Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-31 | 2 | Disclosure2 |
| 2026-09-30 | 1 | Disclosure1 |
got "new" CVEs CVE-2026-53500 CVE-2026-53501 https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9 https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537
Post summary
The tweet simply announces two newly disclosed CVEs (CVE‑2026‑53500 and CVE‑2026‑53501) and provides GitHub security advisory links, without mentioning PoCs, exploits, active exploitation, or patches.
🚨*CVE* CVE-2026-53500 Thumbor is an open-source photo thumbnail service by http://globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping … https://www.cve.org/CVERecord?id=CVE-2026-53500 ----- Traducción: CVE-… http://infoflow.cloud`
Post summary
The post references CVE‑2026‑53500 for Thumbor, noting a regex misuse before v7.8.0, but offers no PoC, exploit, or patch details.
CVE-2026-53500 Thumbor is an open-source photo thumbnail service by http://globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping … https://www.cve.org/CVERecord?id=CVE-2026-53500
Post summary
The text discloses that Thumbor versions prior to 7.8.0 have a configuration flaw involving unescaped regex matches, but it does not provide a PoC, exploit, or patch details.