CVE•Published 2026-07-27•Modified 2026-07-27•0 articles on news•4 live references•NVD data

CVE-2026-59528

Vulnerability data via NVD (ingested)

CVSS v3.1

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS percentile

—

Weaknesses (CWE)

CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere

Description

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.

Timeline

Published 2026-07-27

Modified 2026-07-27

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-59528

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-59528

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-59528

Censys host search filtered to this CVE id.

grep.app

CVE-2026-59528

Public source-code mentions — fast PoC discovery.

GitHub code

CVE-2026-59528

GitHub code search for direct mentions.

Google dork

"CVE-2026-59528" exploit -site:nvd.nist.gov

Write-ups and news, NVD excluded.

Known PoCs on GitHub (8)

CVE-2026-595288 repos

webpro255/awesome-ai-agent-attacksunknown

A curated timeline of real AI agent security incidents, breaches, and vulnerabilities (2024-2026). Every entry sourced and dated.

★ 44·updated 3d ago

kartik2005221/CVE-2025-58434-AND-59528-POCPython

Combined PoC for CVE-2025-28434 and CVE-2025-59528

★ 19·updated 3mo ago

mcp-security-project/mcp-cve-projectunknown

The Project shares all information on MCP related CVE's published

★ 19·updated 1w ago

zulloper/cve-pocPython

CVE POC repo 자동 수집기

★ 16·updated today

sattyamjjain/agent-airlockPython

A deny-by-default contract & type-checker layer for AI agent tool calls — Pydantic-based, in-process, zero-core-deps. Validates the actual tool-call payload (ghost-arg stripping, s…

★ 12·updated today

AzureADTrent/CVE-2025-58434-59528Python

CVE-2025-58434 and CVE-2025-59528 chain POC

★ 4·updated 3mo ago

0xDaeras/Flowise-CVE-2025-58434-Chain-59528Python

FlowiseAI CVE-2025-58434 & CVE-2025-59528 exploit PoC, demonstrating unauthenticated ATO via reset token leakage, followed by authenticated RCE. Includes a reproductible Docker lab…

★ 1·updated 2mo ago

exploitnotes/Hack-The-Box-WriteupsC

★ 1·updated 1mo ago

We haven't classified any articles referencing CVE-2026-59528 yet. The external references above still apply.