{"vulnerability": "CVE-2026-5626", "sightings": [{"uuid": "853dfdcd-6d8c-4fad-a576-3622c16fd2f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56267", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moqobjpz2b22", "content": "CVE-2026-56267 - Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint\nCVE ID : CVE-2026-56267\n \n Published : June 20, 2026, 3:24 p.m. | 4\u00a0hours, 18\u00a0minutes ago\n \n Description : Flowise before 3.0.13 contains an information exposure vulnerability in the POST /a...", "creation_timestamp": "2026-06-20T20:14:38.097951Z"}, {"uuid": "1b9bd560-7a90-4723-a607-326052025021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56265", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motnjm7sut2j", "content": "\ud83d\udea8  ALERT: CVE-2026-56265\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nCrawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authenticat", "creation_timestamp": "2026-06-22T00:39:16.503671Z"}, {"uuid": "b31bbcc9-42d1-42aa-a1ef-09b4552f7a33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56266", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mow2r6nrfg2o", "content": "CVE-2026-56266 - Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints\nCVE ID : CVE-2026-56266\n \n Published : June 22, 2026, 9:04 p.m. | 2\u00a0hours, 5\u00a0minutes ago\n \n Description : Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl...", "creation_timestamp": "2026-06-22T23:41:27.099909Z"}, {"uuid": "455ee7f6-5029-4720-bfc1-c1ea234be4b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56268", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-c2c9-mfw7-p8hw", "content": "", "creation_timestamp": "2026-05-20T15:45:19.000000Z"}, {"uuid": "e06d09a9-da67-4391-b59e-6a616ae54d9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56265", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpceht2wcr2h", "content": "\ud83d\udccc CVE-2026-56265 - Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers w... https://www.cyberhub.blog/cves/CVE-2026-56265", "creation_timestamp": "2026-06-27T21:07:07.532750Z"}, {"uuid": "1fa436d6-4680-4c83-8138-939c0ca1aed5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56264", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpklg64alo25", "content": "CVE-2026-56264 - Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint\nCVE ID : CVE-2026-56264\n \n Published : June 30, 2026, 10:08 p.m. | 3\u00a0hours, 4\u00a0minutes ago\n \n Description : Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the ...", "creation_timestamp": "2026-07-01T03:32:45.714545Z"}, {"uuid": "9e37d363-1eff-4b76-8ae4-ba7429c38923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56264", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpzmrtboah2b", "content": "\ud83d\udccc CVE-2026-56264 - Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and exec... https://www.cyberhub.blog/cves/CVE-2026-56264", "creation_timestamp": "2026-07-07T03:07:07.657463Z"}, {"uuid": "76a81877-94c1-4cec-b54d-dd22d3ab6771", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56261", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqclthdrpr2f", "content": "CVE-2026-56261\nThe Crawl4AI software before version 0.8.7 has a security weakness that allows an attacker to trick the system into accessing internal services and potentially reveal sensitive cloud data. This can happen if an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T16:44:05.212255Z"}, {"uuid": "120386a4-fcbe-4c43-a8a6-78d3ce62b835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56261", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7rjqh62r", "content": "\ud83d\udfe0 CVE-2026-56261 - High (8.6)\n\nCrawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker A...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56261/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T07:01:38.110888Z"}, {"uuid": "d45b1593-2cdc-495f-b7e7-185264221b49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6poejfa2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56260 \u0432 Crawl4AI: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 Docker\n\n\n\nhttps://kripta.biz/posts/FB071A08-3AE6-4DF0-A3B7-3BA4CB1F7921", "creation_timestamp": "2026-07-12T12:32:38.956763Z"}, {"uuid": "74bb83b8-dcd6-4268-9fce-ef9daea6c0b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqh7qnobqh2k", "content": "CVE-2026-56260 - Crawl4AI - Arbitrary File Write via output_path Parameter\nCVE ID : CVE-2026-56260\n \n Published : July 12, 2026, 12:16 p.m. | 16\u00a0minutes ago\n \n Description : Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screen...", "creation_timestamp": "2026-07-12T12:51:06.039335Z"}, {"uuid": "3b18e519-1d51-42a0-82fc-1db020bf5b50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhac725cf2b", "content": "\ud83d\udd34 CVE-2026-56260 - Critical (9.1)\n\nCrawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56260/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T13:00:54.068294Z"}, {"uuid": "c9569b76-f3c3-4a71-9bb9-ae1a1fdbc0a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqk3kkaozt2w", "content": "CVE-2026-56260 - crawl4ai\nThe Crawl4AI software before version 0.8.7 allows attackers to write malicious files to the server. This could cause the server to crash or become unusable. To fix this,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#crawl4ai #kidocode #pip #CVE #infosec", "creation_timestamp": "2026-07-13T16:14:04.462119Z"}, {"uuid": "7baa16f2-0005-4988-84ab-52d6510d2e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkn3kyhcg2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56260 \u0432 Crawl4AI: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 Docker\n\n\n\nhttps://kripta.biz/posts/9A5A5E91-88F5-4EC8-AE32-5DE568475832", "creation_timestamp": "2026-07-13T21:27:49.129882Z"}, {"uuid": "0d385cd3-af96-48c6-ac59-ed6e814b030f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56261", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqla2bb64t2o", "content": "\ud83d\udccc CVE-2026-56261 - Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which ... https://www.cyberhub.blog/cves/CVE-2026-56261", "creation_timestamp": "2026-07-14T03:07:06.805328Z"}, {"uuid": "a204e4fd-6ea7-4425-a67b-c4ba10457d7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlam4nwk32c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56260 \u0432 Crawl4AI: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 Docker\n\n\n\nhttps://kripta.biz/posts/5122B60A-D9B6-4729-94C8-EF051C65A4E3", "creation_timestamp": "2026-07-14T03:17:05.637338Z"}, {"uuid": "db01be4d-ba22-4a74-b46f-fdedb7355d1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqobbn4zxz2m", "content": "\ud83d\udccc CVE-2026-56260 - Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parame... https://www.cyberhub.blog/cves/CVE-2026-56260", "creation_timestamp": "2026-07-15T08:07:07.216262Z"}, {"uuid": "b8de7365-0579-4eed-9481-e5b3b428dcde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56260", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrxd4vj22b", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e7\u05e9\u05d4 \u05d1-Crawl4AI: \u05de\u05d4 \u05d0\u05ea\u05d4 \u05e6\u05e8\u05d9\u05da \u05dc\u05d3\u05e2\u05ea \u05e2\u05dc CVE-2026-56260\n\n\n\nhttps://khesef.xyz/posts/2CB316DA-1965-42D5-A82E-22BAB6BBFEA1", "creation_timestamp": "2026-07-16T08:10:54.214607Z"}, {"uuid": "b5759341-5d15-40d8-98ac-fff2e1a9abff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5626", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5626", "content": "", "creation_timestamp": "2026-07-29T08:15:06.479843Z"}]}