{"vulnerability": "cve-2026-4659", "sightings": [{"uuid": "4c10e2f0-32a7-4cac-90d6-7ef3d665dfca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjorhb7jcn26", "content": "", "creation_timestamp": "2026-04-17T11:00:14.381105Z"}, {"uuid": "5041250a-f1aa-48d1-98c9-5cc056a1a264", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjoxtl33bz26", "content": "", "creation_timestamp": "2026-04-17T12:54:29.907084Z"}, {"uuid": "13d602a6-e396-4611-b4d9-0fb85fa5ce49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mjpo2le3u52h", "content": "", "creation_timestamp": "2026-04-17T19:32:07.258975Z"}, {"uuid": "f22e5bac-8559-4981-9d9c-11a47c7b9c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "Telegram/AZQnk1q88GRrPNbtJYRdzFvYzsq1JKqTcpasHMe998GraXQ", "content": "", "creation_timestamp": "2026-04-17T09:15:54.000000Z"}, {"uuid": "874a0695-41f3-4268-b2c0-caf7d0ffb972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46593", "type": "seen", "source": "https://cert.pl/en/posts/2026/07/CVE-2025-67649", "content": "", "creation_timestamp": "2026-07-31T16:45:08.777908Z"}, {"uuid": "0bcc5148-2fd0-4542-99ac-957aa4f405cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46594", "type": "seen", "source": "https://cert.pl/en/posts/2026/07/CVE-2025-67649", "content": "", "creation_timestamp": "2026-07-31T16:45:11.181296Z"}, {"uuid": "934c0938-4db2-4087-a0bb-c9b79cf8a535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46598", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgbtjxtaj2k", "content": "CVE-2026-46598 - Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent\nCVE ID : CVE-2026-46598\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : For certain crafted inputs, a 'ed25519.PrivateKey' was created by ca...", "creation_timestamp": "2026-05-22T06:15:06.547470Z"}, {"uuid": "3a3671bb-970e-4131-bcb8-7169cd6343f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46597", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgbwgulo32c", "content": "CVE-2026-46597 - Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh\nCVE ID : CVE-2026-46597\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : An incorrectly placed cast from bytes to int allowed for server-side panic i...", "creation_timestamp": "2026-05-22T06:16:40.590784Z"}, {"uuid": "44e7fbbf-ac1c-4bf7-913b-65e15393c38e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46595", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgc4lusjl2k", "content": "CVE-2026-46595 - Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\nCVE ID : CVE-2026-46595\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : Previously, CVE-2024-45337 fixed an authorization bypass for mis...", "creation_timestamp": "2026-05-22T06:20:07.197203Z"}, {"uuid": "246b3c59-5b39-4d65-9bac-28ac0c16cc67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46599", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjr6anon23", "content": "CVE-2026-46599 - Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff\nCVE ID : CVE-2026-46599\n \n Published : May 29, 2026, 8:16 p.m. | 16\u00a0minutes ago\n \n Description : The TIFF decoder does not place a limit on the size of PackBits-compressed data...", "creation_timestamp": "2026-05-29T21:57:28.692785Z"}, {"uuid": "a898a33f-3c35-44a8-b0ed-bc2b87983b56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46597", "type": "seen", "source": "https://gist.github.com/alon710/0234a3b8537da177958a0a725a5f30b9", "content": "# CVE-2026-46597: CVE-2026-46597: Remote Denial of Service in golang.org/x/crypto/ssh via AES-GCM Padding Integer Overflow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46597\n\n## Summary\nA high-severity Denial of Service (DoS) vulnerability (CVE-2026-46597 / GO-2026-5013) exists in the golang.org/x/crypto/ssh module before version v0.52.0. The flaw stems from an incorrect operator order during a type conversion of the GCM packet padding size, allowing a remote, unauthenticated attacker to trigger an out-of-bounds slice runtime panic and crash the Go process.\n\n## TL;DR\nUnauthenticated remote attackers can crash Go-based SSH servers or clients using AES-GCM ciphers by exploiting an integer overflow in padding length checks.\n\n## Technical Details\n\n- **CWE ID**: CWE-191 / CWE-704\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00359 (27.78% percentile)\n- **Impact**: Complete Denial of Service (A:H)\n- **Exploit Status**: Unproven / No Public PoC\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- golang.org/x/crypto/ssh\n- Docker\n- containerd\n- HashiCorp Vault\n- Gitea\n- Prometheus\n- AWS Systems Manager Agent (SSM)\n- cAdvisor\n- Podman\n- Trivy\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade the golang.org/x/crypto module to version v0.52.0 or later and recompile downstream applications.\n- Disable AES-GCM cipher suites (aes128-gcm@openssh.com, aes256-gcm@openssh.com) in the SSH server and client configurations.\n\n**Remediation Steps:**\n1. Update your go.mod file: run 'go get golang.org/x/crypto@v0.52.0'\n2. Run 'go mod tidy' to update dependency trees.\n3. Rebuild and redeploy all affected services and container images.\n4. Verify dependencies across downstream microservices using SCA tools.\n\n## References\n\n- [Go Issue Tracker Tracker: Issue 79561](https://go.dev/issue/79561)\n- [Go Gerrit Change List CL 781620](https://go.dev/cl/781620)\n- [Go Gitiles Code Patch Commit abbc44d](https://go.googlesource.com/crypto/+/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3^!)\n- [Go Vulnerability Database Entry GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013)\n- [Go Announcements Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n- [CVE Registry Entry CVE-2026-46597](https://www.cve.org/CVERecord?id=CVE-2026-46597)\n- [Wiz Vulnerability Advisory](https://www.wiz.io/vulnerability-database/cve/cve-2026-46597)\n- [Shodan Search Queries](https://www.shodan.io/search?query=CVE-2026-46597)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46597) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T13:42:31.989216Z"}, {"uuid": "d4e4cb16-8bcb-4cef-9d10-ff6b51911b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwcpyu2zz2i", "content": "CVE-2026-46590: Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)", "creation_timestamp": "2026-07-05T19:29:10.588256Z"}, {"uuid": "399b7389-c387-4130-9fb4-3e3f3c106d97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpweezp6dg24", "content": "CVE-2026-46592: Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation", "creation_timestamp": "2026-07-05T19:58:48.368808Z"}, {"uuid": "06ef62e3-070a-433d-b416-bce8d8902e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwf7wztkm2n", "content": "CVE-2026-46591: Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)", "creation_timestamp": "2026-07-05T20:13:51.393302Z"}, {"uuid": "7fb7856b-195d-416d-aa90-43f46747892a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46599", "type": "seen", "source": "https://gist.github.com/alon710/b509de249400d70367353eccad7c34f4", "content": "# CVE-2026-46599: CVE-2026-46599: Unrestricted Memory Allocation in golang.org/x/image/tiff PackBits Decoder\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46599\n\n## Summary\nCVE-2026-46599 (also identified by Go vulnerability alias GO-2026-5032) is a high-severity denial-of-service vulnerability in the Go image repository, specifically within the TIFF decoder's PackBits decompression engine. A lack of resource limits during the parsing of Run-Length Encoded PackBits streams allows an attacker to construct a crafted TIFF image that achieves significant decompression amplification. This flaw enables an unauthenticated remote attacker to exhaust system resources, leading to an Out-of-Memory crash or a prolonged application hang.\n\n## TL;DR\nUnrestricted PackBits decompression in golang.org/x/image/tiff allows unauthenticated remote attackers to trigger denial of service via memory exhaustion using a crafted 2MB TIFF image that decompresses to 745MB.\n\n## Technical Details\n\n- **CWE ID**: CWE-770 (Allocation of Resources Without Limits or Throttling)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00353\n- **EPSS Percentile**: 27.35%\n- **Exploit Status**: No public functional exploit code (None/PoC-only)\n- **KEV Status**: Not in CISA's Known Exploited Vulnerabilities (KEV) catalog\n\n## Affected Systems\n\n- Go ecosystem applications using golang.org/x/image/tiff\n- Tailscale clients and mesh components\n- Rclone cloud storage utilities\n- Gitea self-hosted Git services\n- Kubescape CLI scanner\n- Echo web framework-driven backend services parsing multipart image structures\n- **golang.org/x/image/tiff**: < v0.41.0 (Fixed in: `v0.41.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/image to v0.41.0 or higher\n- Implement application-level file validation to block TIFF files\n- Enforce strict HTTP request body size limits\n- Rebuild and redeploy all statically compiled Go binaries\n\n**Remediation Steps:**\n1. Navigate to the Go module directory\n2. Execute 'go get golang.org/x/image@v0.41.0'\n3. Run 'go mod tidy' to update go.sum\n4. Recompile application binaries with 'go build'\n5. Deploy the updated executable to production environments\n\n## References\n\n- [NVD Record for CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-46599)\n- [Go Vulnerability Database Entry](https://pkg.go.dev/vuln/GO-2026-5032)\n- [Go Issue Tracker Thread](https://go.dev/issue/79577)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T08:02:31.782633Z"}, {"uuid": "b81b4799-82bc-4f1a-9e84-9e8ef307e07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6otrzp4q26", "content": "\u0423\u0433\u0440\u043e\u0437\u0430 CVE-2026-46591: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043b\u043e\u0433\u0438\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/0369E6D8-7E54-4CB2-ACC6-95B6CAC6DD07", "creation_timestamp": "2026-07-09T03:27:18.616777Z"}, {"uuid": "3a378fad-6437-4942-ba7f-1c250258db7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6ovvkgmv2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46590 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Apache Camel PQC: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7F7BB718-C759-497C-B5E0-F40E883789D3", "creation_timestamp": "2026-07-09T03:28:29.469525Z"}, {"uuid": "26a68d18-35c4-4f8e-a80f-0f9c506d57a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6oxazobr22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46592: \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 'Confused Deputy'\n\n\n\nhttps://kripta.biz/posts/C9FB7118-0729-44CF-803D-0E9EFC179FA6", "creation_timestamp": "2026-07-09T03:29:16.100446Z"}, {"uuid": "c0061e07-0a79-4808-a55c-32d7eb5dfc47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq7gud5wfd2m", "content": "\ud83d\udccc CVE-2026-46590 - Deserialization of Untrusted Data vulnerability in Apache Camel PQC component.\n\nThe camel-pqc component persists post-quantum key metadata (KeyMetadat... https://www.cyberhub.blog/cves/CVE-2026-46590", "creation_timestamp": "2026-07-09T10:37:06.729844Z"}, {"uuid": "b8a55831-abb4-4c76-8232-0830d8cf5ea6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46595", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mqp5wvyuvz2h", "content": "Patch 1.29.5-asm.12 contains fixes for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-46595 Yes Yes Yes Yes Critical (10.0) CVE-2026-8376 Yes Yes No Yes Medium (9.8) CVE-2026-8925 Yes Yes No Yes Medium (9.8) CVE-2026-39830 Yes Yes Yes", "creation_timestamp": "2026-07-15T16:40:07.639939Z"}, {"uuid": "6da6333b-caa5-4e97-8ca0-1200a5d87dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93542", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46590\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 13:16:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46590: Apache Camel camel-pqc key-lifecycle unsafe deserialization (FileBasedKeyLifecycleManager legacy .key migration via ObjectInputStream), incomplete remediation of CVE-2026-40048 (fixed in 4.18.3/4.21.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T12:00:04.567833Z"}, {"uuid": "5bed4ad5-1a8a-48e9-ae63-2764ccdfccf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93607", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46591\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 19:14:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46591: Apache Camel camel-neo4j Cypher injection via property names in CamelNeo4jMatchProperties, enabling authorization bypass / cross-label data exfiltration (fixed in 4.14.8/4.18.3/4.21.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T12:00:04.865602Z"}, {"uuid": "3fe5a0c2-b98e-4b51-a118-e0bcdb55c074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "seen", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "content": "", "creation_timestamp": "2026-07-16T19:00:04.452658Z"}, {"uuid": "ec54dccf-1dc8-4ff3-bf2c-c48a9e11c6ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "Telegram/HNPB5oa1yFVH3WekiUbQvvfAzLOwUwiNbJgQ6qW_ApvUQ1Y", "content": "", "creation_timestamp": "2026-07-16T19:00:05.658990Z"}, {"uuid": "db42ca03-5027-4257-b0fa-e1654fee7566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "published-proof-of-concept", "source": "Telegram/HNPB5oa1yFVH3WekiUbQvvfAzLOwUwiNbJgQ6qW_ApvUQ1Y", "content": "", "creation_timestamp": "2026-07-17T00:00:25.603345Z"}, {"uuid": "68fe955c-8378-4668-8790-ed0e7862fd62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "published-proof-of-concept", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "content": "", "creation_timestamp": "2026-07-17T00:00:26.315142Z"}, {"uuid": "e30506cb-10aa-4d7b-98b4-c5762a8c375b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93607", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46591\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 19:14:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46591: Apache Camel camel-neo4j Cypher injection via property names in CamelNeo4jMatchProperties, enabling authorization bypass / cross-label data exfiltration (fixed in 4.14.8/4.18.3/4.21.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:55.020724Z"}, {"uuid": "1c728585-8d9e-46cb-b529-a8dbbefd58df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93542", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46590\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 13:16:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46590: Apache Camel camel-pqc key-lifecycle unsafe deserialization (FileBasedKeyLifecycleManager legacy .key migration via ObjectInputStream), incomplete remediation of CVE-2026-40048 (fixed in 4.18.3/4.21.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:54.725626Z"}, {"uuid": "2a215ae6-8220-4b7d-970d-ae09bdd7b5a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqzvgn5eey23", "content": "\ud83d\udccc CVE-2026-46591 - Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component.\n\nThe camel-neo4j producer builds the Cy... https://www.cyberhub.blog/cves/CVE-2026-46591", "creation_timestamp": "2026-07-19T23:07:06.725616Z"}, {"uuid": "531b6ab6-2a69-4d29-a653-1ddfc0a634da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "seen", "source": "Telegram/AcOmRRro0Ie3tE3ej3Y7QKM1mXFx7TgmD9WXozzOdGilEl8", "content": "", "creation_timestamp": "2026-07-20T18:00:13.115971Z"}, {"uuid": "0e625d6d-1249-41f0-be62-143c18b878c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "seen", "source": "Telegram/AcOmRRro0Ie3tE3ej3Y7QKM1mXFx7TgmD9WXozzOdGilEl8", "content": "", "creation_timestamp": "2026-07-21T00:00:35.924026Z"}, {"uuid": "3b621ad2-864f-4724-9fd7-851d9d236c4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "published-proof-of-concept", "source": "Telegram/AcOmRRro0Ie3tE3ej3Y7QKM1mXFx7TgmD9WXozzOdGilEl8", "content": "", "creation_timestamp": "2026-07-22T00:00:03.773715Z"}, {"uuid": "f686d777-2964-4b7d-94ac-114b669242bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46595", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mulsmbhg5n2y", "content": "CVE-2026-46595 - golang-go.crypto\nA security check is bypassed in Go SSH servers when using an incorrect authentication method. This allows unauthorized access to the server. To fix this, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#canonical #UbuntuPro2004LTS #CVE #infosec", "creation_timestamp": "2026-09-03T06:20:04.673265Z"}]}