https://db.gcve.eu/sightings/feed 2026-07-28T21:09:47.348677+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/b0baf083-2a27-499d-af6e-ca75cadc19a1/export 2026-07-28T21:09:47.363813+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "b0baf083-2a27-499d-af6e-ca75cadc19a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26053", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/6625", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-26053\n\ud83d\udd25 CVSS Score: 6.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.\n\ud83d\udccf Published: 2023-03-02T03:11:31.488Z\n\ud83d\udccf Modified: 2025-03-05T21:15:36.343Z\n\ud83d\udd17 References:\n1. https://github.com/gradle/gradle/security/advisories/GHSA-c724-3xg7-g3hf\n2. https://github.com/gradle/gradle/commit/bf3cc0f2b463033037e67aaacda31291643ea1a9\n3. https://security.netapp.com/advisory/ntap-20230413-0002/", "creation_timestamp": "2025-03-05T21:35:05.000000Z"} 2025-03-05T21:35:05+00:00 https://db.gcve.eu/sighting/6eec1326-6aeb-4548-8741-5f6295b59c50/export 2026-07-28T21:09:47.365305+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "6eec1326-6aeb-4548-8741-5f6295b59c50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26052", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6561", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-26052\n\ud83d\udd25 CVSS Score: 3.7 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\ud83d\udd39 Description: Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12. \n\ud83d\udccf Published: 2023-03-02T18:54:33.030Z\n\ud83d\udccf Modified: 2025-03-05T16:10:59.226Z\n\ud83d\udd17 References:\n1. https://github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242\n2. https://github.com/saleor/saleor/releases/tag/3.1.48\n3. https://github.com/saleor/saleor/releases/tag/3.10.14\n4. https://github.com/saleor/saleor/releases/tag/3.11.12\n5. https://github.com/saleor/saleor/releases/tag/3.7.59\n6. https://github.com/saleor/saleor/releases/tag/3.8.30\n7. https://github.com/saleor/saleor/releases/tag/3.9.27", "creation_timestamp": "2025-03-05T16:32:27.000000Z"} 2025-03-05T16:32:27+00:00 https://db.gcve.eu/sighting/93bbdfe5-f705-43cd-9ba1-85cd6969f858/export 2026-07-28T21:09:47.365493+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "93bbdfe5-f705-43cd-9ba1-85cd6969f858", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26059", "type": "seen", "source": "Telegram/YY4S-YauUuBwS1Vc12ZZBfb4WwHICH0Hps4CWaQYIhbl60DL", "content": "", "creation_timestamp": "2025-02-06T02:41:38.000000Z"} 2025-02-06T02:41:38+00:00 https://db.gcve.eu/sighting/84a0b4bb-736d-4a71-bfbd-9cc02da1b1e5/export 2026-07-28T21:09:47.365631+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "84a0b4bb-736d-4a71-bfbd-9cc02da1b1e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26057", "type": "seen", "source": "https://t.me/cibsecurity/62803", "content": "\u203c CVE-2023-26057 \u203c\n\nAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-25T16:25:19.000000Z"} 2023-04-25T16:25:19+00:00 https://db.gcve.eu/sighting/1165fc56-a251-4aac-b1a7-aa4c750b70a8/export 2026-07-28T21:09:47.365766+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "1165fc56-a251-4aac-b1a7-aa4c750b70a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26058", "type": "seen", "source": "https://t.me/cibsecurity/62798", "content": "\u203c CVE-2023-26058 \u203c\n\nAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-25T16:25:13.000000Z"} 2023-04-25T16:25:13+00:00 https://db.gcve.eu/sighting/7a1811c1-3615-481d-86c5-98e3e2835811/export 2026-07-28T21:09:47.365894+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "7a1811c1-3615-481d-86c5-98e3e2835811", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26059", "type": "seen", "source": "https://t.me/cibsecurity/62754", "content": "\u203c CVE-2023-26059 \u203c\n\nAn issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zone behind a perimeter firewall and without exposure to the internet. The attack can only be performed by an internal user.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-24T22:19:50.000000Z"} 2023-04-24T22:19:50+00:00 https://db.gcve.eu/sighting/4bb88b23-a264-468c-8f3b-687fb65e8c83/export 2026-07-28T21:09:47.366019+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "4bb88b23-a264-468c-8f3b-687fb65e8c83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26054", "type": "seen", "source": "https://t.me/cibsecurity/59501", "content": "\u203c CVE-2023-26054 \u203c\n\nBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-06T22:13:00.000000Z"} 2023-03-06T22:13:00+00:00 https://db.gcve.eu/sighting/4b5e298b-71ac-4573-9567-2d2009252361/export 2026-07-28T21:09:47.366166+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "4b5e298b-71ac-4573-9567-2d2009252361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26055", "type": "seen", "source": "https://t.me/cibsecurity/59329", "content": "\u203c CVE-2023-26055 \u203c\n\nXWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-03T06:42:09.000000Z"} 2023-03-03T06:42:09+00:00 https://db.gcve.eu/sighting/e7fd6081-dd2a-4351-8b74-de3ace680c2c/export 2026-07-28T21:09:47.366295+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "e7fd6081-dd2a-4351-8b74-de3ace680c2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26056", "type": "seen", "source": "https://t.me/cibsecurity/59342", "content": "\u203c CVE-2023-26056 \u203c\n\nXWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-02T22:34:47.000000Z"} 2023-03-02T22:34:47+00:00 https://db.gcve.eu/sighting/2cf06786-5255-4099-932a-4a130d01ea9c/export 2026-07-28T21:09:47.366407+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "2cf06786-5255-4099-932a-4a130d01ea9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-26052", "type": "seen", "source": "https://t.me/cibsecurity/59341", "content": "\u203c CVE-2023-26052 \u203c\n\nSaleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-02T22:34:46.000000Z"} 2023-03-02T22:34:46+00:00