{"vulnerability": "CVE-2026-10658", "sightings": [{"uuid": "0486f7a5-ce3a-4c2e-aed4-95befce19767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10658", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116797540252277980", "content": "Zephyr <=4.4.0 Bluetooth Host ISO path has CVE-2026-10658 (HIGH). Missing SDU header length checks can cause denial of service (kernel assert) or OOB reads if CONFIG_BT_ISO_RX is enabled. Evaluate mitigations now. https://radar.offseq.com/threat/cve-2026-10658-vulnerability-in-zephyrproject-rtos-9bbc3a2423f55b2a #OffSeq #Zephyr #CVE #Bluetooth", "creation_timestamp": "2026-06-23T04:30:31.365124Z"}, {"uuid": "ea8c9546-ff77-4df9-9225-204ba7b3b3d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10658", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mowkw3za722p", "content": "CVE-2026-10658 (HIGH) affects Zephyr <=4.4.0 with CONFIG_BT_ISO_RX. Bluetooth ISO receive flaw can cause denial of service or OOB read. Restrict untrusted HCI ISO sources and check patch status: https://radar.offseq.com/threat/cve-2026-10658-vulnerability-in-zephyrproject-rtos-9bbc3a2423f55b2a #O...", "creation_timestamp": "2026-06-23T04:30:32.488402Z"}, {"uuid": "ec8e77d3-880e-4c15-a708-bfb44d1f740a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106584", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6zmfi4wh7ii4g", "content": "CVE-2026-106584 - OpenSSH ssh-keygen Daylight Saving Time Calculation Error\nCVE ID : CVE-2026-106584\n \n Published : Oct. 6, 2026, 8:47 p.m. | 27\u00a0minutes ago\n \n Description : In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Day...", "creation_timestamp": "2026-10-06T21:47:52.796152Z"}, {"uuid": "fe21b20a-87f6-4fda-b3a3-519065da95af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106585", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hsue4ijyxhme7", "content": "CVE-2026-106585 - OpenSSH Decompression Memory Exhaustion Vulnerability\nCVE ID : CVE-2026-106585\n \n Published : Oct. 6, 2026, 8:52 p.m. | 22\u00a0minutes ago\n \n Description : In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded...", "creation_timestamp": "2026-10-06T22:04:52.854842Z"}, {"uuid": "49a1efd0-d9a7-46d0-85e0-05a878d1b951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106583", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/irrsehdybqbzu", "content": "CVE-2026-106583 - OpenSSH Username Command Injection Vulnerability\nCVE ID : CVE-2026-106583\n \n Published : Oct. 7, 2026, 12:17 a.m. | 1\u00a0hour, 7\u00a0minutes ago\n \n Description : In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injec...", "creation_timestamp": "2026-10-07T01:59:58.370167Z"}]}