{"vulnerability": "cve-2026-5848", "sightings": [{"uuid": "823e80ec-c2ea-42cb-b4e7-59ca5e990fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-58480", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116884598388668562", "content": "Blocksy Companion Pro <2.1.47 has a CRITICAL unauthenticated file upload flaw (CVE-2026-58480). Attackers can bypass extension checks and achieve remote code execution via crafted filenames. Patch ASAP. https://radar.offseq.com/threat/cve-2026-58480-unrestricted-upload-of-file-with-da-329cbb8c3408e021 #OffSeq #CVE202658480 #WordPress #Vuln", "creation_timestamp": "2026-07-08T13:30:32.375874Z"}, {"uuid": "d049ebfd-9b3e-40ea-97a8-d9e0c1d2f266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-58480", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq5a3kmqpd2j", "content": "Blocksy Companion Pro for WordPress has a CRITICAL file upload vulnerability (CVE-2026-58480). Unauthenticated attackers can achieve RCE \u2014 update immediately if possible. https://radar.offseq.com/threat/cve-2026-58480-unrestricted-upload-of-file-with-da-329cbb8c3408e021 #OffSeq #WordPress #CVE202...", "creation_timestamp": "2026-07-08T13:30:34.392225Z"}, {"uuid": "33c4fe6c-de5b-492d-9279-c7a9e21cc6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq5cftox272w", "content": "CVE-2026-58480 - blocksy companion\nThe Blocksy Companion Pro plugin for WordPress is affected if it's version is less than 2.1.47. Attackers can upload malicious files, such as executable\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#blocksycompanion #creativethemes #CVE #infosec", "creation_timestamp": "2026-07-08T14:12:06.516593Z"}, {"uuid": "0ce95557-d6a1-4ffb-8f81-3ef07663f741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mq5e5errax26", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-58480](https://patchstack.com/database/wordpress/plugin/blocksy-companion/vulnerability...\nhttps://patchstack.com/database/wordpress/plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-1-46-unauthenticated-arbitrary-file-upload-vuln", "creation_timestamp": "2026-07-08T14:43:09.575692Z"}, {"uuid": "cf7a9d5b-9b12-459c-936d-f6c7f8996fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ka65ce62t", "content": "CVE-2026-58480 - Blocksy Companion Pro\nCVE ID : CVE-2026-58480\n \n Published : July 8, 2026, 2:17 p.m. | 42\u00a0minutes ago\n \n Description : Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attacker...", "creation_timestamp": "2026-07-08T16:32:06.805787Z"}, {"uuid": "3ddc6269-24f7-45a5-a5e1-a41dc88d4cb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mq6dcaeasa2p", "content": "Arbitrary file upload. No auth required. CVE-2026-58480. Blocksy Companion Pro before 2.1.47 lets any visitor execute code on your server. CVSS 9.8. No patch available yet. Disable it now. Scan: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "creation_timestamp": "2026-07-09T00:00:38.608370Z"}, {"uuid": "3d761d36-5e3b-4736-ab38-6dcd534bb13b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58486", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mql6gu5bqd2z", "content": "CVE-2026-58486 - HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter\nCVE ID : CVE-2026-58486\n \n Published : July 13, 2026, 11:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : HedgeDoc is an open source, real-time, collaborative, markdown notes application...", "creation_timestamp": "2026-07-14T02:38:21.762459Z"}, {"uuid": "525311da-24ac-43d5-9ddb-dd2bbe83ebee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58482", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wvh2mgm24", "content": "CVE-2026-58482 - Network-AI: ApprovalInbox HTTP server has no authentication \u2014 anyone can approve pending agent actions\nCVE ID : CVE-2026-58482\n \n Published : July 20, 2026, 5:18 p.m. | 26\u00a0minutes ago\n \n Description : Network-AI, a TypeScript/Node.js multi-agent orchestrator, ...", "creation_timestamp": "2026-07-20T18:38:36.832439Z"}, {"uuid": "2fc490f3-7b7e-4068-afcb-df403ccf6c1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58481", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3xfozvk223", "content": "CVE-2026-58481 - Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory\nCVE ID : CVE-2026-58481\n \n Published : July 20, 2026, 5:18 p.m. | 26\u00a0minutes ago\n \n Description : Network-AI is a TypeScript/Node.js multi-agent orchest...", "creation_timestamp": "2026-07-20T18:47:41.974798Z"}, {"uuid": "594f4a9f-d59b-4974-a828-5d4d0e6e95b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58484", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3yfyrhgv2s", "content": "CVE-2026-58484 - Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning\nCVE ID : CVE-2026-58484\n \n Published : July 20, 2026, 5:18 p.m. | 26\u00a0minutes ago\n \n Description : Network-AI is a TypeScript/Node.js multi-agent orchestr...", "creation_timestamp": "2026-07-20T19:05:56.650296Z"}, {"uuid": "1af44736-7e3d-42d0-a494-54bc55c530ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "https://t.me/GithubRedTeam/95218", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58480\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-26 09:51:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58480 / CVE-2026-15158 \u2014 Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-26T11:00:03.821221Z"}, {"uuid": "2a4c08ba-b4a5-4baa-9f34-9fd349c67649", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "Telegram/Pju2lk9uaKkbkjso0NTtdRvjd808czCF5fWgGC8yN_eU0QM", "content": "", "creation_timestamp": "2026-07-26T22:00:03.623119Z"}, {"uuid": "d4ff413e-2432-45e0-9ead-f4ee0b1ca5d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "Telegram/oYN9diVg7I38yCrVGgTerONHpAHmOmUvLdx-0Vt-uNCO0ik", "content": "", "creation_timestamp": "2026-07-26T15:00:28.757293Z"}, {"uuid": "db90a9bb-bbdc-4dba-a784-c4b4f23df0c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "seen", "source": "https://t.me/GithubRedTeam/95212", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58480-Blocksy-Companion-Pro-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-26 08:59:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58480 / CVE-2026-15158 \u2014 Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-26T10:00:06.408411Z"}, {"uuid": "7cdd90f0-9e2f-4e94-90ad-0c10e114d590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "published-proof-of-concept", "source": "Telegram/Pju2lk9uaKkbkjso0NTtdRvjd808czCF5fWgGC8yN_eU0QM", "content": "", "creation_timestamp": "2026-07-27T00:00:09.100909Z"}, {"uuid": "5c126073-9d45-493a-af93-fb9dbb9495a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "published-proof-of-concept", "source": "Telegram/oYN9diVg7I38yCrVGgTerONHpAHmOmUvLdx-0Vt-uNCO0ik", "content": "", "creation_timestamp": "2026-07-27T00:00:25.393014Z"}, {"uuid": "c605bffe-034c-4385-bf92-51f018f46512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95218", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58480\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-26 09:51:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58480 / CVE-2026-15158 \u2014 Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-27T00:00:30.114876Z"}, {"uuid": "e3f43bdb-224d-48bd-91fe-22f33a255a94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58480", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95212", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58480-Blocksy-Companion-Pro-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-26 08:59:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58480 / CVE-2026-15158 \u2014 Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-27T00:00:31.211055Z"}]}