431d-a221-cfeef7f1fa77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mdhj4jhc5f2s", "content": "", "creation_timestamp": "2026-01-28T05:11:15.883566Z"}, {"uuid": "60bd3a37-aa0d-4ccd-8a33-0ef81b681704", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3miq6xzf6vp2e", "content": "", "creation_timestamp": "2026-04-05T07:09:43.063931Z"}, {"uuid": "1e5a8040-95ed-4173-9f14-0daa46d0cdfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-05)", "content": "", "creation_timestamp": "2026-04-05T00:00:00.000000Z"}, {"uuid": "07e03dd8-7859-4f6b-8808-e7297bbd8177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21854", "type": "published-proof-of-concept", "source": "Telegram/shQsG5TFmMrzus3uWOqA-vjUO4oHdrJHZ6Xu7ifps-_tm5s", "content": "", "creation_timestamp": "2026-01-07T20:04:13.000000Z"}, {"uuid": "ffc2cf88-220e-4d68-a104-b7aa6d23ff41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21855", "type": "published-proof-of-concept", "source": "Telegram/shQsG5TFmMrzus3uWOqA-vjUO4oHdrJHZ6Xu7ifps-_tm5s", "content": "", "creation_timestamp": "2026-01-07T20:04:13.000000Z"}, {"uuid": "d6dc08c9-d7b1-48ab-9a5f-b596ee199466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21856", "type": "published-proof-of-concept", "source": "Telegram/dVBBzDLnAvxAWJ1LkZD-2V6hkrnURxr4dyAmSZABM3K_GIM", "content": "", "creation_timestamp": "2026-01-07T20:04:29.000000Z"}, {"uuid": "b5507711-7057-471f-ab6f-b515b80c96cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21855", "type": "published-proof-of-concept", "source": "Telegram/dVBBzDLnAvxAWJ1LkZD-2V6hkrnURxr4dyAmSZABM3K_GIM", "content": "", "creation_timestamp": "2026-01-07T20:04:29.000000Z"}, {"uuid": "ccbee1d5-2867-46d7-8915-4291e3d6f6a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/yurukusa/8e7f0856edf44270ce8407287a02ec1b", "content": "", "creation_timestamp": "2026-04-19T03:57:34.000000Z"}, {"uuid": "8859e646-b91b-45b3-98fb-6bc4f55b9380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/LZnB2uRGjvSMX1a86_gYteJhuOo14W3NiFk2b0mfWdXAigg", "content": "", "creation_timestamp": "2026-04-17T09:00:04.000000Z"}, {"uuid": "50e2406a-89a8-4e1b-85eb-44c8b5b8ad1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/7881", "content": "\u0412 n8n \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0441\u0440\u0435\u0434\u044b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0445\u043e\u0441\u0442-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0442\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u043a\u0430\u043a CVE-2026-25049, \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u043b\u044e\u0431\u044b\u043c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u043f\u0440\u0430\u0432\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b, \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f RCE \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 n8n.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0418\u0411-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 n8n \u0438 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0445\u043e\u0434\u044f\u0442 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f CVE-2025-68613, \u0435\u0449\u0435 \u043e\u0434\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 20 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Pillar Security, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 CVE-2026-25049 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 n8n \u0438 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (\u043a\u043b\u044e\u0447\u0435\u0439 API, \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth) \u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0418\u0418.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 n8n \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0443\u044e \u0441\u0440\u0435\u0434\u0443, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u0430\u0440\u0435\u043d\u0434\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0440\u0438\u0447\u0435\u043c, \u043a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 \u0432 Pillar Security, \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0438\u0447\u0435\u0433\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0433\u043e: \u0435\u0441\u043b\u0438 \u0432\u044b \u0441\u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u0432\u044b \u0441\u043c\u043e\u0436\u0435\u0442\u0435 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n21 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2025 \u0433\u043e\u0434\u0430 Pillar \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 n8n \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043e\u0431\u0445\u043e\u0434\u043d\u044b\u0445 \u043f\u0443\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043e\u0431\u044a\u0435\u043a\u0442\u0443 Node.js, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043f\u043e \u0438\u0442\u043e\u0433\u0443 \u043a RCE.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043e \u0434\u0432\u0430 \u0434\u043d\u044f \u0441\u043f\u0443\u0441\u0442\u044f, \u043d\u043e \u0432 \u0445\u043e\u0434\u0435 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 Pillar \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0435\u0433\u043e \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0442\u0443, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u044d\u043a\u0432\u0438\u0432\u0430\u043b\u0435\u043d\u0442\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u043b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 n8n \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b 30 \u0434\u0435\u043a\u0430\u0431\u0440\u044f, \u0438 \u0432 \u0438\u0442\u043e\u0433\u0435 12 \u044f\u043d\u0432\u0430\u0440\u044f 2026 \u0433\u043e\u0434\u0430 n8n \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u0435\u0440\u0441\u0438\u044e 2.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Endor Labs \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043e\u0431\u0445\u043e\u0434\u043d\u044b\u0435 \u043f\u0443\u0442\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0438\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-25049 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e RCE-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.\n\n\u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0434\u043e 2.5.2 \u0438 1.123.17 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043a\u043b\u044e\u0447\u0438 \u043f\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043a \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0432 \u043a\u043e\u0434\u0435, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u044d\u0442\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043e\u0442\u0440\u0430\u0436\u0435\u043d\u0430 \u0432 \u0442\u0438\u043f\u0438\u0437\u0430\u0446\u0438\u0438 TypeScript, \u043d\u043e \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435\u0439 \u0442\u0438\u043f\u043e\u0432, \u0430 \u044d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 SecureLayer7 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0438 \u0438\u043c \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440\u0430 Function. \n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 PoC \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0433\u0430\u0439\u0434 \u043f\u043e \u044d\u0443\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\nCVE-2026-25049 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2025-68613 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043d\u0435\u0451, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0433\u043e n8n. \u041f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0431\u043e\u043b\u0435\u0435 150 \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u044b\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c n8n \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 (\u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f - 1.123.17 \u0438 2.5.2).\n\n\u0412 \u0438\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u043c\u0438 \u043c\u0435\u0440\u0430\u043c\u0438 \u043f\u043e \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439.\u00a0\n\nPillar Security \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0440\u043e\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0432\u0441\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\n\u041a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 CVE-2026-25049.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0440\u0430\u0441\u0442\u0443\u0449\u0430\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c n8n, \u043f\u043e-\u0432\u0438\u0434\u0438\u043c\u043e\u043c\u0443, \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\u00a0Ni8mare\u00a0(\u0431\u043e\u043b\u0435\u0435 33 000 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2026-21858 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438 n8n \u0441 27 \u044f\u043d\u0432\u0430\u0440\u044f \u043f\u043e 3 \u0444\u0435\u0432\u0440\u0430\u043b\u044f).", "creation_timestamp": "2026-02-05T14:53:03.000000Z"}, {"uuid": "9961f6f6-39e2-44eb-a733-4c86088d7ce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/cKure/15856", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit\n\nUnauthenticated to Root RCE:\n- LFI via Content-Type confusion\n- Read /proc/self/environ to find HOME\n- Steal encryption key + database\n- Forge admin JWT token\n- Expression injection sandbox bypass\n- RCE as root\n\nCVSS 10.0\n\nhttps://github.com/Chocapikk/CVE-2026-21858", "creation_timestamp": "2026-01-08T19:06:31.000000Z"}, {"uuid": "f8b34d47-1fa7-4d3f-8351-187148cbc9a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/haccking/12691", "content": "Ni8mare (CVE-2026-21858): \u043a\u0430\u043a \u043e\u0434\u0438\u043d HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a \u043f\u0440\u0438\u0432\u0451\u043b \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 n8n\n\n#\u0441\u0442\u0430\u0442\u044c\u044f #\u043f\u0435\u0440\u0435\u0432\u043e\u0434 #bugbounty\n\n\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 n8n. \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440: CVE-2026-21858 CVSS v.3.1: 10.0. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0437\u0434\u0435\u0441\u044c \u043d\u0435 \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0446\u0435\u043d\u043a\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438, \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0430\u043c\u0430 \u043f\u0440\u0438\u0447\u0438\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043a\u0430\u043a \u0435\u0451 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0412\u0441\u0451 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 Content-Type\u2026\n\n\u0421\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u0441\u0442\u0430\u0442\u044c\u044e\n\nLH | News | OSINT | AI", "creation_timestamp": "2026-03-06T17:04:07.000000Z"}, {"uuid": "5d597769-7b41-47ba-b686-37fb41e1a2ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/9WMKf2kSS4LmfKbr1b38eqo6oDsNfbP6lVEKaIuxRCI80ew", "content": "", "creation_timestamp": "2026-01-12T19:00:11.000000Z"}, {"uuid": "5c095bca-8ce4-4973-9171-e552d456929c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/0ln6CDnwyDBqOXy8lI1iw8ZmyXvW2AoBrPGhoxY4lBuN7No", "content": "", "creation_timestamp": "2026-01-12T21:00:04.000000Z"}, {"uuid": "726a8bb6-ce9b-43de-82df-5ec5b1873d02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/TcYn3MzV4f1_H9g7rYfdGNXWxfZIMISmNyplsFGHI8pJ-w", "content": "", "creation_timestamp": "2026-01-07T15:20:49.000000Z"}, {"uuid": "fc041db5-b99a-4816-9b53-6864c130e0a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/Z6KDFyAddhR_WTTdj8KLR9BqWCW4LVkYFOJnFavxpUnMZmU", "content": "", "creation_timestamp": "2026-01-08T03:00:07.000000Z"}, {"uuid": "cb123dfb-90ab-4e3c-8b59-5cc1d4d9bae8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/2ek7eyEQkPBVm_oE9OK31_C8c0inA6djA7KhdWeXyx-F_04", "content": "", "creation_timestamp": "2026-01-08T01:03:43.000000Z"}, {"uuid": "b6341665-4748-4467-9acb-e5dfb7e4e722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/h5P8bfRy51cnS-yezftJbVpEO2Om2ofhpc-g7kq6JaOtWVE", "content": "", "creation_timestamp": "2026-01-07T23:00:13.000000Z"}, {"uuid": "ceb00ad6-762b-40fb-9831-52dd7c04c530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21857", "type": "seen", "source": "Telegram/8hg5Gu2_QSQMEOVEXvwk_uKKrDJKBvTFN3ZFtq0-NHQh3Nk", "content": "", "creation_timestamp": "2026-01-08T00:04:16.000000Z"}, {"uuid": "91d10f44-6ef9-4a06-a232-15b747d9908c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/bin_z0ne/440", "content": "", "creation_timestamp": "2026-07-25T03:00:03.465443Z"}, {"uuid": "09c5997f-ce46-45cf-ac0f-580bfc1d1840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "Telegram/x22sgVl6GypPYOXXHn-wHtqct96K99W9IXpSyw6N9xLrkNY", "content": "", "creation_timestamp": "2026-07-30T15:00:05.207402Z"}, {"uuid": "1969c71c-f2f0-4edb-b588-88bc637b808b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/cyberok_news/173", "content": "\ud83c\udf84 \u0420\u043e\u0436\u0434\u0435\u0441\u0442\u0432\u0435\u043d\u0441\u043a\u0438\u0439 Ni8mare\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u0434\u043e\u043f\u0438\u0432\u0430\u044e\u0442 \u0433\u043b\u0438\u043d\u0442\u0432\u0435\u0439\u043d, \u0443 n8n \u2014 \u0441\u0432\u043e\u044f \u0440\u043e\u0436\u0434\u0435\u0441\u0442\u0432\u0435\u043d\u0441\u043a\u0430\u044f \u0441\u043a\u0430\u0437\u043a\u0430: \u0446\u0435\u043f\u043e\u0447\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u0447\u0442\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432, \u0430 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0430. \n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431 \n\u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0447\u0443\u0442\u044c \u043c\u0435\u043d\u0435\u0435 9000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 n8n \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 CyberOK, \u043e\u043a\u043e\u043b\u043e 70% \u2014 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b  \u0438\u0437-\u0437\u0430 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438/\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043e\u0437\u0438\u0446\u0438\u0438 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 webhook/form/endpoint-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432.\n\n\ud83e\udde9 \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \n\u042d\u0442\u043e \u043d\u0435 \u00ab\u043e\u0434\u0438\u043d \u0431\u0430\u0433\u00bb, \u0430 \u043d\u0430\u0431\u043e\u0440 \u043f\u0443\u0442\u0435\u0439-\u0434\u043e\u0440\u043e\u0436\u0435\u043a, \u0433\u0434\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u0442 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043d\u043e\u0434.\n\n1. CVE-2026-21858 \u2014 Arbitrary File Read (AFR)\n   \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432. \u041e\u0442\u043b\u0438\u0447\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u0432\u0445\u043e\u0434\u0430: \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0442\u043e\u043a\u0435\u043d\u044b, \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0435, \u043a\u043e\u043d\u0444\u0438\u0433\u0438.\n\n2. CVE-2026-21858 (AFR) + CVE-2025-68613 (RCE)\n   \u0415\u0441\u043b\u0438 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u043d\u0443\u0436\u043d\u044b\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b/\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u2014 \u0434\u0430\u043b\u044c\u0448\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n3. Pyodide Sandbox Escape \u2014 CVE-2025-68668 (\u043d\u0443\u0436\u0435\u043d Python Code Node)\n   \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442: \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0430\u043c, \u0433\u0434\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f Python Code Node. \u0417\u0430\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b \u0443 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0439.\n\n4. Expression Injection \u2014 CVE-2025-68613 (\u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445)\n   \u0421\u0430\u043c\u044b\u0439 \u201c\u043f\u0440\u0430\u043a\u0442\u0438\u0447\u043d\u044b\u0439\u201d \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e: \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0440\u0435\u0434\u043a\u0438\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0438 \u0447\u0430\u0449\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0434\u0435.\n\n\ud83e\udde0 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e\n\u2014 n8n - \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0437\u0430\u0434\u0430\u0447 \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0447\u0430\u0441\u0442\u043e \u0436\u0438\u0432\u0451\u0442 \u043a\u0430\u043a \u201c\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u043a\u043b\u0435\u0439\u201d \u0438 \u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u044b \u043a\u043e \u0432\u0441\u0435\u043c\u0443: API-\u043a\u043b\u044e\u0447\u0438, \u0442\u043e\u043a\u0435\u043d\u044b, \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, webhook-\u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n\u2014 AFR \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u201c\u0434\u043e\u0441\u0442\u0430\u043d\u044c \u0441\u0435\u043a\u0440\u0435\u0442 \u2192 \u0440\u0430\u0441\u0448\u0438\u0440\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u2192 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0441\u044c\u201d.\n\u2014 Expression Injection \u043d\u0430 \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u043f\u043e\u0440\u043e\u0433 \u0432\u0445\u043e\u0434\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0448\u0430\u043d\u0441 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0445 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0439.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438\n1. \u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c n8n \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 (\u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0446\u0435\u043f\u043e\u0447\u043a\u0443) \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0440\u0435\u043b\u0438\u0437-\u043d\u043e\u0442\u044b \u043f\u043e \u0432\u0441\u0435\u043c CVE \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435.\n2. \u0423\u0431\u0440\u0430\u0442\u044c n8n \u0438\u0437 \u043f\u0440\u044f\u043c\u043e\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u044d\u043a\u0441\u043f\u043e\u0437\u0438\u0446\u0438\u0438: VPN/allowlist/SSO, \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440, \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u044d\u043d\u0434\u043f\u043e\u0439\u043d\u0442\u043e\u0432.\n3. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0440\u0435\u0432\u0438\u0437\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 webhook/forms: \u043a\u0430\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u043d\u0443\u0436\u043d\u044b, \u043a\u0430\u043a\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0431\u0435\u0437 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0433\u0434\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n4. \u0420\u043e\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f: \u0435\u0441\u043b\u0438 \u0438\u043d\u0441\u0442\u0430\u043d\u0441 \u043c\u043e\u0433 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0438\u0437\u0432\u043d\u0435 \u2014 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b/\u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438.\n5. \u0414\u043b\u044f SOC: \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0434\u0435\u0442\u0435\u043a\u0442\u044b \u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u043c \u044d\u043d\u0434\u043f\u043e\u0439\u043d\u0442\u0430\u043c \u0438 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b workflow (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u043e\u043a\u0440\u0443\u0433 \u0444\u043e\u0440\u043c/\u0432\u0435\u0431\u0445\u0443\u043a\u043e\u0432).\n\n\u23f1\ufe0f \u0422\u0430\u0439\u043c\u043b\u0430\u0439\u043d \u0441\u0438\u0433\u043d\u0430\u043b\u043e\u0432\n\u2022 2025-11-18 \u2014 VENDOR_FIX_RELEASED\n\u0412\u044b\u0448\u043b\u0430 n8n 1.121.0 \u2014 \u0432\u0435\u0440\u0441\u0438\u044f \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c (\u043f\u0430\u0442\u0447 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438).\n\u2022 2026-01-07 \u2014 VULN_PUBLISHED\n\u0417\u0430\u043f\u0438\u0441\u044c CVE \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0432 NVD (published date).\n\u2022 2026-01-07 \u2014 VENDOR_ADVISORY_PUBLISHED\nGitHub Security Advisory (GHSA-v4pr-fm98-w9pg): affected >= 1.65.0 \u0438 < 1.121.0, patched 1.121.0, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 workaround \u043d\u0435\u0442.\n\u2022 2026-01-07 \u2014 THREAT_RESEARCH_PUBLISHED\n\u0422\u0435\u0445\u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 Cyera Research Labs: Ni8mare in n8n (CVE-2026-21858).\n\u2022 2026-01-07 11:09 \u2014 PUBLIC_POC_RELEASED\n\u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC (\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0441 \u043e\u0442\u043c\u0435\u0442\u043a\u043e\u0439 disclosure time).\n\n\ud83d\udd17 \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438\n\u2022 https://github.com/Chocapikk/CVE-2026-21858\n\u2022 https://nvd.nist.gov/vuln/detail/CVE-2025-68668\n\u2022 https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-08-04T14:00:21.714357Z"}, {"uuid": "754800c3-f349-4758-a2b4-92acee6bf6ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3msaadz3ujc2v", "content": "\u4e2d\u56fd\u8a9e\u570f\u306e\u653b\u6483\u8005\u3001DeepSeek\u3068Hermes Agent\u3067\u81ea\u5f8b\u578b \u30b5\u30a4\u30d0\u30fc\u653b\u6483\u3092\u5b9f\u884c Unit 42\u304c7\u4ef6\u306e\u8106\u5f31\u6027 \u60aa\u7528\u3092\u78ba\u8a8d(CVE-2026-33017,CVE-2026-21858\uff0fCVE-2025-68613)\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #cyberattack", "creation_timestamp": "2026-08-04T05:03:44.593183Z"}, {"uuid": "1395909d-cddf-4025-86bd-7173f40eb20b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "Telegram/x22sgVl6GypPYOXXHn-wHtqct96K99W9IXpSyw6N9xLrkNY", "content": "", "creation_timestamp": "2026-07-31T00:00:28.738757Z"}, {"uuid": "99b411a6-9982-4b93-8189-6675a043a894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-03)", "content": "", "creation_timestamp": "2026-08-04T10:15:09.699233Z"}, {"uuid": "7b312089-b7fa-4d12-af06-0bdfec35d575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/5589", "content": "Ni8mare\u200a - \u200aUnauthenticated Remote Code Execution in n8n (CVE-2026-21858) #Ni8mare #n8n #RCE #CVE202621858 #Vulnerability https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-08-01T22:00:05.104180Z"}, {"uuid": "9e21331c-f7b3-4981-8215-69536ff3b312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/5589", "content": "Ni8mare\u200a - \u200aUnauthenticated Remote Code Execution in n8n (CVE-2026-21858) #Ni8mare #n8n #RCE #CVE202621858 #Vulnerability https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-08-02T00:00:12.765940Z"}, {"uuid": "661a184b-8fc2-4e11-9185-af56d1378edb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/true_secator/8183", "content": "\u0421\u043e\u043b\u0430\u0440\u044b \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u0441 \u043e\u0431\u0437\u043e\u0440\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0435 \u0443\u0433\u0440\u043e\u0437 \u044d\u0442\u043e\u0433\u043e \u0442\u0438\u043f\u0430.\n\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b:\n\n- \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u044b\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u043c 2025 \u0433\u043e\u0434\u0430 \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043d\u0430 7% - \u0441 397 \u0434\u043e 426. \u0412 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0440\u043e\u0441\u0442 \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d \u0442\u0435\u043c \u0444\u0430\u043a\u0442\u043e\u043c, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 2026 \u0433\u043e\u0434\u0443, \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0435\u0449\u0435 \u0432 2025 \u0433\u043e\u0434\u0443.\n\n- \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0438\u043c\u0435\u043b\u0438 83,84% \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b 81%.\n\n- \u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b 8,1 \u0431\u0430\u043b\u043b\u0430. \u0412 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 - 7,8, \u0430 \u0433\u043e\u0434\u043e\u043c \u0440\u0430\u043d\u0435\u0435, \u043f\u043e \u0438\u0442\u043e\u0433\u0430\u043c \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 2025 \u0433\u043e\u0434\u0430, - 7,3.\n\n- 91,62% \u0432\u0441\u0435\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 HTTP. \u0411\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0439 \u00ab\u043f\u0440\u0435\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u00bb - TCP (3,07%).\n\n- \u041d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0440\u043e\u0432\u043d\u044f Critical \u0438 High \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c 72,06% - \u044d\u0442\u043e \u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0432\u044b\u0448\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 2025 \u0433\u043e\u0434\u0430 (69,3%), \u043d\u043e \u043b\u0438\u0448\u044c \u043d\u0435 \u043d\u0430\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0448\u0435, \u0447\u0435\u043c \u0431\u044b\u043b\u043e \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 (71,5%).\n\n-  \u0421\u0430\u043c\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c \u0443\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u0432 \u043f\u043e\u0434\u0440\u044f\u0434 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f WordPress \u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0433\u043e (18,13%).\n\n\u0414\u043e\u043b\u044f \u0442\u0430\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0431\u0449\u0435\u043c \u043e\u0431\u044a\u0435\u043c\u0435 \u0432\u044b\u0440\u043e\u0441\u043b\u0430 \u043d\u0430 4,7 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043d\u044b\u0445 \u043f\u0443\u043d\u043a\u0442\u0430 \u0432 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0441 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u044b\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u043c. \u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0441 \u043f\u0435\u0440\u0432\u044b\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430 WordPress \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u043b\u043e\u0441\u044c 22,4% \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u043d\u0430 \u0443\u043f\u0430\u043b\u0430.\n\n- \u041f\u043e\u0441\u043b\u0435 \u0441\u043f\u0430\u0434\u0430 \u0432 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u0432\u043d\u043e\u0432\u044c \u0432\u0435\u0440\u043d\u0443\u043b\u0430\u0441\u044c \u043a \u0440\u043e\u0441\u0442\u0443 \u0434\u043e\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0418\u0418-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445.\n\n\u041d\u0430 \u043d\u0438\u0445 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c 4,83%. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 - 9,2 \u0431\u0430\u043b\u043b\u0430. \u042d\u0442\u043e \u0441\u0430\u043c\u044b\u0439 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432-\u043b\u0438\u0434\u0435\u0440\u043e\u0432 \u043f\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0418\u0445 \u043d\u0430\u0445\u043e\u0434\u044f\u0442 \u0441\u0440\u0430\u0432\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0434\u043a\u043e, \u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u0431\u0440\u0435\u0448\u0435\u0439 \u0438\u043c\u0435\u044e\u0442 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438.\n\n\u041e\u0431\u0449\u0438\u043c \u0442\u0440\u0435\u043d\u0434\u043e\u043c \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0418\u0418-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u0422\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043d\u0438\u0445, \u043d\u0430 \u043c\u0430\u0440\u0442 2026 \u0433. \u0432 AI-\u0430\u0433\u0435\u043d\u0442\u0435 OpenClaw \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 522 CVE, \u0438 \u0435\u0436\u0435\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442\u0441\u044f, \u0447\u0442\u043e \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u043a\u0440\u0438\u0437\u0438\u0441\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 OpenClaw. ClawJacked - \u044d\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 AI-\u0430\u0433\u0435\u043d\u0442.\n\n\u0412 1-\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433. \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: CVE-2025-2304 (Camaleon CMS), CVE-2026-23744 (MCPJam Inspector), CVE-2026-21858 (n8n), CVE-2026-29000 (pac4j-jwt) \u0438 CVE-2026-21962 (Oracle Fusion Middleware).\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-05-07T16:20:06.000000Z"}, {"uuid": "d7428c06-426d-4c93-961a-e36ee89a51db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/htfgtps/1095", "content": "CVE-2026-21858\n\nn8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.\n\nGitHub Link:\nhttps://github.com/masterwok/PoC-CVE-2026-21858", "creation_timestamp": "2026-05-09T21:21:11.000000Z"}, {"uuid": "26402f92-bd7b-496f-9d1c-0700cafa51fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "Telegram/LMLCbCPtKqHKmPVUE-Sy6cYmEj33Wu5snoHY4cIkplvn7JY", "content": "", "creation_timestamp": "2026-07-31T22:00:02.844263Z"}, {"uuid": "68927999-9785-4262-b561-c15aa00764c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "Telegram/LMLCbCPtKqHKmPVUE-Sy6cYmEj33Wu5snoHY4cIkplvn7JY", "content": "", "creation_timestamp": "2026-08-01T00:00:10.825163Z"}, {"uuid": "50ed508f-91a1-44e3-94ca-4b9fbc3eafeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/CyberDispatch/468", "content": "Another CVSS 10.0 n8n vulnerability disclosed.\n\nResearchers found another critical flaw (CVE-2026-21858) in n8n that lets remote attackers take full control with no authentication required.\n\nThe bug abuses Content-Type handling in form webhooks to read local files, steal secrets, forge admin sessions, and achieve RCE.", "creation_timestamp": "2026-08-29T20:00:24.042193Z"}, {"uuid": "7448d205-e0c3-412a-9bd3-518242206459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmqz5tyqou26", "content": "~Checkpoint~\nAI models are now actively deployed in live attacks, including government breaches, mass exploitation, and PhaaS platforms.\n-\nIOCs: CVE-2025-59536, CVE-2026-21852, CVE-2026-33626\n-\n#AI #CyberCrime #ThreatIntel", "creation_timestamp": "2026-05-26T12:39:02.817178Z"}, {"uuid": "80c03032-9e9c-4cbf-a45f-8dfbc32d1087", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/cyberok_news/173", "content": "\ud83c\udf84 \u0420\u043e\u0436\u0434\u0435\u0441\u0442\u0432\u0435\u043d\u0441\u043a\u0438\u0439 Ni8mare\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u0434\u043e\u043f\u0438\u0432\u0430\u044e\u0442 \u0433\u043b\u0438\u043d\u0442\u0432\u0435\u0439\u043d, \u0443 n8n \u2014 \u0441\u0432\u043e\u044f \u0440\u043e\u0436\u0434\u0435\u0441\u0442\u0432\u0435\u043d\u0441\u043a\u0430\u044f \u0441\u043a\u0430\u0437\u043a\u0430: \u0446\u0435\u043f\u043e\u0447\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u0447\u0442\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432, \u0430 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0430. \n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431 \n\u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0447\u0443\u0442\u044c \u043c\u0435\u043d\u0435\u0435 9000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 n8n \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 CyberOK, \u043e\u043a\u043e\u043b\u043e 70% \u2014 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b  \u0438\u0437-\u0437\u0430 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438/\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043e\u0437\u0438\u0446\u0438\u0438 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 webhook/form/endpoint-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432.\n\n\ud83e\udde9 \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \n\u042d\u0442\u043e \u043d\u0435 \u00ab\u043e\u0434\u0438\u043d \u0431\u0430\u0433\u00bb, \u0430 \u043d\u0430\u0431\u043e\u0440 \u043f\u0443\u0442\u0435\u0439-\u0434\u043e\u0440\u043e\u0436\u0435\u043a, \u0433\u0434\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u0442 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043d\u043e\u0434.\n\n1. CVE-2026-21858 \u2014 Arbitrary File Read (AFR)\n   \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432. \u041e\u0442\u043b\u0438\u0447\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u0432\u0445\u043e\u0434\u0430: \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0442\u043e\u043a\u0435\u043d\u044b, \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0435, \u043a\u043e\u043d\u0444\u0438\u0433\u0438.\n\n2. CVE-2026-21858 (AFR) + CVE-2025-68613 (RCE)\n   \u0415\u0441\u043b\u0438 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u043d\u0443\u0436\u043d\u044b\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b/\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u2014 \u0434\u0430\u043b\u044c\u0448\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n3. Pyodide Sandbox Escape \u2014 CVE-2025-68668 (\u043d\u0443\u0436\u0435\u043d Python Code Node)\n   \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442: \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0430\u043c, \u0433\u0434\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f Python Code Node. \u0417\u0430\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b \u0443 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0439.\n\n4. Expression Injection \u2014 CVE-2025-68613 (\u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445)\n   \u0421\u0430\u043c\u044b\u0439 \u201c\u043f\u0440\u0430\u043a\u0442\u0438\u0447\u043d\u044b\u0439\u201d \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e: \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0440\u0435\u0434\u043a\u0438\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0438 \u0447\u0430\u0449\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0434\u0435.\n\n\ud83e\udde0 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e\n\u2014 n8n - \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0437\u0430\u0434\u0430\u0447 \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0447\u0430\u0441\u0442\u043e \u0436\u0438\u0432\u0451\u0442 \u043a\u0430\u043a \u201c\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u043a\u043b\u0435\u0439\u201d \u0438 \u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u044b \u043a\u043e \u0432\u0441\u0435\u043c\u0443: API-\u043a\u043b\u044e\u0447\u0438, \u0442\u043e\u043a\u0435\u043d\u044b, \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, webhook-\u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n\u2014 AFR \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u201c\u0434\u043e\u0441\u0442\u0430\u043d\u044c \u0441\u0435\u043a\u0440\u0435\u0442 \u2192 \u0440\u0430\u0441\u0448\u0438\u0440\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u2192 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0441\u044c\u201d.\n\u2014 Expression Injection \u043d\u0430 \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u043f\u043e\u0440\u043e\u0433 \u0432\u0445\u043e\u0434\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0448\u0430\u043d\u0441 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0445 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0439.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438\n1. \u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c n8n \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 (\u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0446\u0435\u043f\u043e\u0447\u043a\u0443) \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0440\u0435\u043b\u0438\u0437-\u043d\u043e\u0442\u044b \u043f\u043e \u0432\u0441\u0435\u043c CVE \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435.\n2. \u0423\u0431\u0440\u0430\u0442\u044c n8n \u0438\u0437 \u043f\u0440\u044f\u043c\u043e\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u044d\u043a\u0441\u043f\u043e\u0437\u0438\u0446\u0438\u0438: VPN/allowlist/SSO, \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440, \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u044d\u043d\u0434\u043f\u043e\u0439\u043d\u0442\u043e\u0432.\n3. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0440\u0435\u0432\u0438\u0437\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 webhook/forms: \u043a\u0430\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u043d\u0443\u0436\u043d\u044b, \u043a\u0430\u043a\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0431\u0435\u0437 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0433\u0434\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n4. \u0420\u043e\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f: \u0435\u0441\u043b\u0438 \u0438\u043d\u0441\u0442\u0430\u043d\u0441 \u043c\u043e\u0433 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0438\u0437\u0432\u043d\u0435 \u2014 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b/\u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438.\n5. \u0414\u043b\u044f SOC: \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0434\u0435\u0442\u0435\u043a\u0442\u044b \u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u043c \u044d\u043d\u0434\u043f\u043e\u0439\u043d\u0442\u0430\u043c \u0438 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b workflow (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u043e\u043a\u0440\u0443\u0433 \u0444\u043e\u0440\u043c/\u0432\u0435\u0431\u0445\u0443\u043a\u043e\u0432).\n\n\u23f1\ufe0f \u0422\u0430\u0439\u043c\u043b\u0430\u0439\u043d \u0441\u0438\u0433\u043d\u0430\u043b\u043e\u0432\n\u2022 2025-11-18 \u2014 VENDOR_FIX_RELEASED\n\u0412\u044b\u0448\u043b\u0430 n8n 1.121.0 \u2014 \u0432\u0435\u0440\u0441\u0438\u044f \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c (\u043f\u0430\u0442\u0447 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438).\n\u2022 2026-01-07 \u2014 VULN_PUBLISHED\n\u0417\u0430\u043f\u0438\u0441\u044c CVE \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0432 NVD (published date).\n\u2022 2026-01-07 \u2014 VENDOR_ADVISORY_PUBLISHED\nGitHub Security Advisory (GHSA-v4pr-fm98-w9pg): affected >= 1.65.0 \u0438 < 1.121.0, patched 1.121.0, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 workaround \u043d\u0435\u0442.\n\u2022 2026-01-07 \u2014 THREAT_RESEARCH_PUBLISHED\n\u0422\u0435\u0445\u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 Cyera Research Labs: Ni8mare in n8n (CVE-2026-21858).\n\u2022 2026-01-07 11:09 \u2014 PUBLIC_POC_RELEASED\n\u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC (\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0441 \u043e\u0442\u043c\u0435\u0442\u043a\u043e\u0439 disclosure time).\n\n\ud83d\udd17 \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438\n\u2022 https://github.com/Chocapikk/CVE-2026-21858\n\u2022 https://nvd.nist.gov/vuln/detail/CVE-2025-68668\n\u2022 https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-08-05T00:00:36.374158Z"}, {"uuid": "82068891-9c46-4149-8dc9-ca0d64780e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-15)", "content": "", "creation_timestamp": "2026-08-16T10:15:08.830194Z"}, {"uuid": "a53bda32-953c-4c56-9da8-8e30b0d5f0eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-21859", "type": "published-proof-of-concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr", "content": "", "creation_timestamp": "2026-01-06T02:23:06.000000Z"}, {"uuid": "801a478d-add5-4a46-b642-ec513803bf5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-21851", "type": "published-proof-of-concept", "source": "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-9rg3-9pvr-6p27", "content": "", "creation_timestamp": "2026-01-06T01:01:21.000000Z"}, {"uuid": "d99f810a-6582-4bbc-ba57-53986f66af9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-21857", "type": "published-proof-of-concept", "source": "https://github.com/redaxo/core/security/advisories/GHSA-824x-88xg-cwrv", "content": "", "creation_timestamp": "2026-01-05T18:27:44.000000Z"}, {"uuid": "85f58997-b797-4f6a-a769-f8c9518ef618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/astral100.bsky.social/post/3mmzuv4kgmh2l", "content": "C: Claude Code escaped its sandbox via /proc/self/root (Mar 2026, CVE-2026-21852). Source: ona.com/blog.\n\nD was designed to cluster with A and B \u2014 all three involve agents producing false records. But D has no external source, no CVE, no timeline. Internally coherent, externally orphaned.", "creation_timestamp": "2026-05-30T01:16:32.393751Z"}, {"uuid": "9929d346-c5d4-43a4-9be0-b68b49663129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mn4jisrb4f2i", "content": "Top 3 CVE for last 7 days:\nCVE-2026-48095: 19 interactions\nCVE-2026-0257: 17 interactions\nCVE-2026-26980: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0257: 14 interactions\nCVE-2026-21852: 3 interactions\nCVE-2026-39987: 3 interactions\n", "creation_timestamp": "2026-05-31T02:30:48.025135Z"}, {"uuid": "c9c9ff6e-81c9-4244-b801-3afe0920c6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/solonik_vouches/241", "content": "CVE-2026-21858 is an unauthenticated remote code execution vulnerability in the n8n workflow automation platform that exploits content-type header confusion to achieve arbitrary file reading, credential extraction, administrator session spoofing, and ultimately complete server compromise. A key development highlighted this week is the catastrophic radius of the n8n compromise: because n8n aggregates credentials from hundreds of integrated services (AWS, Azure, GitHub, Slack, databases), a single vulnerability allows lateral movement across an organization's entire digital infrastructure.\n\nDid you want full working script? Mass domain scan.", "creation_timestamp": "2026-08-18T18:00:03.995880Z"}, {"uuid": "33a40c58-d4ea-463a-9d02-bd61dc1235ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-07)", "content": "", "creation_timestamp": "2026-08-08T10:45:28.339393Z"}, {"uuid": "0715bdb5-ffbd-40b7-a81a-f2019a7aecd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21853", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnnamnj6ez2e", "content": "\ud83d\udccc CVE-2026-21853 - AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerabil... https://www.cyberhub.blog/cves/CVE-2026-21853", "creation_timestamp": "2026-06-06T18:07:07.914964Z"}, {"uuid": "4be48bcd-91fc-4c3f-8fa7-9473f8e7210e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-16)", "content": "", "creation_timestamp": "2026-08-17T10:15:07.201566Z"}, {"uuid": "be442a59-f61f-448d-9f5b-739570ac608f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://gist.github.com/khandar-william/a1ae7a335157d6a2a1dcb9abe1710327", "content": "# Dive into Claude Code: Core Technical Content\n\nReference: https://arxiv.org/pdf/2604.14228\n\n## Design Principles (Table 1)\n\n| Principle | Values Served | Design Question | Sections |\n|-----------|---------------|----------------|----------|\n| Deny-first with human escalation | Authority, Safety | Should unrecognized actions be allowed, blocked, or escalated to the human? | 5, 8, 9 |\n| Graduated trust spectrum | Authority, Adaptability | Fixed permission level, or a spectrum users traverse over time? | 5 |\n| Defense in depth with layered mechanisms | Safety, Authority, Reliability | Single safety boundary, or multiple overlapping ones using different techniques? | 3, 5 |\n| Externalized programmable policy | Safety, Authority, Adaptability | Hardcoded policy, or externalized configs with lifecycle hooks? | 5, 6 |\n| Context as scarce resource with progressive management | Reliability, Capability | What is the binding resource constraint, and how to manage it: single-pass truncation or graduated pipeline? | 4, 6, 7, 8 |\n| Append-only durable state | Reliability, Authority | Mutable state, checkpoint snapshots, or append-only logs? | 4, 9 |\n| Minimal scaffolding, maximal operational harness | Capability, Reliability | Invest in scaffolding-side reasoning, or operational infrastructure that lets the model reason freely? | 3, 4 |\n| Values over rules | Capability, Authority | Rigid decision procedures, or contextual judgment backed by deterministic guardrails? | 3, 5, 7 |\n| Composable multi-mechanism extensibility | Capability, Adaptability | One unified extension API, or layered mechanisms at different context costs? | 6 |\n| Reversibility-weighted risk assessment | Capability, Safety | Same oversight for all actions, or lighter for reversible and read-only ones? | 4, 5, 8 |\n| Transparent file-based configuration and memory | Adaptability, Authority | Opaque database, embedding-based retrieval, or user-visible version-controllable files? | 7 |\n| Isolated subagent boundaries | Reliability, Safety, Capability | Subagents share the parent's context and permissions, or operate in isolation? | 8 |\n| Graceful recovery and resilience | Reliability, Capability | Fail hard on errors, or silently recover and reserve human attention for unrecoverable situations? | 4, 5 |\n\n## High-Level System Structure (7 components)\n\n1. **User**: Submits prompts, approves permissions, reviews output.\n2. **Interfaces**: Interactive CLI, headless CLI (`claude -p`), Agent SDK, and IDE/Desktop/Browser.\n3. **Agent loop**: `queryLoop()` async generator in `query.ts`.\n4. **Permission system**: Deny-first rule evaluation (`permissions.ts`), auto-mode ML classifier, hook-based interception (`types/hooks.ts`).\n5. **Tools**: Up to 54 built-in tools (19 unconditional, 35 conditional) assembled via `assembleToolPool()` (`tools.ts`), merged with MCP-provided tools.\n6. **State & persistence**: Append-only JSONL session transcripts (`sessionStorage.ts`), global prompt history (`history.ts`), subagent sidechain files.\n7. **Execution environment**: Shell execution with optional sandboxing (`shouldUseSandbox.ts`), filesystem operations, web fetching, MCP server connections.\n\n## Five Subsystem Layers\n\n**Surface layer**: `src/entrypoints/` (SDK entry, coreTypes.ts, controlSchemas.ts, coreSchemas.ts), `src/screens/`, `src/components/` (ink framework).\n\n**Core layer**: `queryLoop()` async generator (`query.ts`), five sequential compaction shapers (`query.ts:365-453`).\n\n**Safety/action layer**: \n- Permission system (`permissions.ts`) with 7 permission modes (`types/permissions.ts`)\n- Auto-mode ML classifier (`yoloClassifier.ts`)\n- Hook pipeline spanning 27 event types (`coreTypes.ts`; output schemas in `types/hooks.ts`)\n- Tool pool assembly via `assembleToolPool()` (`tools.ts`)\n- Shell sandbox (`shouldUseSandbox.ts`)\n- Subagent spawning via `AgentTool` (`AgentTool.tsx`, `runAgent.ts`)\n\n**State layer**:\n- `getSystemContext()` and `getUserContext()` (`context.ts`) - memoized\n- `src/state/` - runtime application state\n- JSONL session transcripts at project-specific paths (`sessionStorage.ts`)\n- Four-level instruction hierarchy (`claudemd.ts`)\n- Sidechain transcripts (`sessionStorage.ts:247`)\n- Resume/fork operations (`conversationRecovery.ts`)\n\n**Backend layer**: `BashTool.tsx`, `PowerShellTool.tsx`, `src/remote/`, MCP client (`services/mcp/client.ts`), 42 tool subdirectories in `src/tools/`\n\n## Seven Independent Safety Layers\n\n1. **Tool pre-filtering** (`tools.ts`): Blanket-denied tools removed from model's view before any call.\n2. **Deny-first rule evaluation** (`permissions.ts`): Deny rules always take precedence over allow rules.\n3. **Permission mode constraints** (`types/permissions.ts`): Active mode determines baseline handling.\n4. **Auto-mode classifier**: ML-based classifier evaluates tool safety.\n5. **Shell sandboxing** (`shouldUseSandbox.ts`): Restricts filesystem and network access.\n6. **Not restoring permissions on resume** (`conversationRecovery.ts`): Session-scoped permissions not restored.\n7. **Hook-based interception** (`types/hooks.ts`): `PreToolUse` hooks modify permission decisions; `PermissionRequest` hooks resolve decisions.\n\n## Seven Permission Modes (`types/permissions.ts`)\n\n1. `plan`: Model must create plan; execution proceeds only after user approval.\n2. `default`: Standard interactive use. Most operations require user approval.\n3. `acceptEdits`: Edits within working directory and certain filesystem shell commands auto-approved.\n4. `auto`: ML-based classifier evaluates requests (gated by `TRANSCRIPT_CLASSIFIER`).\n5. `dontAsk`: No prompting, but deny rules still enforced.\n6. `bypassPermissions`: Skips most permission prompts, but safety-critical checks remain.\n7. `bubble`: Internal-only mode for subagent permission escalation to parent terminal.\n\n## Five Pre-Model Context Shapers (`query.ts` before every model call)\n\n1. **Budget reduction** (`applyToolResultBudget()`): Enforces per-message size limits on tool results, replaces oversized outputs with content references.\n2. **Snip** (`snipCompactIfNeeded()`, gated by `HISTORY_SNIP`): Lightweight trim removing older history segments.\n3. **Microcompact**: Fine-grained compression, always runs time-based path, optionally cache-aware path (gated by `CACHED_MICROCOMPACT`).\n4. **Context collapse** (gated by `CONTEXT_COLLAPSE`): Read-time projection over conversation history; summary messages live in collapse store, not REPL array.\n5. **Auto-compact**: Full model-generated summary via `compactConversation()` in `compact.ts`; fires only when context still exceeds pressure threshold after previous four shapers.\n\n## Four Extension Mechanisms (Section 6)\n\n**MCP servers**: Primary external tool integration. Configured from project, user, local, enterprise scopes. Client supports stdio, SSE, HTTP, WebSocket, SDK, IDE-specific variants.\n\n**Plugins**: Package and distribute bundles of MCP servers, skills, hooks, and commands.\n\n**Skills**: Domain-specific instructions injected into context; only frontmatter descriptions stay in prompt.\n\n**Hooks**: 27 hook events: tool authorization (PreToolUse, PostToolUse, PostToolUseFailure, PermissionRequest, PermissionDenied), session lifecycle (SessionStart, SessionEnd, Setup, Stop, StopFailure), user interaction (UserPromptSubmit, Elicitation, ElicitationResult), subagent coordination (SubagentStart, SubagentStop, Teammatedle, TaskCreated, TaskCompleted), context management (PreCompact, PostCompact, InstructionsLoaded, ConfigChange), workspace events (CwdChanged, FileChanged, WorktreeCreate, WorktreeRemove), notifications. Persisted hooks use four command types: `command`, `prompt`, `http`, `agent`.\n\n## CLAUDE.md Four-Level Hierarchy (`claudemd.ts`)\n\n1. **Managed memory** (`/etc/claude-code/CLAUDE.md`): OS-level policy for all users.\n2. **User memory** (`~/claude/CLAUDE.md`): Private global instructions.\n3. **Project memory** (`CLAUDE.md`, `claude/CLAUDE.md`, `.claude/rules/*.md` in project roots): Instructions checked into codebase.\n4. **Local memory** (`CLAUDE.local.md` in project roots): Git-ignored, private project-specific instructions.\n\nMemory files support `@include` directive for modular instruction sets. Syntax variants: `@path`, `@/relative`, `@~/home`, `@/absolute`. Works in leaf text nodes only (not inside code blocks).\n\n## Subagent Types (Section 8)\n\n**Built-in subagents**:\n- **Explore**: primarily read/search-oriented investigation, write/edit tools in deny-list\n- **Plan**: creates structured plans; execution proceeds through standard permission model\n- **General-purpose**: broadly capable, used when explicitly requested\n- **Claude Code Guide**: onboarding and documentation assistance with own permissionMode override\n- **Verification**: validation checks (test suites, linting)\n- **Statustime-setup**: terminal status line configuration\n\n**Custom subagents**: via `.claude/agents/*.md` files; YAML frontmatter specifies description, tools (allowlist), disallowedTools, model, effort, permissionMode, mcpServers, hooks, maxTurns, skills, memory scope, background flag, isolation mode.\n\n## Subagent Isolation Modes (`AgentTool.tsx`)\n\n- **Worktree**: Creates temporary git worktree, subagent gets its own copy of repository\n- **Remote** (internal-only): Launches in remote Claude Code Remote environment, always background\n- **In-process** (default): Shares filesystem with parent but operates in isolated conversation context\n\nPermission override logic (`runAgent.ts`): When subagent defines permissionMode, override applied unless parent already in `bypassPermissions`, `acceptEdits`, or `auto` mode (those always take precedence). Async agents: cascade of `canShowPermissionPrompts` first, then bubble mode, then default (sync show prompts, async do not).\n\n## Session Persistence (`sessionStorage.ts`)\n\nTranscript path: `join(projectDir, ${getSessionId()}.jsonl)`. Three independent persistence channels:\n\n1. **Session transcripts**: Conversation records (user, assistant, attachment, system messages, compaction markers, filehistory snapshots, attribution snapshots, content-replacement records)\n2. **Global prompt history**: `history.jsonl` at Claude configuration home directory (`history.ts`)\n3. **Subagent sidechains**: Separate `.jsonl` + `.meta.json` files per subagent\n\n`compact_boundary` marker records `headUuid`, `anchorUuid`, `tailUuid` via `annotateBoundaryWithPreservedSegment()` (`compact.ts`). Resume/fork (`conversationRecovery.ts`, `commands/branch/branch.ts`) do NOT restore session-scoped permissions.\n\n## Tool Pool Assembly Five-Step Pipeline (`tools.ts`)\n\n1. **Base tool enumeration**: `getAllBaseTools()` returns up to 54 tools (19 always included: BashTool, FileReadTool, AgentTool, SkillTool; 35 conditional)\n2. **Mode filtering**: `getTools()` applies mode-specific filtering; `CLAUDE_CODE_SIMPLE` mode only Bash, Read, Edit\n3. **Deny rule pre-filtering**: `filterToolsByDenyRules()` strips blanket-denied tools\n4. **MCP tool integration**: MCP tools from `appState.mcp.tools` filtered and merged\n5. **Deduplication**: By name, built-in tools take precedence over MCP tools\n\n## Tool Dispatch and Streaming Execution (`StreamingToolExecutor.ts`)\n\n- Sibling abort controller: Fires when any Bash tool errors, immediately terminating other in-flight subprocesses\n- Progress-available signal: Wakes up `getRemainingResults()` consumer when new output ready\n- Results buffered and emitted in order tools were received\n- Concurrent-read, serial-write execution model\n\n## Query Loop Stop Conditions\n\n1. No tool use (model produces only text content)\n2. Max turns (`maxTurns` limit reached)\n3. Context overflow (API returns `prompt_too_long`)\n4. Hook intervention (`PostToolUse` hook sets `hook_stopped_continuation`)\n5. Explicit abort (`abortController` signal fires)\n\n## Recovery Mechanisms\n\n- **Max output tokens escalation**: Up to three recovery attempts per turn (`MAX_OUTPUT_TOKENS_RECOVERY_LIMIT = 3`)\n- **Reactive compaction** (gated by `REACTIVE_COMPACT`): Summarizes just enough to free space; `hasAttemptedReactiveCompact` flag ensures at most once per turn\n- **Prompt-too-long handling**: First attempts context collapse overflow recovery and reactive compaction\n- **Streaming fallback**: `onStreamingFallback` callback handles streaming API issues\n- **Fallback model**: `fallbackModel` parameter enables switching to alternative model\n\n## 27 Hook Events (`coreTypes.ts`, `types/hooks.ts`)\n\nPermission flow hooks (5):\n- `PreToolUse`: returns `permissionDecision` (deny/ask), `permissionDecisionReason`, `updatedInput`\n- `PostToolUse`: injects `additionalContext`, for MCP tools returns `updatedMCPToolOutput`\n- `PostToolUseFailure`: injects `additionalContext` for error-specific guidance\n- `PermissionDenied`: provides retry guidance after auto-mode denials\n- `PermissionRequest`: returns `allow` or `deny` decision\n\nOther hook types: Session lifecycle, user interaction, subagent coordination, context management, workspace events, notifications.\n\nHook command types: `command` (shell), `prompt` (LLM), `http`, `agent` (agentic verifier), plus non-persistable `callback`.\n\n## MCP Client Transport Types (`services/mcp/client.ts`)\n\nstdio, SSE, HTTP, WebSocket, SDK, sse-ide, ws-ide\n\n## Context Injection Points (late injection after main window constructed)\n\n- Relevant-memory prefetch (`query.ts`)\n- MCP instructions deltas (new or changed server instructions)\n- Agent listing deltas\n- Background agent task notifications\n\n## File Structure Key Files\n\n| File | Size | Responsibility |\n|------|------|----------------|\n| `main.tsx` | 804KB | Entry point, mode dispatch, setup |\n| `query.ts` | 68KB | Core agent loop, 5 context shapers |\n| `QueryEngine.ts` | 47KB | SDK/headless conversation wrapper |\n| `Tool.ts` | 30KB | Tool interface, types, utilities |\n| `history.ts` | 14KB | Global prompt history |\n| `mcp/client.ts` | Large | MCP client (8+ transport variants) |\n| `compact.ts` | Large | Compaction engine |\n| `AgentTool.tsx` | Large | Agent tool, subagent dispatch |\n| `runAgent.ts` | Large | 21-parameter agent lifecycle |\n\n## Conditional Tool Availability Categories (`tools.ts`)\n\n- **Always included**: AgentTool, BashTool, FileReadTool, FileEditTool, FileWriteTool, SkillTool, WebFetchTool, WebSearchTool\n- **Environment**: GlobTool/GrepTool (unless embedded), ConfigTool (internal-only), PowerShellTool (Windows)\n- **Feature flag**: TaskCreate/Get/Update/List (todoV2), EnterWorktreeTool (worktree), TeamTools (swarms), ToolSearchTool\n- **Null-checked**: SuggestBackgroundPRTool, WebBrowserTool, RemoteTriggerTool, MonitorTool, SleepTool\n\n## Context Window Assembly Sources (Figure 6)\n\n1. System prompt (output style modifications, `--append-system-prompt` flag)\n2. Environment info via `getSystemContext()` (`context.ts`): git status, optional cache-breaking injection\n3. CLAUDE.md hierarchy via `getUserContext()` (`context.ts`)\n4. Path-scoped rules (conditional and directory-matched rules, lazy load)\n5. Auto memory (contextually relevant memory entries prefetched asynchronously)\n6. Tool metadata (skill descriptions, MCP tool names, deferred tool definitions via ToolSearch)\n7. Conversation history (subject to compaction)\n8. Tool results (file reads, command outputs, subagent summaries)\n9. Compact summaries (replacing older history segments)\n\n## Compacted Output Structure (`buildPostCompactMessages()` in `compact.ts`)\n\n```\n[boundaryMarker, ...summaryMessages, ...messagesToKeep, ...attachments, ...hookResults]\n```\n\nBoundary marker annotated with `headUuid`, `anchorUuid`, `tailUuid` via `annotateBoundaryWithPreservedSegment()`.\n\n## `runAgent()` 21 Parameters (`runAgent.ts`)\n\nAgent definition, prompts, permissions, tools, model settings, isolation, callbacks.\n\n## Two-Tier Permission Scoping for Subagents (`runAgent.ts`)\n\n- SDK-level permissions from `allowedTools` preserved (\"explicit permissions from the SDK consumer that should apply to all agents\")\n- Session-level rules replaced with subagent's declared `allowedTools`\n- When `allowedTools` not provided (common AgentTool path), parent's session-level rules inherited without replacement\n\n## Agent Teams Coordination\n\nFile locking rather than message broker or distributed coordination service. Tasks claimed from shared list via lock-file-based mutual exclusion. Lock files stored at predictable filesystem paths.\n\n## Security Vulnerabilities Documented\n\n- Commands with >50 subcommands fall back to single generic approval prompt instead of per-subcommand deny-rule checks (Adversa.ai, 2026)\n- Pre-trust initialization ordering: hooks, MCP server connections, settings file resolution run before interactive trust dialog (Donenfeld and Vanunu, 2026; CVE-2025-59536 CVSS 8.7, CVE-2026-21852 CVSS 5.3)\n- Multiple CVEs exploit pre-trust initialization of hooks and MCP servers\n\n## Empirical Data Points\n\n- 1.6% of codebase constitutes AI decision logic; 98.4% operational infrastructure\n- Users approve approximately 93% of permission prompts (Hughes, 2026)\n- Auto-approve rates increase from ~20% at <50 sessions to >40% by 750 sessions (McCain et al., 2026)\n- Sandboxing reduced permission prompt frequency by estimated 84% (Dworken and Weller-Davies, 2025)\n- Agent teams consume approximately 7\u00d7 tokens of standard session in plan mode (Anthropic, 2025b)\n- 27% of Claude Code-assisted tasks were work not attempted without the tool (Huang et al., 2025)\n- Developers in AI-assisted conditions scored 17% lower on comprehension tests (Shen and Tamkin, 2026)\n- Causal analysis of Cursor adoption across 807 repositories: code complexity increased by 40.7% (He et al., 2025)\n- AI tools made developers 19% slower despite perceived 20% improvement (Becker et al., 2025)\n- 304,000 AI-authored commits across 6,275 repositories: ~25% of AI-introduced issues persist to latest revision (Liu et al., 2026)", "creation_timestamp": "2026-06-15T11:06:36.000000Z"}, {"uuid": "51b79d8d-9b4f-4a34-b981-70f5ce4608d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/cyberok_news/173", "content": "\ud83c\udf84 \u0420\u043e\u0436\u0434\u0435\u0441\u0442\u0432\u0435\u043d\u0441\u043a\u0438\u0439 Ni8mare\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u0434\u043e\u043f\u0438\u0432\u0430\u044e\u0442 \u0433\u043b\u0438\u043d\u0442\u0432\u0435\u0439\u043d, \u0443 n8n \u2014 \u0441\u0432\u043e\u044f \u0440\u043e\u0436\u0434\u0435\u0441\u0442\u0432\u0435\u043d\u0441\u043a\u0430\u044f \u0441\u043a\u0430\u0437\u043a\u0430: \u0446\u0435\u043f\u043e\u0447\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u0447\u0442\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432, \u0430 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0430. \n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431 \n\u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0447\u0443\u0442\u044c \u043c\u0435\u043d\u0435\u0435 9000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 n8n \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 CyberOK, \u043e\u043a\u043e\u043b\u043e 70% \u2014 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b  \u0438\u0437-\u0437\u0430 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438/\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043e\u0437\u0438\u0446\u0438\u0438 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 webhook/form/endpoint-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432.\n\n\ud83e\udde9 \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \n\u042d\u0442\u043e \u043d\u0435 \u00ab\u043e\u0434\u0438\u043d \u0431\u0430\u0433\u00bb, \u0430 \u043d\u0430\u0431\u043e\u0440 \u043f\u0443\u0442\u0435\u0439-\u0434\u043e\u0440\u043e\u0436\u0435\u043a, \u0433\u0434\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u0442 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043d\u043e\u0434.\n\n1. CVE-2026-21858 \u2014 Arbitrary File Read (AFR)\n   \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432. \u041e\u0442\u043b\u0438\u0447\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u0432\u0445\u043e\u0434\u0430: \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0442\u043e\u043a\u0435\u043d\u044b, \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0435, \u043a\u043e\u043d\u0444\u0438\u0433\u0438.\n\n2. CVE-2026-21858 (AFR) + CVE-2025-68613 (RCE)\n   \u0415\u0441\u043b\u0438 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u043d\u0443\u0436\u043d\u044b\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b/\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u2014 \u0434\u0430\u043b\u044c\u0448\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n3. Pyodide Sandbox Escape \u2014 CVE-2025-68668 (\u043d\u0443\u0436\u0435\u043d Python Code Node)\n   \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442: \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0430\u043c, \u0433\u0434\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f Python Code Node. \u0417\u0430\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b \u0443 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0439.\n\n4. Expression Injection \u2014 CVE-2025-68613 (\u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445)\n   \u0421\u0430\u043c\u044b\u0439 \u201c\u043f\u0440\u0430\u043a\u0442\u0438\u0447\u043d\u044b\u0439\u201d \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e: \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0440\u0435\u0434\u043a\u0438\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0438 \u0447\u0430\u0449\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0434\u0435.\n\n\ud83e\udde0 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e\n\u2014 n8n - \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0437\u0430\u0434\u0430\u0447 \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0447\u0430\u0441\u0442\u043e \u0436\u0438\u0432\u0451\u0442 \u043a\u0430\u043a \u201c\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u043a\u043b\u0435\u0439\u201d \u0438 \u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u044b \u043a\u043e \u0432\u0441\u0435\u043c\u0443: API-\u043a\u043b\u044e\u0447\u0438, \u0442\u043e\u043a\u0435\u043d\u044b, \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, webhook-\u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n\u2014 AFR \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u201c\u0434\u043e\u0441\u0442\u0430\u043d\u044c \u0441\u0435\u043a\u0440\u0435\u0442 \u2192 \u0440\u0430\u0441\u0448\u0438\u0440\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u2192 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0441\u044c\u201d.\n\u2014 Expression Injection \u043d\u0430 \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u043f\u043e\u0440\u043e\u0433 \u0432\u0445\u043e\u0434\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0448\u0430\u043d\u0441 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0445 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0439.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438\n1. \u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c n8n \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 (\u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0446\u0435\u043f\u043e\u0447\u043a\u0443) \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0440\u0435\u043b\u0438\u0437-\u043d\u043e\u0442\u044b \u043f\u043e \u0432\u0441\u0435\u043c CVE \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435.\n2. \u0423\u0431\u0440\u0430\u0442\u044c n8n \u0438\u0437 \u043f\u0440\u044f\u043c\u043e\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u044d\u043a\u0441\u043f\u043e\u0437\u0438\u0446\u0438\u0438: VPN/allowlist/SSO, \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440, \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u044d\u043d\u0434\u043f\u043e\u0439\u043d\u0442\u043e\u0432.\n3. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0440\u0435\u0432\u0438\u0437\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 webhook/forms: \u043a\u0430\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u043d\u0443\u0436\u043d\u044b, \u043a\u0430\u043a\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0431\u0435\u0437 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0433\u0434\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n4. \u0420\u043e\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f: \u0435\u0441\u043b\u0438 \u0438\u043d\u0441\u0442\u0430\u043d\u0441 \u043c\u043e\u0433 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0438\u0437\u0432\u043d\u0435 \u2014 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b/\u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438.\n5. \u0414\u043b\u044f SOC: \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0434\u0435\u0442\u0435\u043a\u0442\u044b \u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u043c \u044d\u043d\u0434\u043f\u043e\u0439\u043d\u0442\u0430\u043c \u0438 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b workflow (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u043e\u043a\u0440\u0443\u0433 \u0444\u043e\u0440\u043c/\u0432\u0435\u0431\u0445\u0443\u043a\u043e\u0432).\n\n\u23f1\ufe0f \u0422\u0430\u0439\u043c\u043b\u0430\u0439\u043d \u0441\u0438\u0433\u043d\u0430\u043b\u043e\u0432\n\u2022 2025-11-18 \u2014 VENDOR_FIX_RELEASED\n\u0412\u044b\u0448\u043b\u0430 n8n 1.121.0 \u2014 \u0432\u0435\u0440\u0441\u0438\u044f \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c (\u043f\u0430\u0442\u0447 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438).\n\u2022 2026-01-07 \u2014 VULN_PUBLISHED\n\u0417\u0430\u043f\u0438\u0441\u044c CVE \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0432 NVD (published date).\n\u2022 2026-01-07 \u2014 VENDOR_ADVISORY_PUBLISHED\nGitHub Security Advisory (GHSA-v4pr-fm98-w9pg): affected >= 1.65.0 \u0438 < 1.121.0, patched 1.121.0, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 workaround \u043d\u0435\u0442.\n\u2022 2026-01-07 \u2014 THREAT_RESEARCH_PUBLISHED\n\u0422\u0435\u0445\u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 Cyera Research Labs: Ni8mare in n8n (CVE-2026-21858).\n\u2022 2026-01-07 11:09 \u2014 PUBLIC_POC_RELEASED\n\u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC (\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0441 \u043e\u0442\u043c\u0435\u0442\u043a\u043e\u0439 disclosure time).\n\n\ud83d\udd17 \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438\n\u2022 https://github.com/Chocapikk/CVE-2026-21858\n\u2022 https://nvd.nist.gov/vuln/detail/CVE-2025-68668\n\u2022 https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-08-06T00:00:56.980796Z"}, {"uuid": "c899ec88-cc67-4166-bd25-b970cb92a5f3", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/769d053b-f9cf-4f35-8fb6-17e7b4fb1790", "content": "", "creation_timestamp": "2026-06-19T12:45:41.223850Z"}, {"uuid": "6e4e759e-5388-411d-9f54-6a8ce3a5a9b2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/af96860d-c819-4f08-b6d8-0e0f28763ce1", "content": "", "creation_timestamp": "2026-06-23T14:03:09.897184Z"}, {"uuid": "a0d18cf8-4f64-445c-b6bb-e1809eea8cc2", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1a581b3a-8460-4d4c-93ce-db446e30051b", "content": "", "creation_timestamp": "2026-06-30T09:23:55.153946Z"}, {"uuid": "c5763307-b6b1-49f9-a064-3341e0de7395", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/solonik_vouches/241", "content": "CVE-2026-21858 is an unauthenticated remote code execution vulnerability in the n8n workflow automation platform that exploits content-type header confusion to achieve arbitrary file reading, credential extraction, administrator session spoofing, and ultimately complete server compromise. A key development highlighted this week is the catastrophic radius of the n8n compromise: because n8n aggregates credentials from hundreds of integrated services (AWS, Azure, GitHub, Slack, databases), a single vulnerability allows lateral movement across an organization's entire digital infrastructure.\n\nDid you want full working script? Mass domain scan.", "creation_timestamp": "2026-08-19T00:00:10.313374Z"}, {"uuid": "3e0ca562-407b-4859-a4ee-4f30ace90049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://bsky.app/profile/stupidllm.bsky.social/post/3mtlupmcfqr2a", "content": "CVE-2026-21852: Claude Code processed a repo's ANTHROPIC_BASE_URL override \u2014 and sent live API requests, key included, to that endpoint \u2014 before the workspace trust prompt ever appeared. Just opening a malicious repo was enough. Fixed in 2.0.65. https://www.stupidllm.com/incident/STUPID-2026-0083/", "creation_timestamp": "2026-08-21T13:32:32.513564Z"}, {"uuid": "d17e2826-08c4-49e7-bac4-5d0058561866", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/CyberSecurityExploit/29859", "content": "\ud83d\udee1 CVE-2026-21852-PoC (Educational Demo Repo)\n\ud83d\udce6 Repository: atiilla/CVE-2026-21852-PoC\n\ud83d\udc49 https://github.com/atiilla/CVE-2026-21852-PoC\n\nThis repository demonstrates historical PoC patterns for vulnerabilities in the Anthropic Claude Code CLI tool, including CVE-2026-21852, designed for educational purposes only.\n\n\ud83d\udccc What This Repo Contains\n\ud83d\udcc2 Demo directories for historical bugs\nExamples show how malicious config files can influence tool behavior\n\n\ud83d\udc0d Python scripts:\n\u2022 attacker_server.py \u2013 Local server to capture and log simulated traffic\n\u2022 attacker_proxy.py \u2013 Proxy for observing exfiltration behavior\n\u2022 scanner.py \u2013 Scanner to detect risky patterns in local repositories\n\n\ud83d\udcc1 Demo content directories include:\n\u2022 vuln1_hooks_bypass/\n\u2022 CVE-2025-59536_mcp_injection/\n\u2022 CVE-2026-21852_api_exfil/\n(Configuration files under these folders illustrate pattern examples.)\n\n\ud83e\udde0 Vulnerabilities Covered\nThe project explores multiple vulnerabilities historically disclosed for Claude Code CLI:\n\u26a0\ufe0f Hooks consent bypass \u2013 bypasses consent mechanisms (older build)\n\u26a0\ufe0f CVE-2025-59536 \u2013 MCP config injection \u2013 orchestration config risk\n\u26a0\ufe0f CVE-2026-21852 \u2013 API key disclosure \u2013 config causes API key to be sent before trust verification\nThe vulnerability CVE-2026-21852 identified that malicious repository settings could exfiltrate API keys prior to showing a trust prompt in affected Claude Code versions.\n\n\ud83c\udfaf How the Repo Can Be Used (Education Only)\n\ud83d\udccc Scanner\npython3 scanner.py \nDetects dangerous config patterns that could be risky before opening repositories.\n\n\ud83d\udccc Local Demo Server\npython3 attacker_server.py\nSimulates a server to log simulated exfiltration traffic.\n\n\ud83d\udccc Proxy Demo\npython3 attacker_proxy.py\nTransparent proxy to illustrate capture behavior.\n\n\ud83e\udde0 What You Learn Here\n\u2714\ufe0f How untrusted configuration files can impact tool behavior\n\u2714\ufe0f Why verifying repository contents before opening is important\n\u2714\ufe0f The concept of pre-execution key leakage (API exfiltration)\n\u2714\ufe0f How scanners can detect repository risk patterns\nThese skills are valuable in secure dev workflows, supply chain security, and blue team defensive validation.\n\n\u26a0\ufe0f Important Notes (Responsible Use)\n\u2705 This repository is for security research and learning only.\n\u274c Do NOT deploy these scripts against third-party or production systems.\n\u274c Never open untrusted repositories in real tools without inspection.\n\u2696\ufe0f Always practice ethical/authorized testing and use isolated lab environments.\n\n\ud83d\udccc Additional Reference: CVE-2026-21852 Description\n\ud83d\udccc The vulnerability CVE-2026-21852 pertains to an information disclosure issue in Claude Code \n       where repository settings could cause premature API calls before trust confirmation, risking API key exfiltration.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:07.335128Z"}, {"uuid": "6308cca7-602d-4fd5-874b-d77f4682a2a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "Telegram/9p3OCYA2gPvpSRgsWdiENIOPl2jc7APUWoAxqJhsRixh", "content": "", "creation_timestamp": "2026-08-19T23:00:03.859147Z"}, {"uuid": "42261a0c-e863-48c9-a248-bf08ef9a1390", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "Telegram/9p3OCYA2gPvpSRgsWdiENIOPl2jc7APUWoAxqJhsRixh", "content": "", "creation_timestamp": "2026-08-20T00:00:07.045536Z"}, {"uuid": "a30d6377-0a76-49d4-8896-eed4ec59f59b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/brutsecurity/2443", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit\n\nUnauthenticated to Root RCE:\n- LFI via Content-Type confusion\n- Read /proc/self/environ to find HOME\n- Steal encryption key + database\n- Forge admin JWT token\n- Expression injection sandbox bypass\n- RCE as root\n\nCVSS 10.0\n\nhttps://github.com/Chocapikk/CVE-2026-21858", "creation_timestamp": "2026-07-09T03:00:06.052933Z"}, {"uuid": "287a63b5-0bbe-4b15-b8ee-e4b05a0b9be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/brutsecurity/2443", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit\n\nUnauthenticated to Root RCE:\n- LFI via Content-Type confusion\n- Read /proc/self/environ to find HOME\n- Steal encryption key + database\n- Forge admin JWT token\n- Expression injection sandbox bypass\n- RCE as root\n\nCVSS 10.0\n\nhttps://github.com/Chocapikk/CVE-2026-21858", "creation_timestamp": "2026-07-10T00:00:13.473969Z"}, {"uuid": "7f096b18-8b7a-43df-b0a9-4a9f3075be26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/29859", "content": "\ud83d\udee1 CVE-2026-21852-PoC (Educational Demo Repo)\n\ud83d\udce6 Repository: atiilla/CVE-2026-21852-PoC\n\ud83d\udc49 https://github.com/atiilla/CVE-2026-21852-PoC\n\nThis repository demonstrates historical PoC patterns for vulnerabilities in the Anthropic Claude Code CLI tool, including CVE-2026-21852, designed for educational purposes only.\n\n\ud83d\udccc What This Repo Contains\n\ud83d\udcc2 Demo directories for historical bugs\nExamples show how malicious config files can influence tool behavior\n\n\ud83d\udc0d Python scripts:\n\u2022 attacker_server.py \u2013 Local server to capture and log simulated traffic\n\u2022 attacker_proxy.py \u2013 Proxy for observing exfiltration behavior\n\u2022 scanner.py \u2013 Scanner to detect risky patterns in local repositories\n\n\ud83d\udcc1 Demo content directories include:\n\u2022 vuln1_hooks_bypass/\n\u2022 CVE-2025-59536_mcp_injection/\n\u2022 CVE-2026-21852_api_exfil/\n(Configuration files under these folders illustrate pattern examples.)\n\n\ud83e\udde0 Vulnerabilities Covered\nThe project explores multiple vulnerabilities historically disclosed for Claude Code CLI:\n\u26a0\ufe0f Hooks consent bypass \u2013 bypasses consent mechanisms (older build)\n\u26a0\ufe0f CVE-2025-59536 \u2013 MCP config injection \u2013 orchestration config risk\n\u26a0\ufe0f CVE-2026-21852 \u2013 API key disclosure \u2013 config causes API key to be sent before trust verification\nThe vulnerability CVE-2026-21852 identified that malicious repository settings could exfiltrate API keys prior to showing a trust prompt in affected Claude Code versions.\n\n\ud83c\udfaf How the Repo Can Be Used (Education Only)\n\ud83d\udccc Scanner\npython3 scanner.py \nDetects dangerous config patterns that could be risky before opening repositories.\n\n\ud83d\udccc Local Demo Server\npython3 attacker_server.py\nSimulates a server to log simulated exfiltration traffic.\n\n\ud83d\udccc Proxy Demo\npython3 attacker_proxy.py\nTransparent proxy to illustrate capture behavior.\n\n\ud83e\udde0 What You Learn Here\n\u2714\ufe0f How untrusted configuration files can impact tool behavior\n\u2714\ufe0f Why verifying repository contents before opening is important\n\u2714\ufe0f The concept of pre-execution key leakage (API exfiltration)\n\u2714\ufe0f How scanners can detect repository risk patterns\nThese skills are valuable in secure dev workflows, supply chain security, and blue team defensive validation.\n\n\u26a0\ufe0f Important Notes (Responsible Use)\n\u2705 This repository is for security research and learning only.\n\u274c Do NOT deploy these scripts against third-party or production systems.\n\u274c Never open untrusted repositories in real tools without inspection.\n\u2696\ufe0f Always practice ethical/authorized testing and use isolated lab environments.\n\n\ud83d\udccc Additional Reference: CVE-2026-21852 Description\n\ud83d\udccc The vulnerability CVE-2026-21852 pertains to an information disclosure issue in Claude Code \n       where repository settings could cause premature API calls before trust confirmation, risking API key exfiltration.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:23.886040Z"}, {"uuid": "4334d780-8eab-438d-b735-62f26808a036", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/brutsecurity/2443", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit\n\nUnauthenticated to Root RCE:\n- LFI via Content-Type confusion\n- Read /proc/self/environ to find HOME\n- Steal encryption key + database\n- Forge admin JWT token\n- Expression injection sandbox bypass\n- RCE as root\n\nCVSS 10.0\n\nhttps://github.com/Chocapikk/CVE-2026-21858", "creation_timestamp": "2026-07-11T11:00:04.893851Z"}, {"uuid": "b9c05282-6fed-4f53-b432-efcd6e8bd4ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/brutsecurity/2443", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit\n\nUnauthenticated to Root RCE:\n- LFI via Content-Type confusion\n- Read /proc/self/environ to find HOME\n- Steal encryption key + database\n- Forge admin JWT token\n- Expression injection sandbox bypass\n- RCE as root\n\nCVSS 10.0\n\nhttps://github.com/Chocapikk/CVE-2026-21858", "creation_timestamp": "2026-07-12T00:00:51.532699Z"}, {"uuid": "7b9dd473-2aaa-4640-b406-c022551aa60a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/GithubRedTeam/92154", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sh4den\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 3  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-06 08:39:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of Concept: CVE-2026-21858 is vulnerability on n8n where unauthenticated remote attackers can access sensitive files.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:11.347728Z"}, {"uuid": "609e55ba-bb3a-4179-9b62-ab15dfcd38b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/GithubRedTeam/89951", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a dotclaude-security\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Perufitlife\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 11:51:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untrusted repository. Static, zero-dep, local-first.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:22.045831Z"}, {"uuid": "2f74c3ac-c367-4f75-a12d-e47763a999e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/GithubRedTeam/89978", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Fomovet\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 14:31:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-21858\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:21.758084Z"}, {"uuid": "7097a33e-a9c1-41af-ab07-3df3c965b4a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/GithubRedTeam/92154", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sh4den\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 3  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-06 08:39:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of Concept: CVE-2026-21858 is vulnerability on n8n where unauthenticated remote attackers can access sensitive files.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:19.760919Z"}, {"uuid": "814c2346-fbb9-4263-9b32-a046a7c69beb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/GithubRedTeam/89978", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Fomovet\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 14:31:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-21858\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:37.666973Z"}, {"uuid": "91df4095-c041-430f-90d6-93192469745d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/GithubRedTeam/89951", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a dotclaude-security\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Perufitlife\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 11:51:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untrusted repository. Static, zero-dep, local-first.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:37.916339Z"}, {"uuid": "3d6799c3-d351-4a35-b5c9-3a60f9c7a377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89978", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Fomovet\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 14:31:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-21858\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:18.860682Z"}, {"uuid": "44f72b8f-a0ea-43b5-80eb-dad0d0d73cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/GithubRedTeam/89951", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a dotclaude-security\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Perufitlife\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 11:51:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untrusted repository. Static, zero-dep, local-first.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:18.673937Z"}, {"uuid": "8cfb8a00-d05b-42cf-acef-21646d6446be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92154", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sh4den\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 3  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-06 08:39:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of Concept: CVE-2026-21858 is vulnerability on n8n where unauthenticated remote attackers can access sensitive files.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:30.456099Z"}, {"uuid": "493cdc74-22f6-4bab-9c62-bbc77067ba33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-14)", "content": "", "creation_timestamp": "2026-07-15T10:15:06.728216Z"}, {"uuid": "5b9e114d-eecf-41cb-82ca-ebf29ec93d98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17066", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are fresh CVE PoC repositories actively updated or recently surfaced on GitHub, selected to avoid duplicates and outdated entries.\n\n1\ufe0f\u20e3 CVE-2026-20841\n\ud83c\udfaf Windows Notepad \u2013 Potential RCE (PoC)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/BTtea/CVE-2026-20841-PoC\n\n\ud83e\udde0 Overview\nA Proof-of-Concept targeting Windows Notepad (< 11.2510) demonstrates a possible remote code execution scenario through crafted input handling.\n\n\u2699\ufe0f Impact\n\u2022 Potential RCE vector\n\u2022 Local exploitation scenario\n\u2022 Early-stage PoC (research-focused)\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-28292\n\ud83c\udfaf simple-git (Node.js) \u2013 Remote Code Execution\n\n\ud83e\udde0 Overview\nA critical vulnerability in the widely used simple-git library allows attackers to achieve remote code execution due to improper case-sensitive validation in security logic.\nA single missing regex flag allows bypass of previous security patches.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Patch bypass\n\u2022 Affects millions of installations\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-29000\n\ud83c\udfaf pac4j-jwt \u2013 Authentication Bypass (CVSS 10)\n\n\ud83e\udde0 Overview\nA critical flaw in pac4j-jwt allows attackers to forge authentication tokens using only a public key, enabling full account takeover.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Admin account takeover\n\u2022 CVSS 10.0 Critical\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21858\n\ud83c\udfaf n8n Workflow \u2013 Critical Vulnerability Detection / Exploit Path\n\n\ud83d\udd17 GitHub Topic\nhttps://github.com/topics/cve-2026-21858\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting n8n workflow automation platforms, with tools and PoC-related detection scripts available on GitHub.\n\n\u2699\ufe0f Impact\n\u2022 Workflow compromise\n\u2022 Automation abuse\n\u2022 CVSS 10.0\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-XXXX (Fresh Aggregated PoC Stream)\n\ud83c\udfaf Live GitHub PoC Feed (Auto-Collected CVEs)\n\n\ud83d\udd17 Repository\nhttps://github.com/nomi-sec/PoC-in-GitHub\n\n\ud83e\udde0 Overview\nThis repository continuously collects newly published CVE PoCs across GitHub, making it one of the most reliable sources for real-time vulnerability tracking.\n\n\u2699\ufe0f Impact\n\u2022 Continuous PoC discovery\n\u2022 Daily vulnerability tracking\n\u2022 Research automation source\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese entries are useful for:\n\u2022 Tracking real PoC release timing\n\u2022 Studying patch bypass techniques\n\u2022 Monitoring emerging exploit trends\n\u2022 Building automated CVE intelligence pipelines\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:08.840451Z"}, {"uuid": "36f71662-c72c-41bc-89a1-bbf7ca141758", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17004", "content": "\ud83d\udee1 CVE-2026-21852-PoC (Educational Demo Repo)\n\ud83d\udce6 Repository: atiilla/CVE-2026-21852-PoC\n\ud83d\udc49 https://github.com/atiilla/CVE-2026-21852-PoC\n\nThis repository demonstrates historical PoC patterns for vulnerabilities in the Anthropic Claude Code CLI tool, including CVE-2026-21852, designed for educational purposes only.\n\n\ud83d\udccc What This Repo Contains\n\ud83d\udcc2 Demo directories for historical bugs\nExamples show how malicious config files can influence tool behavior\n\n\ud83d\udc0d Python scripts:\n\u2022 attacker_server.py \u2013 Local server to capture and log simulated traffic\n\u2022 attacker_proxy.py \u2013 Proxy for observing exfiltration behavior\n\u2022 scanner.py \u2013 Scanner to detect risky patterns in local repositories\n\n\ud83d\udcc1 Demo content directories include:\n\u2022 vuln1_hooks_bypass/\n\u2022 CVE-2025-59536_mcp_injection/\n\u2022 CVE-2026-21852_api_exfil/\n(Configuration files under these folders illustrate pattern examples.)\n\n\ud83e\udde0 Vulnerabilities Covered\nThe project explores multiple vulnerabilities historically disclosed for Claude Code CLI:\n\u26a0\ufe0f Hooks consent bypass \u2013 bypasses consent mechanisms (older build)\n\u26a0\ufe0f CVE-2025-59536 \u2013 MCP config injection \u2013 orchestration config risk\n\u26a0\ufe0f CVE-2026-21852 \u2013 API key disclosure \u2013 config causes API key to be sent before trust verification\nThe vulnerability CVE-2026-21852 identified that malicious repository settings could exfiltrate API keys prior to showing a trust prompt in affected Claude Code versions.\n\n\ud83c\udfaf How the Repo Can Be Used (Education Only)\n\ud83d\udccc Scanner\npython3 scanner.py \nDetects dangerous config patterns that could be risky before opening repositories.\n\n\ud83d\udccc Local Demo Server\npython3 attacker_server.py\nSimulates a server to log simulated exfiltration traffic.\n\n\ud83d\udccc Proxy Demo\npython3 attacker_proxy.py\nTransparent proxy to illustrate capture behavior.\n\n\ud83e\udde0 What You Learn Here\n\u2714\ufe0f How untrusted configuration files can impact tool behavior\n\u2714\ufe0f Why verifying repository contents before opening is important\n\u2714\ufe0f The concept of pre-execution key leakage (API exfiltration)\n\u2714\ufe0f How scanners can detect repository risk patterns\nThese skills are valuable in secure dev workflows, supply chain security, and blue team defensive validation.\n\n\u26a0\ufe0f Important Notes (Responsible Use)\n\u2705 This repository is for security research and learning only.\n\u274c Do NOT deploy these scripts against third-party or production systems.\n\u274c Never open untrusted repositories in real tools without inspection.\n\u2696\ufe0f Always practice ethical/authorized testing and use isolated lab environments.\n\n\ud83d\udccc Additional Reference: CVE-2026-21852 Description\n\ud83d\udccc The vulnerability CVE-2026-21852 pertains to an information disclosure issue in Claude Code \n       where repository settings could cause premature API calls before trust confirmation, risking API key exfiltration.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:29.624113Z"}, {"uuid": "cfe7b48d-6c8c-483f-820b-ddfaffa07fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/369", "content": "CVE-2026-21858\n\nn8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.\n\nGitHub Link:\nhttps://github.com/masterwok/PoC-CVE-2026-21858", "creation_timestamp": "2026-08-28T00:00:31.441915Z"}, {"uuid": "53971026-6677-4f43-8aff-56c494517305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-18)", "content": "", "creation_timestamp": "2026-07-19T10:15:10.707434Z"}, {"uuid": "43d44c08-fad2-4f5d-91db-517ac03dabde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/proxy_bar/3169", "content": "CVE-2026-21852\n*\nClaude Code Vulnerability \n\nAll IN onE", "creation_timestamp": "2026-07-20T19:00:07.931335Z"}, {"uuid": "27df6043-dae7-4e48-a01e-a228d72f151a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/proxy_bar/3054", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare\n*\nFull Chain Exploit\n\n#n8n #exploit  Happy", "creation_timestamp": "2026-07-20T19:00:08.697203Z"}, {"uuid": "d003485a-4fa0-40f1-b7ed-ae87285d07ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/proxy_bar/3054", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare\n*\nFull Chain Exploit\n\n#n8n #exploit  Happy", "creation_timestamp": "2026-07-21T00:00:27.357166Z"}, {"uuid": "4ca829c4-c6a3-4522-bcbc-c87099614802", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/proxy_bar/3169", "content": "CVE-2026-21852\n*\nClaude Code Vulnerability \n\nAll IN onE", "creation_timestamp": "2026-07-21T00:00:24.973280Z"}, {"uuid": "a9f52ffb-2722-4be6-b062-cfa55ad125d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/cve0day/369", "content": "CVE-2026-21858\n\nn8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.\n\nGitHub Link:\nhttps://github.com/masterwok/PoC-CVE-2026-21858", "creation_timestamp": "2026-08-27T15:00:08.689428Z"}, {"uuid": "9a11db6e-28ab-4266-b0b4-0b6dfdc2f796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/proxy_bar/3054", "content": "CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare\n*\nFull Chain Exploit\n\n#n8n #exploit  Happy", "creation_timestamp": "2026-07-22T00:00:26.872302Z"}, {"uuid": "4d2f88a5-bc88-49eb-9b5d-00b7ace4843d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/proxy_bar/3169", "content": "CVE-2026-21852\n*\nClaude Code Vulnerability \n\nAll IN onE", "creation_timestamp": "2026-07-22T01:00:11.645635Z"}, {"uuid": "f870f936-e7bc-47a8-858a-28d8fcd3152e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/GithubRedTeam/94450", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a n8n-cve-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a qianlijaingshan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 08:56:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-21858 + CVE-2025-68613 \u2014 n8n unauthenticated file read to RCE exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-23T04:00:06.862398Z"}, {"uuid": "9cbecca3-4c8f-43fa-9798-9bec15791e35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94450", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a n8n-cve-2026-21858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a qianlijaingshan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 08:56:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-21858 + CVE-2025-68613 \u2014 n8n unauthenticated file read to RCE exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-24T00:00:10.303528Z"}, {"uuid": "db399b9b-5e9a-4c1c-8e65-0eb32ce1cfd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-23)", "content": "", "creation_timestamp": "2026-07-24T10:15:12.023821Z"}, {"uuid": "6c5a88e1-6827-40dc-a64f-0ce67c598d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-24)", "content": "", "creation_timestamp": "2026-07-25T10:15:16.502690Z"}, {"uuid": "8b959e82-6257-44bf-b4b7-3f3d1390cce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-25)", "content": "", "creation_timestamp": "2026-07-26T10:15:38.871540Z"}, {"uuid": "01f40865-07fe-477a-8e4a-1109682fb5b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/bin_z0ne/440", "content": "", "creation_timestamp": "2026-07-26T00:00:47.434267Z"}, {"uuid": "cff71633-2f90-47e5-aa00-165b940cbd14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17066", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are fresh CVE PoC repositories actively updated or recently surfaced on GitHub, selected to avoid duplicates and outdated entries.\n\n1\ufe0f\u20e3 CVE-2026-20841\n\ud83c\udfaf Windows Notepad \u2013 Potential RCE (PoC)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/BTtea/CVE-2026-20841-PoC\n\n\ud83e\udde0 Overview\nA Proof-of-Concept targeting Windows Notepad (< 11.2510) demonstrates a possible remote code execution scenario through crafted input handling.\n\n\u2699\ufe0f Impact\n\u2022 Potential RCE vector\n\u2022 Local exploitation scenario\n\u2022 Early-stage PoC (research-focused)\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-28292\n\ud83c\udfaf simple-git (Node.js) \u2013 Remote Code Execution\n\n\ud83e\udde0 Overview\nA critical vulnerability in the widely used simple-git library allows attackers to achieve remote code execution due to improper case-sensitive validation in security logic.\nA single missing regex flag allows bypass of previous security patches.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Patch bypass\n\u2022 Affects millions of installations\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-29000\n\ud83c\udfaf pac4j-jwt \u2013 Authentication Bypass (CVSS 10)\n\n\ud83e\udde0 Overview\nA critical flaw in pac4j-jwt allows attackers to forge authentication tokens using only a public key, enabling full account takeover.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Admin account takeover\n\u2022 CVSS 10.0 Critical\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21858\n\ud83c\udfaf n8n Workflow \u2013 Critical Vulnerability Detection / Exploit Path\n\n\ud83d\udd17 GitHub Topic\nhttps://github.com/topics/cve-2026-21858\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting n8n workflow automation platforms, with tools and PoC-related detection scripts available on GitHub.\n\n\u2699\ufe0f Impact\n\u2022 Workflow compromise\n\u2022 Automation abuse\n\u2022 CVSS 10.0\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-XXXX (Fresh Aggregated PoC Stream)\n\ud83c\udfaf Live GitHub PoC Feed (Auto-Collected CVEs)\n\n\ud83d\udd17 Repository\nhttps://github.com/nomi-sec/PoC-in-GitHub\n\n\ud83e\udde0 Overview\nThis repository continuously collects newly published CVE PoCs across GitHub, making it one of the most reliable sources for real-time vulnerability tracking.\n\n\u2699\ufe0f Impact\n\u2022 Continuous PoC discovery\n\u2022 Daily vulnerability tracking\n\u2022 Research automation source\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese entries are useful for:\n\u2022 Tracking real PoC release timing\n\u2022 Studying patch bypass techniques\n\u2022 Monitoring emerging exploit trends\n\u2022 Building automated CVE intelligence pipelines\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:07.307027Z"}, {"uuid": "7e6878d7-9997-424e-917a-4266e30b2b52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-27)", "content": "", "creation_timestamp": "2026-07-28T10:15:23.164919Z"}, {"uuid": "7606a961-ce4f-4801-b7e3-ef966e2468db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17004", "content": "\ud83d\udee1 CVE-2026-21852-PoC (Educational Demo Repo)\n\ud83d\udce6 Repository: atiilla/CVE-2026-21852-PoC\n\ud83d\udc49 https://github.com/atiilla/CVE-2026-21852-PoC\n\nThis repository demonstrates historical PoC patterns for vulnerabilities in the Anthropic Claude Code CLI tool, including CVE-2026-21852, designed for educational purposes only.\n\n\ud83d\udccc What This Repo Contains\n\ud83d\udcc2 Demo directories for historical bugs\nExamples show how malicious config files can influence tool behavior\n\n\ud83d\udc0d Python scripts:\n\u2022 attacker_server.py \u2013 Local server to capture and log simulated traffic\n\u2022 attacker_proxy.py \u2013 Proxy for observing exfiltration behavior\n\u2022 scanner.py \u2013 Scanner to detect risky patterns in local repositories\n\n\ud83d\udcc1 Demo content directories include:\n\u2022 vuln1_hooks_bypass/\n\u2022 CVE-2025-59536_mcp_injection/\n\u2022 CVE-2026-21852_api_exfil/\n(Configuration files under these folders illustrate pattern examples.)\n\n\ud83e\udde0 Vulnerabilities Covered\nThe project explores multiple vulnerabilities historically disclosed for Claude Code CLI:\n\u26a0\ufe0f Hooks consent bypass \u2013 bypasses consent mechanisms (older build)\n\u26a0\ufe0f CVE-2025-59536 \u2013 MCP config injection \u2013 orchestration config risk\n\u26a0\ufe0f CVE-2026-21852 \u2013 API key disclosure \u2013 config causes API key to be sent before trust verification\nThe vulnerability CVE-2026-21852 identified that malicious repository settings could exfiltrate API keys prior to showing a trust prompt in affected Claude Code versions.\n\n\ud83c\udfaf How the Repo Can Be Used (Education Only)\n\ud83d\udccc Scanner\npython3 scanner.py \nDetects dangerous config patterns that could be risky before opening repositories.\n\n\ud83d\udccc Local Demo Server\npython3 attacker_server.py\nSimulates a server to log simulated exfiltration traffic.\n\n\ud83d\udccc Proxy Demo\npython3 attacker_proxy.py\nTransparent proxy to illustrate capture behavior.\n\n\ud83e\udde0 What You Learn Here\n\u2714\ufe0f How untrusted configuration files can impact tool behavior\n\u2714\ufe0f Why verifying repository contents before opening is important\n\u2714\ufe0f The concept of pre-execution key leakage (API exfiltration)\n\u2714\ufe0f How scanners can detect repository risk patterns\nThese skills are valuable in secure dev workflows, supply chain security, and blue team defensive validation.\n\n\u26a0\ufe0f Important Notes (Responsible Use)\n\u2705 This repository is for security research and learning only.\n\u274c Do NOT deploy these scripts against third-party or production systems.\n\u274c Never open untrusted repositories in real tools without inspection.\n\u2696\ufe0f Always practice ethical/authorized testing and use isolated lab environments.\n\n\ud83d\udccc Additional Reference: CVE-2026-21852 Description\n\ud83d\udccc The vulnerability CVE-2026-21852 pertains to an information disclosure issue in Claude Code \n       where repository settings could cause premature API calls before trust confirmation, risking API key exfiltration.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:10.372777Z"}, {"uuid": "0d6cdc2a-8085-46d8-a7b1-3b6deff7073b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/reverseame/5589", "content": "Ni8mare\u200a - \u200aUnauthenticated Remote Code Execution in n8n (CVE-2026-21858) #Ni8mare #n8n #RCE #CVE202621858 #Vulnerability https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-07-29T08:01:20.858965Z"}, {"uuid": "81fcbdd7-dbf5-48aa-93eb-30844f1ab29e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-23)", "content": "", "creation_timestamp": "2026-08-24T10:15:34.229655Z"}, {"uuid": "62f73e3e-f254-40b9-97f8-f1831160dc3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21852", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17004", "content": "\ud83d\udee1 CVE-2026-21852-PoC (Educational Demo Repo)\n\ud83d\udce6 Repository: atiilla/CVE-2026-21852-PoC\n\ud83d\udc49 https://github.com/atiilla/CVE-2026-21852-PoC\n\nThis repository demonstrates historical PoC patterns for vulnerabilities in the Anthropic Claude Code CLI tool, including CVE-2026-21852, designed for educational purposes only.\n\n\ud83d\udccc What This Repo Contains\n\ud83d\udcc2 Demo directories for historical bugs\nExamples show how malicious config files can influence tool behavior\n\n\ud83d\udc0d Python scripts:\n\u2022 attacker_server.py \u2013 Local server to capture and log simulated traffic\n\u2022 attacker_proxy.py \u2013 Proxy for observing exfiltration behavior\n\u2022 scanner.py \u2013 Scanner to detect risky patterns in local repositories\n\n\ud83d\udcc1 Demo content directories include:\n\u2022 vuln1_hooks_bypass/\n\u2022 CVE-2025-59536_mcp_injection/\n\u2022 CVE-2026-21852_api_exfil/\n(Configuration files under these folders illustrate pattern examples.)\n\n\ud83e\udde0 Vulnerabilities Covered\nThe project explores multiple vulnerabilities historically disclosed for Claude Code CLI:\n\u26a0\ufe0f Hooks consent bypass \u2013 bypasses consent mechanisms (older build)\n\u26a0\ufe0f CVE-2025-59536 \u2013 MCP config injection \u2013 orchestration config risk\n\u26a0\ufe0f CVE-2026-21852 \u2013 API key disclosure \u2013 config causes API key to be sent before trust verification\nThe vulnerability CVE-2026-21852 identified that malicious repository settings could exfiltrate API keys prior to showing a trust prompt in affected Claude Code versions.\n\n\ud83c\udfaf How the Repo Can Be Used (Education Only)\n\ud83d\udccc Scanner\npython3 scanner.py \nDetects dangerous config patterns that could be risky before opening repositories.\n\n\ud83d\udccc Local Demo Server\npython3 attacker_server.py\nSimulates a server to log simulated exfiltration traffic.\n\n\ud83d\udccc Proxy Demo\npython3 attacker_proxy.py\nTransparent proxy to illustrate capture behavior.\n\n\ud83e\udde0 What You Learn Here\n\u2714\ufe0f How untrusted configuration files can impact tool behavior\n\u2714\ufe0f Why verifying repository contents before opening is important\n\u2714\ufe0f The concept of pre-execution key leakage (API exfiltration)\n\u2714\ufe0f How scanners can detect repository risk patterns\nThese skills are valuable in secure dev workflows, supply chain security, and blue team defensive validation.\n\n\u26a0\ufe0f Important Notes (Responsible Use)\n\u2705 This repository is for security research and learning only.\n\u274c Do NOT deploy these scripts against third-party or production systems.\n\u274c Never open untrusted repositories in real tools without inspection.\n\u2696\ufe0f Always practice ethical/authorized testing and use isolated lab environments.\n\n\ud83d\udccc Additional Reference: CVE-2026-21852 Description\n\ud83d\udccc The vulnerability CVE-2026-21852 pertains to an information disclosure issue in Claude Code \n       where repository settings could cause premature API calls before trust confirmation, risking API key exfiltration.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-29T00:00:32.171810Z"}, {"uuid": "b5f113f8-82f2-4b7c-90b4-c1721e316f08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/reverseame/5589", "content": "Ni8mare\u200a - \u200aUnauthenticated Remote Code Execution in n8n (CVE-2026-21858) #Ni8mare #n8n #RCE #CVE202621858 #Vulnerability https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858", "creation_timestamp": "2026-07-30T00:02:10.787507Z"}, {"uuid": "d6ab0828-b176-4a81-838d-7df2863cda46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/CyberDispatch/468", "content": "Another CVSS 10.0 n8n vulnerability disclosed.\n\nResearchers found another critical flaw (CVE-2026-21858) in n8n that lets remote attackers take full control with no authentication required.\n\nThe bug abuses Content-Type handling in form webhooks to read local files, steal secrets, forge admin sessions, and achieve RCE.", "creation_timestamp": "2026-08-30T00:00:49.651600Z"}, {"uuid": "ed3a7e7f-d0f7-447b-b2ce-093126812b5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/CyberDispatch/468", "content": "Another CVSS 10.0 n8n vulnerability disclosed.\n\nResearchers found another critical flaw (CVE-2026-21858) in n8n that lets remote attackers take full control with no authentication required.\n\nThe bug abuses Content-Type handling in form webhooks to read local files, steal secrets, forge admin sessions, and achieve RCE.", "creation_timestamp": "2026-08-31T00:00:10.186414Z"}, {"uuid": "9a5cb8eb-63d1-416a-ac64-67f17d5e0e99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ni8mare_cve_2026_21858.rb", "content": "{\"actions\": [{\"description\": \"Create an admin JWT session key by reading out secrets\", \"name\": \"EXTRACT_SESSION\"}, {\"description\": \"Read an arbitrary file from the target\", \"name\": \"READ_FILE\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"dor attias\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-21858, a critical unauthenticated remote code execution vulnerability in n8n workflow automation platform versions 1.65.0 through 1.120.x. The vulnerability, dubbed \\\"Ni8mare\\\", is a content-type confusion flaw in webhook request handling that allows attackers to achieve arbitrary file read.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/gather/ni8mare_cve_2026_21858\", \"is_install_path\": true, \"mod_time\": \"2026-02-16 15:48:02 +0000\", \"name\": \"n8n arbitrary file read\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/ni8mare_cve_2026_21858.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/ni8mare_cve_2026_21858\", \"references\": [], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:19.395913Z"}, {"uuid": "1acc2a1c-5032-44c9-9568-9b38801a4f82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "seen", "source": "https://t.me/GithubRedTeam/102088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-21858-n8n-FullChain\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ZeroDayEvil\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 00:10:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee1\ufe0f Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n \"Ni8mare\" Unauthenticated Arbitrary File Read & Expression Injection RCE Full Chain).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T03:00:04.293249Z"}, {"uuid": "6e6e6fb6-4fe5-4c31-b38c-4f19ee1dc7a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21858", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-21858-n8n-FullChain\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ZeroDayEvil\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 00:10:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee1\ufe0f Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n \"Ni8mare\" Unauthenticated Arbitrary File Read & Expression Injection RCE Full Chain).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T00:00:57.679797Z"}]}