{"vulnerability": "cve-2026-5473", "sightings": [{"uuid": "a64e1f62-1130-4412-a46c-1085be73fe60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54737", "type": "seen", "source": "https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5", "content": "# CVE-2026-54737: CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54737\n\n## Summary\nCVE-2026-54737 is a high-severity Prototype Pollution vulnerability in the @phun-ky/defaults-deep npm library prior to version 2.0.5. Due to unsafe recursive object merging, unauthenticated attackers can supply structured payloads that modify the properties of Object.prototype, compromising the runtime process state.\n\n## TL;DR\nA prototype pollution vulnerability in the recursive merging function of @phun-ky/defaults-deep versions prior to 2.0.5 allows remote attackers to execute arbitrary modification of Object.prototype attributes via crafted inputs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.3 (High)\n- **EPSS Status**: Not Registered\n- **Impact**: Prototype Pollution (Privilege Escalation, DoS, RCE)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js runtime environments using @phun-ky/defaults-deep dependency\n- **@phun-ky/defaults-deep**: < 2.0.5 (Fixed in: `2.0.5`)\n\n## Mitigation\n\n- Upgrade @phun-ky/defaults-deep to version 2.0.5 or above\n- Implement structural deep-sanitization recursive functions on all input middleware\n- Enforce strict prototype freezing at the initialization stage of Node.js services\n\n**Remediation Steps:**\n1. Run npm install @phun-ky/defaults-deep@2.0.5 inside project workspaces\n2. Incorporate input validation schemas such as AJV or Joi to reject properties named __proto__, constructor, and prototype\n3. Deploy custom Express body-parser middleware to strip dangerous keys before merging operations\n\n## References\n\n- [GitHub Security Advisory GHSA-mj3g-7xcc-x4vh](https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh)\n- [GitHub Pull Request #49](https://github.com/phun-ky/defaults-deep/pull/49)\n- [Fix Commit 807dba9](https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059)\n- [Release Tag v2.0.5](https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54737) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T18:32:14.083108Z"}, {"uuid": "9ffd35b8-c253-48b7-9af9-a2d8b4b1b308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54733", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrn26pxli2a", "content": "CVE-2026-54733 - moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint\nCVE ID : CVE-2026-54733\n \n Published : July 16, 2026, 2:52 p.m. | 43\u00a0minutes ago\n \n Description : The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Of...", "creation_timestamp": "2026-07-16T16:15:41.508120Z"}, {"uuid": "6038f412-d296-48ab-a10d-dd04175d9027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54733", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqrou4dsoi2o", "content": "CVE-2026-54733 - o365-moodle\nThe Moodle Office 365 plugin allows attackers to bypass login verification, gaining access to user accounts. This affects users who rely on Office 365 integration for\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#o365moodle #microsoft #CVE #infosec", "creation_timestamp": "2026-07-16T16:48:04.672582Z"}, {"uuid": "5342957b-8c45-437b-943a-30df4025d1d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54733", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116936433017678779", "content": "It is possible to see elevated activities targeting microsoft o365-moodle (CVE-2026-54733) https://vuldb.com/vuln/379542/cti", "creation_timestamp": "2026-07-17T17:12:45.459468Z"}, {"uuid": "fd204047-ecc9-4d98-8082-58411dac3b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54732", "type": "seen", "source": "https://gist.github.com/alon710/795619632fe9ba16f51e5c93358e8801", "content": "# CVE-2026-54732: CVE-2026-54732: Arbitrary File Write via Path Traversal in libreoffice-convert\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54732\n\n## Summary\nA path traversal and arbitrary file write vulnerability exists in the libreoffice-convert Node.js package in all versions prior to 1.8.2. The convertWithOptions function fails to validate or sanitize the caller-controlled options.fileName parameter, allowing directory traversal sequences to write files outside the temporary directory.\n\n## TL;DR\nUnsanitized input in options.fileName allows attackers to perform directory traversal and write arbitrary files anywhere on the host filesystem that the Node.js process can write to, which can lead to remote code execution.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5\n- **Integrity Impact**: High\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- libreoffice-convert < 1.8.2\n- **libreoffice-convert**: < 1.8.2 (Fixed in: `1.8.2`)\n\n## Mitigation\n\n- Upgrade to libreoffice-convert version 1.8.2 or later to apply the path.basename containment patch.\n- Implement application-level sanitization to normalize and strip directory traversal sequences before parsing options.\n- Ensure Node.js execution occurs under a non-privileged system account with minimal write access.\n- Enforce read-only containers with temporary volumes mounted for specific processing needs.\n\n**Remediation Steps:**\n1. Run 'npm install libreoffice-convert@1.8.2' or 'yarn upgrade libreoffice-convert@1.8.2' in the project directory.\n2. Audit all routes that forward request body parameters to convertWithOptions to verify input validation.\n3. Deploy container security policies that restrict the writable filesystem to dedicated sandbox locations.\n\n## References\n\n- [GHSA-gmxc-r82q-347r: Path traversal in libreoffice-convert](https://github.com/elwerene/libreoffice-convert/security/advisories/GHSA-gmxc-r82q-347r)\n- [Fix Commit b78f17df9b9183bd503fc4635fc8b3df6705047b](https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b)\n- [CVE-2026-54732 Details on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54732)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54732) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T19:31:53.204017Z"}, {"uuid": "b0d01bc4-2fa5-4b2d-80bc-1f9e421274d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54736", "type": "seen", "source": "https://gist.github.com/alon710/c1d8520d53bfcef788cd28dc6c9eb99d", "content": "# CVE-2026-54736: CVE-2026-54736: Timing Side-Channel Vulnerability in Phalcon Crypt Decryption\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54736\n\n## Summary\nPhalcon versions prior to 5.14.1 are vulnerable to a timing side-channel attack in the authenticated decryption process. The HMAC signature verification utilizes a non-constant-time byte comparison, allowing unauthenticated remote attackers to reconstruct valid signatures and forge arbitrary encrypted payloads.\n\n## TL;DR\nA timing side-channel in Phalcon allows remote, unauthenticated attackers to forge encrypted payloads by guessing HMAC signatures byte-by-byte.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.2 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Phalcon PHP Framework applications using Crypt::decrypt() with signing enabled\n- **cphalcon**: < 5.14.1 (Fixed in: `5.14.1`)\n\n## Mitigation\n\n- Upgrade Phalcon to version 5.14.1 or higher\n- Implement rate-limiting on decryption endpoints to prevent brute-force timing attacks\n- Ensure error messages do not leak decryption or signature validation states\n\n**Remediation Steps:**\n1. Verify current extension version via 'php -ri phalcon'\n2. Update phalcon/cphalcon dependency in composer.json to '^5.14.1'\n3. Recompile/update the C extension in the target environment\n4. Restart the PHP-FPM or Apache web server to apply the changes\n\n## References\n\n- [GitHub Security Advisory GHSA-8jqh-95g6-7jpj](https://github.com/phalcon/cphalcon/security/advisories/GHSA-8jqh-95g6-7jpj)\n- [Phalcon Issue #17090](https://github.com/phalcon/cphalcon/issues/17090)\n- [Phalcon PR #17091](https://github.com/phalcon/cphalcon/pull/17091)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54736) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T16:32:37.947723Z"}, {"uuid": "a6cb391a-c63a-4f66-9610-0069d52e9e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://gist.github.com/alon710/fffec7ff7a3f093df17d5e871ff03c84", "content": "# CVE-2026-54735: CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54735\n\n## Summary\nCVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server's bidder adapters, allowing unauthenticated remote attackers to route HTTP requests to arbitrary locations, including internal local host loopbacks and cloud provider metadata endpoints.\n\n## TL;DR\nPrebid Server versions prior to 4.4.0 fail to validate or sanitize dynamic host and subdomain parameters within several bidder adapters. This allows unauthenticated remote attackers to manipulate the destination of outbound HTTP requests by supplying control characters in OpenRTB requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1**: 10.0 (Critical)\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Server-Side Request Forgery, Local Host Enumeration, Credential Disclosure\n\n## Affected Systems\n\n- Prebid Server\n- **prebid-server**: < 4.4.0 (Fixed in: `4.4.0`)\n\n## Mitigation\n\n- Upgrade to Prebid Server version 4.4.0 or above\n- Configure outbound egress firewalls to block private IP ranges (RFC 1918) and link-local addresses\n- Implement DNS resolution filters inside the container network\n\n**Remediation Steps:**\n1. Identify all active Prebid Server instances and map their respective current versions\n2. Execute upgrade processes to update the prebid-server image or binary to version 4.4.0 or newer\n3. Deploy updated network security policies or firewall rules to limit Prebid Server's outbound egress to public IP endpoints\n4. Verify the mitigation using test payloads matching invalid-host structures\n\n## References\n\n- [GitHub Security Advisory GHSA-4p3g-4hcj-wpvx](https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T16:32:11.749626Z"}, {"uuid": "c91aa657-457d-4824-83ec-1c4b46e476a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsezo76df2q", "content": "CVE-2026-54735 - prebid\nThe Prebid Server's request handling system can be tricked into sending requests to unauthorized destinations, potentially exposing internal services to malicious actors. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prebid #Golang #CVE #infosec", "creation_timestamp": "2026-07-29T16:50:04.964411Z"}, {"uuid": "b55097ef-79cf-4119-b9a4-69d0f44d81fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsik6jv3n22", "content": "CVE-2026-54735 - prebid-server's request forgery vulnerability allows for possible host environment data extraction\nCVE ID : CVE-2026-54735\n \n Published : July 29, 2026, 4:17 p.m. | 1\u00a0hour, 26\u00a0minutes ago\n \n Description : Prebid Server is an open-source solution for running re...", "creation_timestamp": "2026-07-29T17:53:00.317369Z"}, {"uuid": "5ff1f336-da7b-4337-9adc-4d8c4fb18bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-54735", "content": "", "creation_timestamp": "2026-07-29T20:15:07.768816Z"}, {"uuid": "90d8bc1d-f0a8-4abe-a6b8-be3f06d18da3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54734", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvqr3auarc2p", "content": "\ud83d\udd34 CVE-2026-54734 - Critical (10)\n\nPrebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54734/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-17T23:01:11.270422Z"}, {"uuid": "bafcc765-f899-4ca8-9611-6461249cd76f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54734", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ifjjy7dtddv2y", "content": "CVE-2026-54734 - Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction\nCVE ID : CVE-2026-54734\n \n Published : Sept. 17, 2026, 10:17 p.m. | 52\u00a0minutes ago\n \n Description : Prebid Server Java is the Java version of Prebid Serve...", "creation_timestamp": "2026-09-18T00:04:27.737985Z"}, {"uuid": "4e8536ea-9544-46c2-8f55-014215447a54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54734", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvquswmbs525", "content": "\ud83d\udea8 CVE-2026-54734 \u2014 CVSS 10 CRITICAL\n\nPrebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpola...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54734\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-18T00:08:05.792177Z"}, {"uuid": "d71cd36b-6809-4249-b388-34ac425f8361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54734", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvr33cfqde24", "content": "CVE-2026-54734 - prebid-server-java\nThe Java version of Prebid Server can be made to contact internal or sensitive URLs when an attacker supplies crafted bid parameters. This could expose internal network data or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prebid #CVE #infosec", "creation_timestamp": "2026-09-18T02:00:09.071319Z"}]}