{"vulnerability": "CVE-2026-5802", "sightings": [{"uuid": "4fad81b3-7c94-4d15-8994-eb543be089d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5802", "type": "published-proof-of-concept", "source": "Telegram/viJYT7gg8S3gJ-1aMGboAArF-0q_OTu7PWcGdGBWd_FKwXc", "content": "", "creation_timestamp": "2026-04-09T01:27:18.000000Z"}, {"uuid": "5d935c99-9834-4b25-9573-bdd6dde23e34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "seen", "source": "Telegram/8sG8-znVA24HEgCSSOgSFdLJSscjGG_d1L2w-JFGPL2oE2E", "content": "", "creation_timestamp": "2026-07-30T01:00:03.106725Z"}, {"uuid": "4ae8a7b7-fa31-4c7f-b8e5-4352a7ad6562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "published-proof-of-concept", "source": "Telegram/8sG8-znVA24HEgCSSOgSFdLJSscjGG_d1L2w-JFGPL2oE2E", "content": "", "creation_timestamp": "2026-07-31T00:00:43.899813Z"}, {"uuid": "6a2065c5-0af8-477f-bcd6-4174e0814246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58028", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mplurpetfu26", "content": "CVE-2026-58028 - Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets\nCVE ID : CVE-2026-58028\n \n Published : July 1, 2026, 3:15 p.m. | 31\u00a0minutes ago\n \n Description : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross...", "creation_timestamp": "2026-07-01T15:52:56.630409Z"}, {"uuid": "fbf1db55-1f38-490d-ad27-6e29081afbaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58029", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpluujzji72j", "content": "CVE-2026-58029 - Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata\nCVE ID : CVE-2026-58029\n \n Published : July 1, 2026, 3:19 p.m. | 27\u00a0minutes ago\n \n Description : Vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is asso...", "creation_timestamp": "2026-07-01T15:54:31.320758Z"}, {"uuid": "d3251969-d059-4145-818b-bc7ca78829b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58026", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mplvfifk5b2q", "content": "CVE-2026-58026 - $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces\nCVE ID : CVE-2026-58026\n \n Published : July 1, 2026, 3:10 p.m. | 36\u00a0minutes ago\n \n Description : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wi...", "creation_timestamp": "2026-07-01T16:04:00.080087Z"}, {"uuid": "d3729add-e232-4835-a7eb-617453c0b569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58027", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mplvyeiqtn2t", "content": "CVE-2026-58027 - QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI\nCVE ID : CVE-2026-58027\n \n Published : July 1, 2026, 3:01 p.m. | 45\u00a0minutes ago\n \n Description : Exposure of Sensitive Information to an Unauthorized Actor vuln...", "creation_timestamp": "2026-07-01T16:14:33.647545Z"}, {"uuid": "23619f1d-4333-412b-ab41-307bf6216656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mplwmq2mzg2y", "content": "CVE-2026-58025 - Remote Code Execution via Unsafe Deserialization in LogItem Import\nCVE ID : CVE-2026-58025\n \n Published : July 1, 2026, 3:23 p.m. | 23\u00a0minutes ago\n \n Description : Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulner...", "creation_timestamp": "2026-07-01T16:26:04.001320Z"}, {"uuid": "ce731660-ed9e-45d5-9e3f-c556f0e8d21e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58024", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzalob7e2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58024 \u0432 Wikimedia: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\n\n\nhttps://kripta.biz/posts/F8D59D6E-DC9F-40B8-90C9-AF1622673240", "creation_timestamp": "2026-07-02T02:45:30.681839Z"}, {"uuid": "825b891d-63ac-4edd-a4f0-e69007a21e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58026", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzczpfxv2q", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58026 \u0432 Wikimedia: \u0443\u0433\u0440\u043e\u0437\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445\n\n\n\nhttps://kripta.biz/posts/74EA82F5-FA2E-485C-9826-04B880DA8143", "creation_timestamp": "2026-07-02T02:46:52.652847Z"}, {"uuid": "eb4100e0-d4e0-4893-8168-4595492168ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzi6sza72o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58025 \u0432 MediaWiki: \u0440\u0438\u0441\u043a\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445\n\n\n\nhttps://kripta.biz/posts/3D6B8A2A-82DC-4A8E-AC18-E91BA29EE5B6", "creation_timestamp": "2026-07-02T02:49:45.446005Z"}, {"uuid": "d6ed15cc-6087-46d6-8650-3358b5de2dcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58028", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzkujtyx27", "content": "CVE-2026-58028: \u0423\u0433\u0440\u043e\u0437\u0430 XSS-\u0430\u0442\u0430\u043a \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\n\n\n\nhttps://kripta.biz/posts/1B6188E6-6D15-4E24-8E6F-B857998B22E8", "creation_timestamp": "2026-07-02T02:51:15.632280Z"}, {"uuid": "8b4b8838-066c-4043-a028-c28e91fa8545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58029", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzlikquv2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58029 \u0432 MediaWiki: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0432\u0438\u043a\u0438-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/0055E0D9-76AB-4F22-9929-D5047912A1D2", "creation_timestamp": "2026-07-02T02:51:36.360526Z"}, {"uuid": "19be81b0-797c-4730-b3d3-4dafea5b5b2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58027", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn6yv7vvy2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58027 \u0432 Wikimedia: \u0443\u0433\u0440\u043e\u0437\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\n\n\nhttps://kripta.biz/posts/AE69A510-CB53-444A-A83A-D327D215E4FF", "creation_timestamp": "2026-07-02T04:28:34.408801Z"}, {"uuid": "6b9bebcb-3522-4b40-a355-494e559fa04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58029", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn6zexux52y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58029 \u0432 MediaWiki: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0432\u0438\u043a\u0438-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/21209854-73EE-48E5-AC4E-840F9A8A6BF3", "creation_timestamp": "2026-07-02T04:28:51.084917Z"}, {"uuid": "a16976a1-a165-4dae-abd0-7198f8820b48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58024", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn77mty652u", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58024 \u0432 Wikimedia: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\n\n\nhttps://kripta.biz/posts/11409EE2-8BFA-447C-868B-810C36C6CD44", "creation_timestamp": "2026-07-02T04:32:20.895310Z"}, {"uuid": "d0455ae1-ddc8-483f-8a36-59427e01b5f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7aar4gf2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58025 \u0432 MediaWiki: \u0440\u0438\u0441\u043a\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445\n\n\n\nhttps://kripta.biz/posts/905854AC-2530-4B22-92AD-26388418D4F1", "creation_timestamp": "2026-07-02T04:32:41.563337Z"}, {"uuid": "aacc24f7-d738-4a46-916f-07e69e060d64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58028", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7egx4oq2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58028: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u0441\u0430\u0439\u0442 \u043e\u0442 XSS-\u0430\u0442\u0430\u043a\n\n\n\nhttps://kripta.biz/posts/6A005DCC-FA83-434A-B6DC-76C8A41D008A", "creation_timestamp": "2026-07-02T04:35:02.163761Z"}, {"uuid": "d40e4682-bd5a-42a5-9033-485c7ade601e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58026", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7hcifrk2m", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58026 \u0432 Wikimedia: \u0443\u0433\u0440\u043e\u0437\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\n\n\nhttps://kripta.biz/posts/43EA00A7-F1EF-4AFE-8022-E403DB719747", "creation_timestamp": "2026-07-02T04:36:38.605699Z"}, {"uuid": "3bb7c656-342e-4cbd-a2cd-ff90f7492294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58026", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfqvvxnb2m", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58026 \u0432 Wikimedia: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\n\n\nhttps://kripta.biz/posts/D3C5D685-C745-41DA-BE9F-27A2C92A137E", "creation_timestamp": "2026-07-02T06:29:22.955802Z"}, {"uuid": "48525e50-e89e-4303-950b-e7aba57c49a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnflpf7ai2o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58025 \u0432 MediaWiki: \u0440\u0438\u0441\u043a\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445\n\n\n\nhttps://kripta.biz/posts/5E4E8B2E-0906-4546-8085-A9F86F00E788", "creation_timestamp": "2026-07-02T06:26:29.058991Z"}, {"uuid": "bce7d015-ba64-4a29-b7ab-7e0ec0de013a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58027", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfwqoolr2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58027 \u0432 Wikimedia: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\n\n\nhttps://kripta.biz/posts/7EA922C9-DC19-41E3-B066-513EB9BD2965", "creation_timestamp": "2026-07-02T06:32:38.791965Z"}, {"uuid": "401eb3d5-cf3a-49ab-bfc9-ec0685418b3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58028", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfxxobgj2b", "content": "CVE-2026-58028: \u0423\u0433\u0440\u043e\u0437\u0430 XSS-\u0430\u0442\u0430\u043a\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445\n\n\n\nhttps://kripta.biz/posts/0EB3F0A1-B569-485B-A49D-80B18F40C1AA", "creation_timestamp": "2026-07-02T06:33:20.380535Z"}, {"uuid": "bf0b32e7-c9f2-48dd-bd41-c0eeb4665f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58029", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpng2jcggq2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58029 \u0432 MediaWiki: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0432\u0438\u043a\u0438-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/109856E7-3479-4062-A0E7-E04DE2DE3BA4", "creation_timestamp": "2026-07-02T06:34:46.188122Z"}, {"uuid": "c33c0ef4-ea37-4b94-8664-c0b74c3cb07b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58024", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnhi5i23427", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58024 \u0432 Wikimedia: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\n\n\nhttps://kripta.biz/posts/67764072-16F0-4ADE-8FA7-0751880D5093", "creation_timestamp": "2026-07-02T07:00:16.441247Z"}, {"uuid": "8cf63384-a12b-4956-8792-6280fbbeae58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58023", "type": "seen", "source": "https://gist.github.com/prajnak/06b8b2c74ce416478b826c460d0061f8", "content": "# Apache Thrift 2026 CVEs are invisible to purl-matching SCA\n\n**TL;DR** \u2014 The August 2026 Apache Thrift advisories (fixed in `0.24.0`) carry\n**CPE identifiers only**. No `pkg:pypi` / `pkg:maven` purl is ever produced, so any\nSCA that matches code libraries by ecosystem+purl finds nothing to attach them to.\nAn image with `thrift==0.22.0` installed from PyPI scans **clean**.\n\nThis is reproducible in two `curl` calls against public APIs \u2014 no scanner licence,\nno private data.\n\n---\n\n## Reproduce in 30 seconds (no Docker needed)\n\n### 1. Ask OSV whether PyPI `thrift` 0.22.0 has known vulnerabilities\n\n```bash\ncurl -s -X POST https://api.osv.dev/v1/query \\\n  -d '{\"package\":{\"name\":\"thrift\",\"ecosystem\":\"PyPI\"},\"version\":\"0.22.0\"}'\n```\n\n```json\n{}\n```\n\nEmpty. Zero vulnerabilities.\n\n### 2. Now confirm the advisory exists \u2014 and explicitly names Python\n\n```bash\ncurl -s https://api.osv.dev/v1/vulns/CVE-2026-41608 | jq '{id, summary}'\n```\n\n```json\n{\n  \"id\": \"CVE-2026-41608\",\n  \"summary\": \"Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport\"\n}\n```\n\nThe advisory exists. Its own summary says **Python**. `0.22.0` is in range\n(fixed in `0.24.0`). Yet step 1 returns nothing.\n\n---\n\n## Root cause\n\n```bash\ncurl -s https://api.osv.dev/v1/vulns/CVE-2026-41608 | jq '.affected[0]'\n```\n\n```json\n{\n  \"ranges\": [\n    {\n      \"type\": \"GIT\",\n      \"repo\": \"https://github.com/apache/thrift\",\n      \"events\": [\n        { \"introduced\": \"0\" },\n        { \"fixed\": \"6d2ec95f450b4ce404afb8929ff479e68770141a\" }\n      ],\n      \"database_specific\": {\n        \"cpe\": \"cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*\",\n        \"extracted_events\": [\n          { \"introduced\": \"0\" },\n          { \"fixed\": \"0.24.0\" }\n        ],\n        \"source\": \"CPE_RANGE\"\n      }\n    }\n  ],\n  \"versions\": [\"last-before-0-10\"]\n}\n```\n\nThree things to notice:\n\n1. **There is no `package` key.** No ecosystem, no name, no purl. A purl-matching\n   engine has nothing to key on.\n2. `ranges[0].type` is **`GIT`**, not `ECOSYSTEM` \u2014 the range is a commit SHA,\n   auto-derived from a CPE (`\"source\": \"CPE_RANGE\"`).\n3. `versions` is `[\"last-before-0-10\"]` \u2014 a placeholder artifact of that\n   conversion, not a usable version list.\n\nThe upstream advisory was filed against the Apache Thrift *product* via CPE.\nNothing downstream ever binds it to `pkg:pypi/thrift`, `pkg:maven/org.apache.thrift/libthrift`,\n`pkg:npm/thrift`, or any other ecosystem package.\n\n---\n\n## Reproduce against a container image\n\n```dockerfile\n# Dockerfile\nFROM python:3.12-slim\nRUN pip install --no-cache-dir thrift==0.22.0\n```\n\n```bash\ndocker build -t thrift-cve-repro:0.22.0 .\n```\n\nConfirm the package and its metadata are present and discoverable:\n\n```bash\ndocker run --rm thrift-cve-repro:0.22.0 \\\n  sh -c 'pip show thrift | head -2; ls /usr/local/lib/python3.12/site-packages | grep -i thrift'\n```\n\n```\nName: thrift\nVersion: 0.22.0\nthrift\nthrift-0.22.0.dist-info\n```\n\nNow scan that image with any purl-matching SCA.\n\n**Expected:** at least CVE-2026-41608, CVE-2026-48586, CVE-2026-43871 reported,\nfixed in `0.24.0`.\n\n**Actual:** zero findings for `thrift`. The SBOM correctly lists\n`thrift 0.22.0 (PyPI)` \u2014 discovery works fine. Only *matching* fails.\n\n---\n\n## Which advisories actually apply to a Python deployment\n\nApache Thrift published 18 advisories fixed in `0.24.0`. **Only three name the\nPython bindings.** These are the ones a PyPI `thrift` install is exposed to:\n\n| CVE | Bindings named in the advisory | CVSS |\n|---|---|---|\n| CVE-2026-41608 | **Python** only | 7.5 |\n| CVE-2026-48586 | C++, Java, **Python**, Go, D, C/GLib | 7.5 |\n| CVE-2026-43871 | **Python**, Go, PHP, Java | 7.5 |\n\nAll three: `AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H` \u2014 remote unauthenticated\ndenial of service against anything deserializing untrusted Thrift payloads.\n\nThe other 15 do **not** apply to a Python deployment. They are C++, c_glib,\nSwift, Rust, Node.js, Go and Java binding bugs \u2014 `TSSLSocket::matchName`,\n`web_server.js`, `TFramedTransport` uint32 overflow, and similar. None of that\ncode ships in the PyPI package.\n\nVerify any of them yourself:\n\n```bash\nfor c in CVE-2026-55971 CVE-2026-58023 CVE-2026-41604 CVE-2026-41602; do\n  curl -s \"https://api.osv.dev/v1/vulns/$c\" | jq -r '\"\\(.id)  \\(.summary)\"'\ndone\n```\n\n```\nCVE-2026-55971  Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()\nCVE-2026-58023  Apache Thrift: c_glib heap out-of-bounds read in transport\nCVE-2026-41604  Apache Thrift: Swift Range crash in skip()\nCVE-2026-41602  Apache Thrift: Go TFramedTransport uint32 overflow\n```\n\n---\n\n## What a fix should look like\n\nAdd ecosystem/purl mappings **per binding**, driven by the bindings each advisory\nnames in its own text:\n\n```\nCVE-2026-41608  ->  pkg:pypi/thrift                         (< 0.24.0)\nCVE-2026-48586  ->  pkg:pypi/thrift, pkg:maven/org.apache.thrift/libthrift, ...\nCVE-2026-43871  ->  pkg:pypi/thrift, pkg:maven/..., pkg:composer/...\n```\n\n## What a fix should **not** look like\n\nDo not blanket-CPE-match ecosystem packages against `cpe:2.3:a:apache:thrift`.\n\nA scanner that does this reports **all 18** against `thrift 0.22.0`, including\n~14 rated Critical \u2014 because it inherits per-binding CVSS scores from bindings\nthat aren't installed. That is roughly **5\u00d7 over-reported** for a Python\ndeployment, and triaging it back down to the real three costs more time than the\noriginal finding saved.\n\nThe gap here is precision *and* recall: three real findings are missed, and the\nnaive fix would introduce fifteen false ones.\n\n---\n\n## Wider question\n\nApache Thrift is unlikely to be unique. The pattern is: **one upstream project,\nmany language bindings, advisories filed at product level with CPE only**.\nOther multi-binding projects (protobuf, gRPC, Avro, Arrow, ICU, libxml2\nwrappers) plausibly share it.\n\nTwo things that would help anyone consuming this data:\n\n1. A way to report on SBOM components whose only matching advisories are\n   CPE-only \u2014 i.e. *where am I blind right now?*\n2. Systematic per-binding purl mapping where an advisory's text names the\n   affected bindings, rather than case-by-case backfill.\n\n---\n\n*Verified 2026-08-27 against `api.osv.dev`. Everything above uses public APIs and\npublic package data; no scanner output or private environment data is included.*\n", "creation_timestamp": "2026-08-27T11:48:03.153505Z"}, {"uuid": "d9c5e3e3-3aa4-4630-bb3f-fc81cab93b86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58023", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgjss4sl32u", "content": "CVE-2026-58023: Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path", "creation_timestamp": "2026-07-24T23:43:46.073257Z"}, {"uuid": "455c462e-2246-4af2-b447-dd336a17eb59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-58023", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/apache-security-advisory-av26-749", "content": "", "creation_timestamp": "2026-07-28T17:22:15.674086Z"}, {"uuid": "5d94005a-d2e9-4d6c-abf1-db46d1759277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "seen", "source": "https://t.me/GithubRedTeam/95734", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58025\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 18:18:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58025 \u2014 MediaWiki Deserialization RCE via Log Entry Import. LogEntryBase::extractParams() unserialize() user-controlled log_params. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T21:00:09.780389Z"}, {"uuid": "b7461c7a-8647-4e71-b210-6b8a58787a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58025", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95734", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58025\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 18:18:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58025 \u2014 MediaWiki Deserialization RCE via Log Entry Import. LogEntryBase::extractParams() unserialize() user-controlled log_params. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:08.836228Z"}]}