{"vulnerability": "CVE-2026-7258", "sightings": [{"uuid": "8b762ec0-c2e6-439e-a9b1-d9a80e814c56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7258", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mlczxuq7ac2w", "content": "\ud83d\udee1\ufe0f Security updates:\n\n- php-8.1.34-2 (in the php:remi-8.1 module)\n- php80-php-8.1.34-2 (in the php81 Software Collection)\n\nWith security fixes backported from 8.2.31 (CVE-2026-6735, CVE-2026-7259, CVE-2025-14179, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258)", "creation_timestamp": "2026-05-08T05:51:09.921786Z"}, {"uuid": "dee2e339-8f1a-43c3-8ce8-25cbb67efe06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7258", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mldbcc7rmn2e", "content": "9/18\n\nhttps://www.cve.org/CVERecord?id=CVE-2026-7568\n    https://www.cve.org/CVERecord?id=CVE-2026-7258\n    https://www.cve.org/CVERecord?id=CVE-2026-42371\n  (* Security fix *)\nxap/mozilla-firefox-140.10.2esr-x86_64-1.txz:  Upgraded.\n  This update contains security fixes and", "creation_timestamp": "2026-05-08T08:02:16.133614Z"}, {"uuid": "8f84a224-192c-4428-beb9-511658a084c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7258", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mli76aeqtq2t", "content": "CVE-2026-7258 - Out-of-bounds read in urldecode() on NetBSD\nCVE ID : CVE-2026-7258\n \n Published : May 10, 2026, 5:16 a.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some funct...", "creation_timestamp": "2026-05-10T07:07:28.859198Z"}, {"uuid": "96e387e6-8e13-45e1-a067-db8b64e73656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7258", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mlkr672pc225", "content": "\ud83d\udee1\ufe0f Security updates:\n\n- php-8.0.30-16 (in the php:remi-8.0 module)\n- php80-php-8.0.30-16 (in the php80 Software Collection)\n\nWith security fixes backported from 8.1.34 (CVE-2026-6735, CVE-2026-7259, CVE-2025-14179, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258)", "creation_timestamp": "2026-05-11T07:34:55.586729Z"}, {"uuid": "a37b3136-0fdb-4f27-a9c8-d00488cc9d5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7258", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mllakdpahl2k", "content": "\ud83d\udd17 CVE : CVE-2025-14179, CVE-2026-42371, CVE-2026-6104, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7263, CVE-2026-7568", "creation_timestamp": "2026-05-11T12:10:09.144763Z"}, {"uuid": "fe461836-f32c-4aa8-9641-c32add0b4d7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7258", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mlnbxdu4qk2i", "content": "\ud83d\udee1\ufe0f Security updates:\n\n- php-7.4.33-26 (in the php:remi-7.4 module)\n- php74-php-7.4.33-26 (in the php74 Software Collection)\n\nWith security fixes backported from 8.1.34 (CVE-2026-6735, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258)", "creation_timestamp": "2026-05-12T07:40:38.700467Z"}, {"uuid": "10b27a0e-219c-45f5-9471-3194758cb30a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72580", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mspzfwuvwd26", "content": "CVE-2026-72580 - xiaoai-patch\nA vulnerability in a patch for Xiaomi smart speakers allows a remote attacker to execute arbitrary system commands on affected devices. This could potentially disrupt the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#xiaoaipatch #duhow #CVE #infosec", "creation_timestamp": "2026-08-10T11:42:04.327326Z"}, {"uuid": "b892463f-2c1a-4ce9-bbf7-dd8ab57f4371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72589", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mspzfybvir2u", "content": "CVE-2026-72589 - crontab-ui\nThe Crontab UI, a software for managing scheduled tasks, is vulnerable to a security flaw that allows an attacker to execute arbitrary system commands without a password.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#crontabui #alseambusher #CVE #infosec", "creation_timestamp": "2026-08-10T11:42:05.573537Z"}, {"uuid": "944ccda3-7645-402d-8165-db341a957230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72581", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fg6gdf2cjbu76", "content": "CVE-2026-72581 - duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint\nCVE ID : CVE-2026-72581\n \n Published : Aug. 10, 2026, 11:17 a.m. | 43\u00a0minutes ago\n \n Description : A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb0704...", "creation_timestamp": "2026-08-10T12:04:41.812754Z"}, {"uuid": "88ae3bbc-10c8-48a0-ab58-482972ec1a40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72589", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/byddngx6ghhgb", "content": "CVE-2026-72589 - alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field\nCVE ID : CVE-2026-72589\n \n Published : Aug. 10, 2026, 11:17 a.m. | 43\u00a0minutes ago\n \n Description : An OS command injection vulnerability in alseambusher/crontab-u...", "creation_timestamp": "2026-08-10T12:24:41.892678Z"}, {"uuid": "6840c81d-c353-4fd2-b0af-9ae344041029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72585", "type": "seen", "source": "Telegram/hDDi_lD4Zf9-gI1Gn10sykTtiK4LT5_Zn07fv0DMntTOtvA", "content": "", "creation_timestamp": "2026-08-17T18:00:04.465739Z"}, {"uuid": "b2ee9799-4574-46db-8a3c-e60c32d3a10f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72582", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msqbktfscu22", "content": "CVE-2026-72582 - Unpatched DoS in fastschema \u2264v0.15.1. NULL pointer dereference crashes server via single HTTP request to /api/auth/local/recover. CVSS 7.5. No fix yet - monitor and restrict access. #CVE #infosec #DoS\n\nhttps://www.valtersit.com/cve/CVE-2026-72582/", "creation_timestamp": "2026-08-10T14:07:58.140785Z"}, {"uuid": "3356cf3d-dd88-4867-aab8-82b334c9bf47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72582", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117071601890559097", "content": "CVE-2026-72582 - Unpatched DoS in fastschema \u2264v0.15.1. NULL pointer dereference crashes server via single HTTP request to /api/auth/local/recover. CVSS 7.5. No fix yet - monitor and restrict access. #CVE #infosec #DoS\nhttps://www.valtersit.com/cve/CVE-2026-72582/", "creation_timestamp": "2026-08-10T14:08:50.316193Z"}, {"uuid": "3a913e8c-5db0-4570-b4d0-fb6f7beed246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72581", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msqel3mkyb22", "content": "CVE-2026-72581 - SSRF in duhow/xiaoai-patch lets attackers hit internal networks via Xiaomi smart speaker. CVSS 8.6. Unpatched. Block access or update once fixed. #CVE #infosec #IoT\n\nhttps://www.valtersit.com/cve/CVE-2026-72581/", "creation_timestamp": "2026-08-10T15:01:48.237081Z"}, {"uuid": "85edb4bf-b6e9-4df2-939d-e4e589da9540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72581", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117071813538439961", "content": "CVE-2026-72581 - SSRF in duhow/xiaoai-patch lets attackers hit internal networks via Xiaomi smart speaker. CVSS 8.6. Unpatched. Block access or update once fixed. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-72581/", "creation_timestamp": "2026-08-10T15:03:02.887586Z"}, {"uuid": "bf59107d-0374-41ac-a8d7-b1ec3075b7c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72585", "type": "published-proof-of-concept", "source": "Telegram/hDDi_lD4Zf9-gI1Gn10sykTtiK4LT5_Zn07fv0DMntTOtvA", "content": "", "creation_timestamp": "2026-08-18T00:00:12.251006Z"}, {"uuid": "00be2b23-d3ae-48d3-a67c-3dc9768b2e3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72585", "type": "seen", "source": "https://t.me/GithubRedTeam/98371", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-72585-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Nel-droid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 20:17:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC: Grafana Editor role deletes protected contact points (CVE-2026-72585, Medium 6.5)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:07.864155Z"}, {"uuid": "f95cb8d2-5f70-4bd0-85c1-bb138d13cc1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72585", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98371", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-72585-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Nel-droid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 20:17:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC: Grafana Editor role deletes protected contact points (CVE-2026-72585, Medium 6.5)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:06.810859Z"}]}