{"vulnerability": "cve-2026-25679", "sightings": [{"uuid": "5c9e5882-f7b0-4d7d-b65a-f24245f316fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mghrq2szlq2o", "content": "", "creation_timestamp": "2026-03-07T12:00:57.207071Z"}, {"uuid": "1bd9c9fa-9311-427f-aed9-459e1a368e8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/golang.org/post/3mge5fq5pq22k", "content": "", "creation_timestamp": "2026-03-06T01:19:17.454486Z"}, {"uuid": "7f4c68ff-87d4-43f0-9007-253897ed5f9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mggrpmxkpe23", "content": "", "creation_timestamp": "2026-03-07T02:28:02.386058Z"}, {"uuid": "f66c6c50-d5f7-4e98-847c-4494e1b7b44e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mggfreamou2e", "content": "", "creation_timestamp": "2026-03-06T22:54:15.620858Z"}, {"uuid": "9b115d81-f87e-451c-949b-d21b318d6aab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "5940c143-7f1e-40d0-a52f-09c51151d9f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mgvujrkwsw2j", "content": "", "creation_timestamp": "2026-03-13T02:28:23.186896Z"}, {"uuid": "9cfbcfab-fd8e-4ef2-9573-b525d349c996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "20a0c0e1-ef79-4a2b-9623-634a3532aae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mhihsg66sq2o", "content": "", "creation_timestamp": "2026-03-20T12:01:09.747688Z"}, {"uuid": "985fac80-f966-47c3-8110-80049faddce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mla57mhsvw2u", "content": "portainer 2.33.8 patches CVE-2026-25679\nRemoves JWT query string support, addressing Docker API auth bypass vulnerabilities.\nUpgrade carefully.\n\n\u2192 releaseport.com/r/portainer-portainer/2-33-8", "creation_timestamp": "2026-05-07T02:11:10.114954Z"}, {"uuid": "9b090d36-f26e-4b2a-8137-520be4d00344", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbtea75l32g", "content": "This addresses the following vulnerabilities: CVE-2025-58188 CVE-2025-58187 CVE-2026-34040 CVE-2026-33997 CVE-2026-33186 CVE-2026-25679 CVE-2026-24051 CVE-2026-0915 CVE-2026-0861 CVE-2025-68119 CVE-2025-61732 CVE-2025-61731 CVE-2025-61729 CVE-2025-61726 CVE-2025-4674", "creation_timestamp": "2026-05-07T18:20:07.409226Z"}, {"uuid": "d08eb010-95d1-4d05-9744-d809081a16b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbteahwco2i", "content": "CVE-2025-15558 CVE-2025-15281 N/A Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: CVE-2026-33186 CVE-2026-32283 CVE-2026-32281 CVE-2026-32280 CVE-2026-27144 CVE-2026-27143 CVE-2026-27140 CVE-2026-25679 N/A Security fixes for", "creation_timestamp": "2026-05-07T18:20:11.714215Z"}, {"uuid": "e6bc38be-5975-49b7-b8ff-e25b0ccf66d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbteatrxb25", "content": "This addresses the following vulnerabilities: CVE-2026-34481 CVE-2026-32283 CVE-2026-32281 CVE-2026-32280 CVE-2026-27144 CVE-2026-27143 CVE-2026-27140 CVE-2026-25679 N/A Security fixes for apigee-hybrid-cassandra-client", "creation_timestamp": "2026-05-07T18:20:15.762275Z"}, {"uuid": "32717a66-d6b7-4229-86a1-6a7e7fc5df12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbteazi222q", "content": "This addresses the following vulnerabilities: CVE-2026-39883 CVE-2026-33186 CVE-2026-32283 CVE-2026-32281 CVE-2026-32280 CVE-2026-27144 CVE-2026-27143 CVE-2026-27140 CVE-2026-25679 N/A Security fixes for apigee-kube-rbac-proxy", "creation_timestamp": "2026-05-07T18:20:19.609905Z"}, {"uuid": "34f60ab8-9b27-4662-96fa-38786038f990", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbteb7csh2w", "content": "This addresses the following vulnerabilities: CVE-2026-24051 CVE-2026-25679 N/A Security fixes for apigee-mart-server", "creation_timestamp": "2026-05-07T18:20:20.505928Z"}, {"uuid": "8871fd19-565b-4732-968b-a8d5a840b00b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlcoqsnj6m2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 371 interactions\nCVE-2026-41940: 96 interactions\nCVE-2026-0300: 24 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 15 interactions\nCVE-2026-25679: 10 interactions\nCVE-2026-27140: 8 interactions\n", "creation_timestamp": "2026-05-08T02:30:20.809983Z"}, {"uuid": "f3856622-d73c-4a84-8ba7-20950a9be7d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://gist.github.com/akses0/75206bef66ae9889ac26a86a74520308", "content": "// Tripper - a deliberately vulnerable URL unfurling service.\n//\n// CVE-2026-25679 demo: the \"SSRF guard\" inspects u.Host, trusting that\n// url.Parse rejects malformed authorities. On vulnerable Go (1.24.13-1.25.7,\n// 1.26.0) the URL \"https://example.com[::1]/\" parses with Host == \"[::1]\",\n// so an attacker smuggles an internal hostname past the guard inside the\n// domain portion of the URL.\npackage main\n\nimport (\n\t\"fmt\"\n\t\"io\"\n\t\"log\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strings\"\n\t\"time\"\n)\n\nvar client = &http.Client{\n\t// Unfurlers usually limit redirects and set timeouts; this demo keeps\n\t// them short so port-scanning via timing is snappy.\n\tTimeout: 3 * time.Second,\n\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\tif len(via) >= 3 {\n\t\t\treturn fmt.Errorf(\"too many redirects\")\n\t\t}\n\t\treturn nil\n\t},\n}\n\n// naive guard: a string blocklist over the parsed hostname. This mirrors\n// the very common real-world pattern (grep for \"localhost\", obvious\n// RFC1918 prefixes, cloud metadata...) - and it has no idea that\n// \"example.com[::1]\" parses to the IPv6 loopback on vulnerable Go.\nfunc isAllowed(u *url.URL) bool {\n\thost := strings.ToLower(u.Hostname())\n\tif host == \"\" {\n\t\treturn false\n\t}\n\tblocked := []string{\n\t\t\"localhost\", \"127.\", \"0.0.0.0\", \"10.\", \"192.168.\", \"172.16.\",\n\t\t\"169.254\", \"metadata\", \"internal\", \".local\",\n\t}\n\tfor _, b := range blocked {\n\t\tif strings.Contains(host, b) {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}\n\nfunc unfurl(w http.ResponseWriter, r *http.Request) {\n\traw := r.URL.Query().Get(\"url\")\n\tif raw == \"\" {\n\t\thttp.Error(w, \"missing ?url=\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tu, err := url.Parse(raw)\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"rejected by url.Parse: %v\", err), http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tif !isAllowed(u) {\n\t\thttp.Error(w, fmt.Sprintf(\"blocked: host %q is internal\", u.Hostname()), http.StatusForbidden)\n\t\treturn\n\t}\n\n\tstart := time.Now()\n\tresp, err := client.Get(u.String())\n\telapsed := time.Since(start)\n\tif err != nil {\n\t\t// Timing leak: even errors reveal whether something answered.\n\t\tfmt.Fprintf(w, \"fetch failed after %v: %v\\n\", elapsed, err)\n\t\treturn\n\t}\n\tdefer resp.Body.Close()\n\n\tbody, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))\n\ttitle := \"\"\n\tif s := string(body); len(s) > 0 {\n\t\tif i := strings.Index(s, \"\"); i >= 0 {\n\t\t\tif j := strings.Index(s[i:], \"\"); j > 0 {\n\t\t\t\ttitle = s[i+7 : i+j]\n\t\t\t}\n\t\t}\n\t}\n\n\tfmt.Fprintf(w, \"unfurled %s\\n  status : %s\\n  time   : %v\\n  title  : %s\\n\",\n\t\tu, resp.Status, elapsed, strings.TrimSpace(title))\n}\n\nfunc main() {\n\thttp.HandleFunc(\"/unfurl\", unfurl)\n\thttp.HandleFunc(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\tfmt.Fprintf(w, \"Tripper unfurler (vulnerable build)\\nTry: /unfurl?url=https://example.com\\n\")\n\t})\n\tlog.Println(\"Tripper listening on :8080\")\n\tlog.Fatal(http.ListenAndServe(\":8080\", nil))\n}\n", "creation_timestamp": "2026-08-30T12:06:22.342042Z"}, {"uuid": "13b2bcea-e49a-4c13-aed5-adbb61e225b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp6xslyedc22", "content": "\ud83d\udd12 ELSA-2026-29702: Atualiza\u00e7\u00e3o IMPORTANTE do runc no Oracle Linux 9 corrige 3 CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281). Saiba mais: -> tinyurl.com/ub67wkx3 #Oracle", "creation_timestamp": "2026-06-26T12:42:33.171996Z"}, {"uuid": "3f31a0aa-4b7b-4e09-a85c-092bc1ffa83a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp6xsn3kck22", "content": "\ud83d\udd12 ELSA-2026-29702: Atualiza\u00e7\u00e3o IMPORTANTE do runc no Oracle Linux 9 corrige 3 CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281). Saiba mais: -> tinyurl.com/ub67wkx3 #Oracle", "creation_timestamp": "2026-06-26T12:42:33.684383Z"}, {"uuid": "20480ffa-9d47-4d29-897a-b872421a5d3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp74le66es22", "content": "ELSA-2026-29703: atualiza\u00e7\u00e3o cr\u00edtica para container-networking-plugins no Oracle Linux 9. Quatro CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283) corrigidos. Vers\u00e3o 1.9.0-3.el9_8. Saiba mais: ->  tinyurl.com/4ua596y4 #Oracle", "creation_timestamp": "2026-06-26T14:07:57.871513Z"}, {"uuid": "f6a474a0-8d56-4290-b75a-a0f9d02eb51b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp74lf4i4222", "content": "ELSA-2026-29703: atualiza\u00e7\u00e3o cr\u00edtica para container-networking-plugins no Oracle Linux 9. Quatro CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283) corrigidos. Vers\u00e3o 1.9.0-3.el9_8. Saiba mais: ->  tinyurl.com/4ua596y4 #Oracle", "creation_timestamp": "2026-06-26T14:07:58.459210Z"}, {"uuid": "1086398f-518d-4b21-9924-46900a0596b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-25679", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp7drvhp62o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-25679: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 URL\n\n\n\nhttps://kripta.biz/posts/76BD5E44-6F20-405D-BEA4-102A40D39C04", "creation_timestamp": "2026-07-02T23:39:59.499350Z"}]}